oscerd opened a new pull request, #27442: URL: https://github.com/apache/camel/pull/27442
## Summary Adds the missing `security = "insecure:serialization"` annotation to the `requireClassRegistration` option in `camel-fory`. ## Motivation The `requireClassRegistration` option controls whether Apache Fory enforces class allowlisting during deserialization. When set to `false`, Fory will deserialize any class present in the wire payload. Every other component that exposes a similar unsafe-deserialization opt-in (30+ components: `camel-avro`, `camel-jms`, `camel-netty`, `camel-mina`, etc.) carries `security = "insecure:serialization"`. This annotation enables the Camel security policy framework (`camel.main.profile=prod`) to detect and reject unsafe configuration at startup. The `requireClassRegistration` field was missing this annotation. The default value is `true` (safe), so this is a hardening/annotation gap rather than a default exposure. ## Changes - `ForyDataFormat.java` (runtime): added `@Metadata(label = "security", security = "insecure:serialization", insecureValue = "false")` to the `requireClassRegistration` field - `ForyDataFormat.java` (model): updated `@Metadata` to include `label = "security"`, `security = "insecure:serialization"`, and `insecureValue = "false"` - Regenerated all metadata JSON files (`fory.json` in component, model, and catalog) ## Testing No functional change — annotation only. Verified via `mvn install -Dquickly` on `camel-fory`, `camel-core-model`, and `catalog/camel-catalog`. _Bob on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
