This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new f4998a4812cf docs: Document Bouncy Castle 1.85 migration for Camel
4.18.6 (#28191)
f4998a4812cf is described below
commit f4998a4812cfcd29d6df93303be7e193cd76896a
Author: Roman Stepaniuk <[email protected]>
AuthorDate: Wed Oct 21 06:44:29 2026 +0200
docs: Document Bouncy Castle 1.85 migration for Camel 4.18.6 (#28191)
Add the upgrade note requested in #26519 for PQC parameter/provider
changes, legacy key migration and the SPHINCSPLUS default.
Co-authored-by: Codex <[email protected]>
---
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index a6c938e75b24..d7592015ed91 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -313,6 +313,19 @@ as `Failed to connect, because a certificate or security
check failed`. To resto
The certificate that the user name and password are encrypted with is checked
by the same validator. Endpoints that
use the security policy `None` are not affected.
+=== camel-pqc - Bouncy Castle 1.85
+
+Camel 4.18.6 upgrades Bouncy Castle from 1.83 to 1.85. `DILITHIUM`,
`SPHINCSPLUS` and `KYBER`
+now use ML-DSA, SLH-DSA and ML-KEM through the `BC` provider. The Camel option
names are unchanged.
+
+Replace `DilithiumParameterSpec`, `SPHINCSPlusParameterSpec` and
`KyberParameterSpec` in user code
+with `MLDSAParameterSpec`, `SLHDSAParameterSpec` and `MLKEMParameterSpec` from
+`org.bouncycastle.jcajce.spec`, and use the `BC` provider when creating key
material.
+Previously stored Dilithium and SPHINCS+ keys must be regenerated; update
peers that use their public keys.
+
+The default `SPHINCSPLUS` parameter set changes from `haraka_256s` (NIST
category 5)
+to `slh_dsa_sha2_128s` (category 1). Use an SLH-DSA 256-bit parameter set if
category 5 is required.
+
=== camel-pqc - a configured KeyGenerator is used by one exchange at a time
When Camel creates the instance itself, the KEM operations of the `pqc`
component and the PQC data format now use a
