oscerd opened a new pull request, #25944: URL: https://github.com/apache/camel/pull/25944
Backport to `camel-4.22.x` of five fixes already reviewed and merged on `main`. These are grouped together because each **changes a default or adds a check that was not there before**, so they deserve a closer look than the other backports in this wave before going into a patch release. - CAMEL-24454: camel-mllp - default `logPhi` to false and honour it on the paths that ignored it (#25832, `dd2bf571`) - CAMEL-24443: camel-knative - do not trust every certificate when SSL is enabled without a truststore (#25824, `26c899d8`) - CAMEL-24437: camel-oauth - bind the authorization code callback to the flow with a state parameter (#25821, `495c5ad3`) - CAMEL-24439: camel-shiro - verify the presented credentials on every exchange (#25822, `6f72ae64`) - CAMEL-24441: camel-crypto-pgp - require integrity protection when decrypting (#25848, `9d3108de`) **What changes for an existing deployment:** - camel-mllp stops writing HL7 payload content to the log unless `logPhi=true` is set explicitly. Previously it defaulted to on, and two paths logged regardless of the setting. - camel-knative with SSL enabled but no truststore configured no longer falls back to trusting every certificate. Such a deployment now needs a truststore, or `trustAll` set deliberately. - camel-oauth rejects an authorization-code callback whose `state` does not match the one issued for that session. A deployment behind a proxy that drops or rewrites the callback query string would start seeing 400s. - camel-shiro verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. `alwaysReauthenticate=false` keeps the old behaviour. - camel-crypto-pgp refuses a decryption whose message has no integrity packet. `requireIntegrityProtection=false` restores the old acceptance. Straight cherry-picks, applied in the order they merged on `main`. One mechanical adaptation, folded into the CAMEL-24437 commit: the new cases in `OAuthProcessorFailClosedTest` use JUnit assertions, since `camel-oauth` has no assertj test dependency on this branch and the rest of that file is JUnit. The upgrade-guide entries are not included: the guides for every line live on `main`. Built and tested per module on this branch (`core`, `camel-crypto-pgp`, `camel-knative-http`, `camel-mllp`, `camel-oauth`, `camel-shiro`), including the new and touched tests: `PGPRequireIntegrityProtectionTest`, `PGPDataFormatTest`, `KnativeSslClientOptionsTrustTest`, `KnativeHttpTest`, `LogPhiTest`, `Hl7UtilTest`, `OAuthProcessorFailClosedTest`, `ShiroAuthenticationCredentialAlwaysCheckedTest`. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
