You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/07/10 09:20:53 UTC
[PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
oscerd opened a new pull request, #24573:
URL: https://github.com/apache/camel/pull/24573
JIRA: https://issues.apache.org/jira/browse/CAMEL-23979
Exposes the published Apache Camel CVE security advisories (the data behind https://camel.apache.org/security/) to tooling, following the approach suggested by @davsclaus on the issue: the advisories are synced from camel-website into a JSON file shipped with `camel-catalog`, the same way the known releases are synced, and the MCP server consumes the catalog fully offline.
## Changes
### camel-tooling-model
- New `SecurityAdvisoryModel` (cve, date, severity, summary, affected, fixed, mitigation, url, components) with `JsonMapper` serialization support.
### camel-package-maven-plugin
- New `update-security-advisories` goal mirroring `update-camel-releases`: scans `content/security/CVE-*.md` in the camel-website repository via the GitHub contents API, parses the YAML front matter (snakeyaml-engine, already a plugin dependency), skips drafts and non-advisory pages, extracts the `camel-*` component tokens named by the advisory text, and writes `camel-security-advisories.json` into camel-catalog `src/generated`.
### camel-catalog
- New `update-security-advisories` profile wiring the goal (run it like the releases sync: `mvn -Pupdate-security-advisories generate-resources` in `catalog/camel-catalog`).
- Generated `advisories/camel-security-advisories.json` (currently 76 published advisories).
- New `CamelCatalog.camelSecurityAdvisories()` API following the `camelReleases()` pattern.
### camel-jbang-mcp
- New `camel_security_advisories` tool: lists the published advisories, optionally filtered by Camel version, component and severity. The `affected` prose is parsed best-effort (`X before Y` exclusive ranges, `X up to Y` inclusive ranges, bare versions) into an `affectsGivenVersion` verdict; advisories whose ranges cannot be parsed are kept with the verdict unset so the LLM judges from the prose.
- New MCP resources `camel://security/advisories` (list) and `camel://security/advisory/{cve}` (detail).
- `camel_route_harden_context` now embeds the known CVE advisories affecting the components used by the route at the given Camel version (matched via catalog artifact ids, capped at 20, failures degrade to a note without breaking the hardening analysis).
- When the catalog carries no advisory data, the tools report it explicitly instead of returning an empty list, so a missing data set is never mistaken for "no known CVEs".
### Docs
- `camel-jbang-mcp.adoc`: new tool row, advisory data source/freshness section, usage example.
## Data freshness semantics
The advisory data is as fresh as the catalog bundled with the release (same model as the known releases data); the tool description and docs state explicitly that advisories published after the release are not included and link to the website for the latest. The TUI CVE audit tab (OSV.dev, dependency-level) remains complementary; a possible follow-up is sharing `OsvClient` and offering a dependency CVE audit tool in the MCP server too.
## Testing
- `UpdateSecurityAdvisoriesMojoTest`: front-matter parsing against canned copies of two real advisories (recent + 2013-style), draft/non-advisory skipping, JsonMapper round-trip (4 tests).
- `CamelCatalogTest#camelSecurityAdvisories`: validates the shipped JSON through the new API.
- MCP module: `AdvisoryServiceTest`, `AdvisoryToolsTest`, `AdvisoryResourcesTest`, `HardenToolsAdvisoryTest` (20 tests) — catalog loading, both affected-range grammars, filtering, harden embedding/degradation. All fully offline.
- Full module test suites green: camel-package-maven-plugin (50), camel-catalog (981), camel-jbang-mcp (300).
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24573:
URL: https://github.com/apache/camel/pull/24573#issuecomment-4934985594
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `catalog/camel-catalog`
- `docs`
- `dsl/camel-jbang/camel-jbang-mcp`
- `tooling/camel-tooling-model`
- `tooling/maven/camel-package-maven-plugin`
> :information_source: Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the `test-dependents` label to force testing all dependents.
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 570 tested, 27 compile-only — current: 80 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **597 affected modules** (current approach: 80).
<details><summary>:warning: Modules only in Scalpel (596)</summary>
- `apache-camel`
- `archetypes`
- `camel-a2a`
- `camel-activemq`
- `camel-activemq6`
- `camel-ai-parent`
- `camel-allcomponents`
- `camel-amqp`
- `camel-api`
- `camel-api-component-maven-plugin`
- `camel-arangodb`
- `camel-archetype-api-component`
- `camel-archetype-component`
- `camel-archetype-dataformat`
- `camel-archetype-java`
- `camel-archetype-main`
- `camel-archetype-spring`
- `camel-as2`
- `camel-as2-api`
- `camel-as2-parent`
- `camel-asn1`
- `camel-asterisk`
- `camel-atmosphere-websocket`
- `camel-atom`
- `camel-attachments`
- `camel-avro`
- `camel-avro-rpc`
- `camel-avro-rpc-jetty`
- `camel-avro-rpc-parent`
- `camel-avro-rpc-spi`
- `camel-aws-bedrock`
- `camel-aws-cloudtrail`
- `camel-aws-common`
- `camel-aws-config`
- `camel-aws-parameter-store`
- `camel-aws-parent`
- `camel-aws-secrets-manager`
- `camel-aws-security-hub`
- `camel-aws2-athena`
- `camel-aws2-comprehend`
- `camel-aws2-cw`
- `camel-aws2-ddb`
- `camel-aws2-ec2`
- `camel-aws2-ecs`
- `camel-aws2-eks`
- `camel-aws2-eventbridge`
- `camel-aws2-iam`
- `camel-aws2-kinesis`
- `camel-aws2-kms`
- `camel-aws2-lambda`
- `camel-aws2-mq`
- `camel-aws2-msk`
- `camel-aws2-polly`
- `camel-aws2-redshift`
- `camel-aws2-rekognition`
- `camel-aws2-s3`
- `camel-aws2-s3-vectors`
- `camel-aws2-ses`
- `camel-aws2-sns`
- `camel-aws2-sqs`
- `camel-aws2-step-functions`
- `camel-aws2-sts`
- `camel-aws2-textract`
- `camel-aws2-timestream`
- `camel-aws2-transcribe`
- `camel-aws2-translate`
- `camel-azure-common`
- `camel-azure-cosmosdb`
- `camel-azure-eventgrid`
- `camel-azure-eventhubs`
- `camel-azure-files`
- `camel-azure-functions`
- `camel-azure-key-vault`
- `camel-azure-parent`
- `camel-azure-schema-registry`
- `camel-azure-servicebus`
- `camel-azure-storage-blob`
- `camel-azure-storage-datalake`
- `camel-azure-storage-queue`
- `camel-barcode`
- `camel-base`
- `camel-base-engine`
- `camel-base64`
- `camel-bean`
- `camel-bean-validator`
- `camel-beanio`
- `camel-bindy`
- `camel-bonita`
- `camel-box`
- `camel-box-api`
- `camel-box-parent`
- `camel-braintree`
- `camel-browse`
- `camel-caffeine`
- `camel-camunda`
- `camel-cassandraql`
- `camel-catalog`
- `camel-catalog-common`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-cbor`
- `camel-chatscript`
- `camel-chunk`
- `camel-cli-connector`
- `camel-cli-debug`
- `camel-clickup`
- `camel-cloudevents`
- `camel-cluster`
- `camel-cm-sms`
- `camel-coap`
- `camel-cometd`
- `camel-component-maven-plugin`
- `camel-componentdsl`
- `camel-console`
- `camel-consul`
- `camel-controlbus`
- `camel-core`
- `camel-core-all`
- `camel-core-catalog`
- `camel-core-engine`
- `camel-core-languages`
- `camel-core-model`
- `camel-core-processor`
- `camel-core-reifier`
- `camel-core-xml`
- `camel-couchbase`
- `camel-couchdb`
- `camel-cron`
- `camel-crypto`
- `camel-crypto-pgp`
- `camel-csimple-joor`
- `camel-csimple-maven-plugin`
- `camel-csv`
- `camel-cxf-common`
- `camel-cxf-parent`
- `camel-cxf-rest`
- `camel-cxf-soap`
- `camel-cxf-spring-common`
- `camel-cxf-spring-rest`
- `camel-cxf-spring-soap`
- `camel-cxf-spring-transport`
- `camel-cxf-transport`
- `camel-cyberark-vault`
- `camel-dapr`
- `camel-dataformat`
- `camel-dataset`
- `camel-datasonnet`
- `camel-debezium-common`
- `camel-debezium-common-parent`
- `camel-debezium-db2`
- `camel-debezium-maven-plugin`
- `camel-debezium-mongodb`
- `camel-debezium-mysql`
- `camel-debezium-oracle`
- `camel-debezium-parent`
- `camel-debezium-postgres`
- `camel-debezium-sqlserver`
- `camel-debug`
- `camel-dependencies`
- `camel-dfdl`
- `camel-dhis2`
- `camel-dhis2-api`
- `camel-dhis2-parent`
- `camel-diagram`
- `camel-digitalocean`
- `camel-direct`
- `camel-disruptor`
- `camel-djl`
- `camel-dns`
- `camel-docker`
- `camel-docling`
- `camel-drill`
- `camel-dropbox`
- `camel-dsl-modeline`
- `camel-dsl-support`
- `camel-dynamic-router`
- `camel-ehcache`
- `camel-eip-documentation-enricher-maven-plugin`
- `camel-elasticsearch`
- `camel-elasticsearch-rest-client`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-event`
- `camel-exec`
- `camel-fastjson`
- `camel-fhir`
- `camel-fhir-api`
- `camel-fhir-parent`
- `camel-file`
- `camel-file-watch`
- `camel-flatpack`
- `camel-flink`
- `camel-flowable`
- `camel-fop`
- `camel-fory`
- `camel-freemarker`
- `camel-ftp`
- `camel-ftp-common`
- `camel-geocoder`
- `camel-git`
- `camel-github2`
- `camel-google-bigquery`
- `camel-google-calendar`
- `camel-google-common`
- `camel-google-drive`
- `camel-google-firestore`
- `camel-google-functions`
- `camel-google-mail`
- `camel-google-parent`
- `camel-google-pubsub`
- `camel-google-secret-manager`
- `camel-google-sheets`
- `camel-google-speech-to-text`
- `camel-google-storage`
- `camel-google-text-to-speech`
- `camel-google-vertexai`
- `camel-google-vision`
- `camel-graphql`
- `camel-grok`
- `camel-groovy`
- `camel-grpc`
- `camel-gson`
- `camel-hashicorp-vault`
- `camel-hazelcast`
- `camel-headersmap`
- `camel-health`
- `camel-hl7`
- `camel-http`
- `camel-http-base`
- `camel-http-common`
- `camel-huawei-parent`
- `camel-huaweicloud-common`
- `camel-huaweicloud-dms`
- `camel-huaweicloud-frs`
- `camel-huaweicloud-functiongraph`
- `camel-huaweicloud-iam`
- `camel-huaweicloud-imagerecognition`
- `camel-huaweicloud-obs`
- `camel-huaweicloud-smn`
- `camel-huggingface`
- `camel-ibm-cos`
- `camel-ibm-parent`
- `camel-ibm-secrets-manager`
- `camel-ibm-watson-discovery`
- `camel-ibm-watson-language`
- `camel-ibm-watson-speech-to-text`
- `camel-ibm-watson-text-to-speech`
- `camel-ibm-watsonx-ai`
- `camel-ibm-watsonx-data`
- `camel-ical`
- `camel-iec60870`
- `camel-iggy`
- `camel-ignite`
- `camel-infinispan`
- `camel-infinispan-common`
- `camel-infinispan-embedded`
- `camel-infinispan-parent`
- `camel-influxdb`
- `camel-influxdb2`
- `camel-irc`
- `camel-ironmq`
- `camel-iso8583`
- `camel-itest`
- `camel-jackson`
- `camel-jackson-avro`
- `camel-jackson-protobuf`
- `camel-jackson3`
- `camel-jackson3-avro`
- `camel-jackson3-protobuf`
- `camel-jackson3xml`
- `camel-jacksonxml`
- `camel-jandex`
- `camel-jasypt`
- `camel-java-io`
- `camel-java-joor-dsl`
- `camel-javascript`
- `camel-jaxb`
- `camel-jbang-console`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-mcp`
- `camel-jbang-parent`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-test`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-jcache`
- `camel-jcr`
- `camel-jdbc`
- `camel-jetty`
- `camel-jetty-common`
- `camel-jfr`
- `camel-jgroups`
- `camel-jgroups-raft`
- `camel-jira`
- `camel-jms`
- `camel-jmx`
- `camel-jolt`
- `camel-jooq`
- `camel-joor`
- `camel-jpa`
- `camel-jq`
- `camel-jsch`
- `camel-jslt`
- `camel-json-patch`
- `camel-json-validator`
- `camel-jsonapi`
- `camel-jsonata`
- `camel-jsonb`
- `camel-jsonpath`
- `camel-jsoup`
- `camel-jt400`
- `camel-jta`
- `camel-jte`
- `camel-kafka`
- `camel-kamelet`
- `camel-kamelet-main`
- `camel-kamelet-main-support`
- `camel-keycloak`
- `camel-knative`
- `camel-knative-api`
- `camel-knative-http`
- `camel-knative-parent`
- `camel-kserve`
- `camel-kubernetes`
- `camel-kudu`
- `camel-langchain4j-agent`
- `camel-langchain4j-agent-api`
- `camel-langchain4j-chat`
- `camel-langchain4j-core`
- `camel-langchain4j-embeddings`
- `camel-langchain4j-embeddingstore`
- `camel-langchain4j-embeddingstore-api`
- `camel-langchain4j-tokenizer`
- `camel-langchain4j-tools`
- `camel-langchain4j-web-search`
- `camel-language`
- `camel-launcher`
- `camel-launcher-container`
- `camel-ldap`
- `camel-ldif`
- `camel-leveldb`
- `camel-log`
- `camel-lra`
- `camel-lucene`
- `camel-lumberjack`
- `camel-lzf`
- `camel-mail`
- `camel-mail-microsoft-oauth`
- `camel-main`
- `camel-management`
- `camel-management-api`
- `camel-mapstruct`
- `camel-master`
- `camel-maven-plugin`
- `camel-mdc`
- `camel-metrics`
- `camel-micrometer`
- `camel-micrometer-observability`
- `camel-micrometer-prometheus`
- `camel-microprofile-config`
- `camel-microprofile-fault-tolerance`
- `camel-microprofile-health`
- `camel-microprofile-parent`
- `camel-milo`
- `camel-milvus`
- `camel-mina`
- `camel-mina-sftp`
- `camel-minio`
- `camel-mllp`
- `camel-mock`
- `camel-mongodb`
- `camel-mongodb-gridfs`
- `camel-mustache`
- `camel-mvel`
- `camel-mybatis`
- `camel-nats`
- `camel-neo4j`
- `camel-netty`
- `camel-netty-http`
- `camel-oaipmh`
- `camel-oauth`
- `camel-observability-services`
- `camel-observation`
- `camel-ocsf`
- `camel-ognl`
- `camel-olingo2`
- `camel-olingo2-api`
- `camel-olingo2-parent`
- `camel-olingo4`
- `camel-olingo4-api`
- `camel-olingo4-parent`
- `camel-once`
- `camel-openai`
- `camel-openapi-java`
- `camel-openapi-rest-dsl-generator`
- `camel-openapi-validator`
- `camel-opensearch`
- `camel-openstack`
- `camel-opentelemetry`
- `camel-opentelemetry-metrics`
- `camel-opentelemetry2`
- `camel-optaplanner`
- `camel-package-maven-plugin`
- `camel-paho`
- `camel-paho-mqtt5`
- `camel-parquet-avro`
- `camel-pdf`
- `camel-pg-replication-slot`
- `camel-pgevent`
- `camel-pgvector`
- `camel-pinecone`
- `camel-platform-http`
- `camel-platform-http-jolokia`
- `camel-platform-http-main`
- `camel-platform-http-vertx`
- `camel-plc4x`
- `camel-pqc`
- `camel-printer`
- `camel-protobuf`
- `camel-pubnub`
- `camel-pulsar`
- `camel-python`
- `camel-qdrant`
- `camel-quartz`
- `camel-quickfix`
- `camel-reactive-executor-tomcat`
- `camel-reactive-executor-vertx`
- `camel-reactive-streams`
- `camel-reactor`
- `camel-redis`
- `camel-ref`
- `camel-report-maven-plugin`
- `camel-resilience4j`
- `camel-resilience4j-micrometer`
- `camel-resourceresolver-github`
- `camel-rest`
- `camel-rest-openapi`
- `camel-restdsl-openapi-plugin`
- `camel-robotframework`
- `camel-rocketmq`
- `camel-route-parser`
- `camel-rss`
- `camel-rxjava`
- `camel-saga`
- `camel-salesforce`
- `camel-salesforce-codegen`
- `camel-salesforce-maven-plugin`
- `camel-salesforce-parent`
- `camel-sap-netweaver`
- `camel-saxon`
- `camel-scheduler`
- `camel-schematron`
- `camel-seda`
- `camel-servicenow`
- `camel-servicenow-maven-plugin`
- `camel-servicenow-parent`
- `camel-servlet`
- `camel-shell`
- `camel-shiro`
- `camel-sjms`
- `camel-sjms2`
- `camel-slack`
- `camel-smb`
- `camel-smooks`
- `camel-smpp`
- `camel-snakeyaml`
- `camel-snmp`
- `camel-soap`
- `camel-solr`
- `camel-splunk`
- `camel-splunk-hec`
- `camel-spring`
- `camel-spring-ai-chat`
- `camel-spring-ai-embeddings`
- `camel-spring-ai-image`
- `camel-spring-ai-parent`
- `camel-spring-ai-tools`
- `camel-spring-ai-vector-store`
- `camel-spring-batch`
- `camel-spring-cloud-config`
- `camel-spring-jdbc`
- `camel-spring-ldap`
- `camel-spring-main`
- `camel-spring-parent`
- `camel-spring-rabbitmq`
- `camel-spring-redis`
- `camel-spring-security`
- `camel-spring-ws`
- `camel-spring-xml`
- `camel-sql`
- `camel-ssh`
- `camel-stax`
- `camel-stitch`
- `camel-stream`
- `camel-streamcaching-test`
- `camel-stringtemplate`
- `camel-stripe`
- `camel-stub`
- `camel-support`
- `camel-swift`
- `camel-syslog`
- `camel-tahu`
- `camel-tarfile`
- `camel-telegram`
- `camel-telemetry`
- `camel-telemetry-dev`
- `camel-tensorflow-serving`
- `camel-test-infra-all`
- `camel-test-infra-artemis`
- `camel-test-infra-cli`
- `camel-test-infra-core`
- `camel-test-infra-jetty`
- `camel-test-infra-qdrant`
- `camel-test-infra-smb`
- `camel-test-junit5`
- `camel-test-junit6`
- `camel-test-main-junit5`
- `camel-test-main-junit6`
- `camel-test-parent`
- `camel-test-spring-junit5`
- `camel-test-spring-junit6`
- `camel-threadpoolfactory-vertx`
- `camel-thrift`
- `camel-thymeleaf`
- `camel-tika`
- `camel-timer`
- `camel-tooling-maven`
- `camel-tracing`
- `camel-twilio`
- `camel-twitter`
- `camel-undertow`
- `camel-undertow-spring-security`
- `camel-univocity-parsers`
- `camel-util`
- `camel-validator`
- `camel-velocity`
- `camel-vertx`
- `camel-vertx-common`
- `camel-vertx-http`
- `camel-vertx-parent`
- `camel-vertx-websocket`
- `camel-wal`
- `camel-wasm`
- `camel-weather`
- `camel-weaviate`
- `camel-web3j`
- `camel-webhook`
- `camel-whatsapp`
- `camel-wordpress`
- `camel-workday`
- `camel-xchange`
- `camel-xj`
- `camel-xml-io`
- `camel-xml-io-dsl`
- `camel-xml-io-util`
- `camel-xml-jaxb`
- `camel-xml-jaxb-dsl`
- `camel-xml-jaxb-dsl-test`
- `camel-xml-jaxb-dsl-test-definition`
- `camel-xml-jaxb-dsl-test-spring`
- `camel-xml-jaxp`
- `camel-xml-jaxp-util`
- `camel-xmlsecurity`
- `camel-xmpp`
- `camel-xpath`
- `camel-xslt`
- `camel-xslt-saxon`
- `camel-yaml-dsl`
- `camel-yaml-dsl-common`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `camel-yaml-dsl-parent`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
- `camel-yaml-io`
- `camel-zeebe`
- `camel-zendesk`
- `camel-zip-deflater`
- `camel-zipfile`
- `camel-zookeeper`
- `camel-zookeeper-master`
- `components`
- `core`
- `coverage`
- `docs`
- `dsl`
- `dummy-component`
- `sync-properties-maven-plugin`
</details>
<details><summary>Modules only in current approach (79)</summary>
- `[ERROR]`
- `[ERROR]`
- `[ERROR]`
- `[ERROR] mvn <args> -rf :camel-package-maven-plugin`
- `[ERROR] After correcting the problems, you can resume the build with the command`
- `[ERROR] Command execution failed.`
- `[ERROR] Failed to execute goal org.codehaus.mojo:exec-maven-plugin:3.6.3:exec (default-cli) on project camel-package-maven-plugin: Command execution failed. Process exited with an error: 127 (Exit value: 127) -> [Help 1]`
- `[ERROR] For more information about the errors and possible solutions, please read the following articles:`
- `[ERROR] Re-run Maven using the -X switch to enable full debug logging.`
- `[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.`
- `[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException`
- `at com.gradle.maven.cache.extension.c.a.a (SourceFile:46)`
- `at com.gradle.maven.cache.extension.c.a.a (SourceFile:46)`
- `at com.gradle.maven.cache.extension.c.b.a (SourceFile:62)`
- `at com.gradle.maven.cache.extension.c.b.c (SourceFile:118)`
- `at com.gradle.maven.cache.extension.c.c.a (SourceFile:26)`
- `at com.gradle.maven.cache.extension.c.d.a (SourceFile:27)`
- `at com.gradle.maven.cache.extension.c.g.a (SourceFile:27)`
- `at com.gradle.maven.cache.extension.c.h$1.run (SourceFile:35)`
- `at com.gradle.maven.cache.extension.c.h.a (SourceFile:31)`
- `at com.gradle.maven.cache.extension.c.j.a (SourceFile:28)`
- `at com.gradle.maven.cache.extension.c.m.a (SourceFile:80)`
- `at com.gradle.maven.cache.extension.c.n.a (SourceFile:53)`
- `at com.gradle.maven.cache.extension.c.o.a (SourceFile:18)`
- `at com.gradle.maven.cache.extension.c.p.a (SourceFile:27)`
- `at com.gradle.maven.cache.extension.c.q.a (SourceFile:23)`
- `at com.gradle.maven.cache.extension.g.b.lambda$createProxy$0 (SourceFile:77)`
- `at com.gradle.maven.scan.extension.internal.e.b.executeMojo (SourceFile:116)`
- `at java.lang.reflect.Method.invoke (Method.java:569)`
- `at java.lang.reflect.Method.invoke (Method.java:569)`
- `at java.lang.reflect.Method.invoke (Method.java:569)`
- `at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)`
- `at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)`
- `at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)`
- `at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)`
- `at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)`
- `at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)`
- `at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)`
- `at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)`
- `at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)`
- `at jdk.proxy5.$Proxy69.execute (Unknown Source)`
- `at org.apache.commons.exec.DefaultExecutor.execute (DefaultExecutor.java:306)`
- `at org.apache.commons.exec.DefaultExecutor.executeInternal (DefaultExecutor.java:408)`
- `at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)`
- `at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)`
- `at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)`
- `at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285)`
- `at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919)`
- `at org.apache.maven.cli.MavenCli.main (MavenCli.java:207)`
- `at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)`
- `at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)`
- `at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)`
- `at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)`
- `at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)`
- `at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)`
- `at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)`
- `at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)`
- `at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)`
- `at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)`
- `at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)`
- `at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)`
- `at org.apache.maven.wrapper.BootstrapMainStarter.start (BootstrapMainStarter.java:52)`
- `at org.apache.maven.wrapper.MavenWrapperMain.main (MavenWrapperMain.java:73)`
- `at org.apache.maven.wrapper.WrapperExecutor.execute (WrapperExecutor.java:161)`
- `at org.codehaus.mojo.exec.ExecMojo.execute (ExecMojo.java:464)`
- `at org.codehaus.mojo.exec.ExecMojo.executeCommandLine (ExecMojo.java:873)`
- `at org.codehaus.mojo.exec.ExecMojo.executeCommandLine (ExecMojo.java:913)`
- `at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)`
- `at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)`
- `at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)`
- `at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362)`
- `at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute (SourceFile:27)`
- `at org.gradle.internal.operations.DefaultBuildOperationRunner$1.execute (SourceFile:30)`
- `at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute (SourceFile:60)`
- `at org.gradle.internal.operations.DefaultBuildOperationRunner$2.execute (SourceFile:67)`
- `at org.gradle.internal.operations.DefaultBuildOperationRunner.execute (SourceFile:167)`
- `at org.gradle.internal.operations.DefaultBuildOperationRunner.execute (SourceFile:60)`
- `at org.gradle.internal.operations.DefaultBuildOperationRunner.run (SourceFile:48)`
- `org.apache.commons.exec.ExecuteException: Process exited with an error: 127 (Exit value: 127)`
</details>
**Skip-tests mode would test 570 modules** (5 direct + 565 downstream), **skip tests for 27** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (570)</summary>
- `archetypes`
- `camel-a2a`
- `camel-activemq`
- `camel-activemq6`
- `camel-ai-parent`
- `camel-amqp`
- `camel-api`
- `camel-api-component-maven-plugin`
- `camel-arangodb`
- `camel-archetype-api-component`
- `camel-archetype-component`
- `camel-archetype-dataformat`
- `camel-archetype-java`
- `camel-archetype-main`
- `camel-archetype-spring`
- `camel-as2`
- `camel-as2-api`
- `camel-as2-parent`
- `camel-asn1`
- `camel-asterisk`
- `camel-atmosphere-websocket`
- `camel-atom`
- `camel-attachments`
- `camel-avro`
- `camel-avro-rpc`
- `camel-avro-rpc-jetty`
- `camel-avro-rpc-parent`
- `camel-avro-rpc-spi`
- `camel-aws-bedrock`
- `camel-aws-cloudtrail`
- `camel-aws-common`
- `camel-aws-config`
- `camel-aws-parameter-store`
- `camel-aws-parent`
- `camel-aws-secrets-manager`
- `camel-aws-security-hub`
- `camel-aws2-athena`
- `camel-aws2-comprehend`
- `camel-aws2-cw`
- `camel-aws2-ddb`
- `camel-aws2-ec2`
- `camel-aws2-ecs`
- `camel-aws2-eks`
- `camel-aws2-eventbridge`
- `camel-aws2-iam`
- `camel-aws2-kinesis`
- `camel-aws2-kms`
- `camel-aws2-lambda`
- `camel-aws2-mq`
- `camel-aws2-msk`
- `camel-aws2-polly`
- `camel-aws2-redshift`
- `camel-aws2-rekognition`
- `camel-aws2-s3`
- `camel-aws2-s3-vectors`
- `camel-aws2-ses`
- `camel-aws2-sns`
- `camel-aws2-sqs`
- `camel-aws2-step-functions`
- `camel-aws2-sts`
- `camel-aws2-textract`
- `camel-aws2-timestream`
- `camel-aws2-transcribe`
- `camel-aws2-translate`
- `camel-azure-common`
- `camel-azure-cosmosdb`
- `camel-azure-eventgrid`
- `camel-azure-eventhubs`
- `camel-azure-files`
- `camel-azure-functions`
- `camel-azure-key-vault`
- `camel-azure-parent`
- `camel-azure-schema-registry`
- `camel-azure-servicebus`
- `camel-azure-storage-blob`
- `camel-azure-storage-datalake`
- `camel-azure-storage-queue`
- `camel-barcode`
- `camel-base`
- `camel-base-engine`
- `camel-base64`
- `camel-bean`
- `camel-bean-validator`
- `camel-beanio`
- `camel-bindy`
- `camel-bonita`
- `camel-box`
- `camel-box-api`
- `camel-box-parent`
- `camel-braintree`
- `camel-browse`
- `camel-caffeine`
- `camel-camunda`
- `camel-cassandraql`
- `camel-catalog`
- `camel-catalog-common`
- `camel-cbor`
- `camel-chatscript`
- `camel-chunk`
- `camel-cli-connector`
- `camel-cli-debug`
- `camel-clickup`
- `camel-cloudevents`
- `camel-cluster`
- `camel-cm-sms`
- `camel-coap`
- `camel-cometd`
- `camel-component-maven-plugin`
- `camel-console`
- `camel-consul`
- `camel-controlbus`
- `camel-core`
- `camel-core-all`
- `camel-core-catalog`
- `camel-core-engine`
- `camel-core-languages`
- `camel-core-model`
- `camel-core-processor`
- `camel-core-reifier`
- `camel-core-xml`
- `camel-couchbase`
- `camel-couchdb`
- `camel-cron`
- `camel-crypto`
- `camel-crypto-pgp`
- `camel-csimple-joor`
- `camel-csv`
- `camel-cxf-common`
- `camel-cxf-parent`
- `camel-cxf-rest`
- `camel-cxf-soap`
- `camel-cxf-spring-common`
- `camel-cxf-spring-rest`
- `camel-cxf-spring-soap`
- `camel-cxf-spring-transport`
- `camel-cxf-transport`
- `camel-cyberark-vault`
- `camel-dapr`
- `camel-dataformat`
- `camel-dataset`
- `camel-datasonnet`
- `camel-debezium-common`
- `camel-debezium-common-parent`
- `camel-debezium-db2`
- `camel-debezium-maven-plugin`
- `camel-debezium-mongodb`
- `camel-debezium-mysql`
- `camel-debezium-oracle`
- `camel-debezium-parent`
- `camel-debezium-postgres`
- `camel-debezium-sqlserver`
- `camel-debug`
- `camel-dependencies`
- `camel-dfdl`
- `camel-dhis2`
- `camel-dhis2-api`
- `camel-dhis2-parent`
- `camel-diagram`
- `camel-digitalocean`
- `camel-direct`
- `camel-disruptor`
- `camel-djl`
- `camel-dns`
- `camel-docker`
- `camel-docling`
- `camel-drill`
- `camel-dropbox`
- `camel-dsl-modeline`
- `camel-dsl-support`
- `camel-dynamic-router`
- `camel-ehcache`
- `camel-eip-documentation-enricher-maven-plugin`
- `camel-elasticsearch`
- `camel-elasticsearch-rest-client`
- `camel-event`
- `camel-exec`
- `camel-fastjson`
- `camel-fhir`
- `camel-fhir-api`
- `camel-fhir-parent`
- `camel-file`
- `camel-file-watch`
- `camel-flatpack`
- `camel-flink`
- `camel-flowable`
- `camel-fop`
- `camel-fory`
- `camel-freemarker`
- `camel-ftp`
- `camel-ftp-common`
- `camel-geocoder`
- `camel-git`
- `camel-github2`
- `camel-google-bigquery`
- `camel-google-calendar`
- `camel-google-common`
- `camel-google-drive`
- `camel-google-firestore`
- `camel-google-functions`
- `camel-google-mail`
- `camel-google-parent`
- `camel-google-pubsub`
- `camel-google-secret-manager`
- `camel-google-sheets`
- `camel-google-speech-to-text`
- `camel-google-storage`
- `camel-google-text-to-speech`
- `camel-google-vertexai`
- `camel-google-vision`
- `camel-graphql`
- `camel-grok`
- `camel-groovy`
- `camel-grpc`
- `camel-gson`
- `camel-hashicorp-vault`
- `camel-hazelcast`
- `camel-headersmap`
- `camel-health`
- `camel-hl7`
- `camel-http`
- `camel-http-base`
- `camel-http-common`
- `camel-huawei-parent`
- `camel-huaweicloud-common`
- `camel-huaweicloud-dms`
- `camel-huaweicloud-frs`
- `camel-huaweicloud-functiongraph`
- `camel-huaweicloud-iam`
- `camel-huaweicloud-imagerecognition`
- `camel-huaweicloud-obs`
- `camel-huaweicloud-smn`
- `camel-huggingface`
- `camel-ibm-cos`
- `camel-ibm-parent`
- `camel-ibm-secrets-manager`
- `camel-ibm-watson-discovery`
- `camel-ibm-watson-language`
- `camel-ibm-watson-speech-to-text`
- `camel-ibm-watson-text-to-speech`
- `camel-ibm-watsonx-ai`
- `camel-ibm-watsonx-data`
- `camel-ical`
- `camel-iec60870`
- `camel-iggy`
- `camel-ignite`
- `camel-infinispan`
- `camel-infinispan-common`
- `camel-infinispan-embedded`
- `camel-infinispan-parent`
- `camel-influxdb`
- `camel-influxdb2`
- `camel-irc`
- `camel-ironmq`
- `camel-iso8583`
- `camel-jackson`
- `camel-jackson-avro`
- `camel-jackson-protobuf`
- `camel-jackson3`
- `camel-jackson3-avro`
- `camel-jackson3-protobuf`
- `camel-jackson3xml`
- `camel-jacksonxml`
- `camel-jandex`
- `camel-jasypt`
- `camel-java-io`
- `camel-java-joor-dsl`
- `camel-javascript`
- `camel-jaxb`
- `camel-jbang-console`
- `camel-jbang-mcp`
- `camel-jbang-parent`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-jcache`
- `camel-jcr`
- `camel-jdbc`
- `camel-jetty`
- `camel-jetty-common`
- `camel-jfr`
- `camel-jgroups`
- `camel-jgroups-raft`
- `camel-jira`
- `camel-jms`
- `camel-jmx`
- `camel-jolt`
- `camel-jooq`
- `camel-joor`
- `camel-jpa`
- `camel-jq`
- `camel-jsch`
- `camel-jslt`
- `camel-json-patch`
- `camel-json-validator`
- `camel-jsonapi`
- `camel-jsonata`
- `camel-jsonb`
- `camel-jsonpath`
- `camel-jsoup`
- `camel-jt400`
- `camel-jta`
- `camel-jte`
- `camel-kafka`
- `camel-kamelet`
- `camel-kamelet-main-support`
- `camel-keycloak`
- `camel-knative`
- `camel-knative-api`
- `camel-knative-http`
- `camel-knative-parent`
- `camel-kserve`
- `camel-kubernetes`
- `camel-kudu`
- `camel-langchain4j-agent`
- `camel-langchain4j-agent-api`
- `camel-langchain4j-chat`
- `camel-langchain4j-core`
- `camel-langchain4j-embeddings`
- `camel-langchain4j-embeddingstore`
- `camel-langchain4j-embeddingstore-api`
- `camel-langchain4j-tokenizer`
- `camel-langchain4j-tools`
- `camel-langchain4j-web-search`
- `camel-language`
- `camel-launcher-container`
- `camel-ldap`
- `camel-ldif`
- `camel-leveldb`
- `camel-log`
- `camel-lra`
- `camel-lucene`
- `camel-lumberjack`
- `camel-lzf`
- `camel-mail`
- `camel-mail-microsoft-oauth`
- `camel-main`
- `camel-management`
- `camel-management-api`
- `camel-mapstruct`
- `camel-master`
- `camel-maven-plugin`
- `camel-mdc`
- `camel-metrics`
- `camel-micrometer`
- `camel-micrometer-observability`
- `camel-micrometer-prometheus`
- `camel-microprofile-config`
- `camel-microprofile-fault-tolerance`
- `camel-microprofile-health`
- `camel-microprofile-parent`
- `camel-milo`
- `camel-milvus`
- `camel-mina`
- `camel-mina-sftp`
- `camel-minio`
- `camel-mllp`
- `camel-mock`
- `camel-mongodb`
- `camel-mongodb-gridfs`
- `camel-mustache`
- `camel-mvel`
- `camel-mybatis`
- `camel-nats`
- `camel-neo4j`
- `camel-netty`
- `camel-netty-http`
- `camel-oaipmh`
- `camel-oauth`
- `camel-observability-services`
- `camel-observation`
- `camel-ocsf`
- `camel-ognl`
- `camel-olingo2`
- `camel-olingo2-api`
- `camel-olingo2-parent`
- `camel-olingo4`
- `camel-olingo4-api`
- `camel-olingo4-parent`
- `camel-once`
- `camel-openai`
- `camel-openapi-java`
- `camel-openapi-rest-dsl-generator`
- `camel-openapi-validator`
- `camel-opensearch`
- `camel-openstack`
- `camel-opentelemetry`
- `camel-opentelemetry-metrics`
- `camel-opentelemetry2`
- `camel-optaplanner`
- `camel-package-maven-plugin`
- `camel-paho`
- `camel-paho-mqtt5`
- `camel-parquet-avro`
- `camel-pdf`
- `camel-pg-replication-slot`
- `camel-pgevent`
- `camel-pgvector`
- `camel-pinecone`
- `camel-platform-http`
- `camel-platform-http-jolokia`
- `camel-platform-http-main`
- `camel-platform-http-vertx`
- `camel-plc4x`
- `camel-pqc`
- `camel-printer`
- `camel-protobuf`
- `camel-pubnub`
- `camel-pulsar`
- `camel-python`
- `camel-qdrant`
- `camel-quartz`
- `camel-quickfix`
- `camel-reactive-executor-tomcat`
- `camel-reactive-executor-vertx`
- `camel-reactive-streams`
- `camel-reactor`
- `camel-redis`
- `camel-ref`
- `camel-resilience4j`
- `camel-resilience4j-micrometer`
- `camel-resourceresolver-github`
- `camel-rest`
- `camel-rest-openapi`
- `camel-restdsl-openapi-plugin`
- `camel-robotframework`
- `camel-rocketmq`
- `camel-rss`
- `camel-rxjava`
- `camel-saga`
- `camel-salesforce`
- `camel-salesforce-codegen`
- `camel-salesforce-maven-plugin`
- `camel-salesforce-parent`
- `camel-sap-netweaver`
- `camel-saxon`
- `camel-scheduler`
- `camel-schematron`
- `camel-seda`
- `camel-servicenow`
- `camel-servicenow-maven-plugin`
- `camel-servicenow-parent`
- `camel-servlet`
- `camel-shell`
- `camel-shiro`
- `camel-sjms`
- `camel-sjms2`
- `camel-slack`
- `camel-smb`
- `camel-smooks`
- `camel-smpp`
- `camel-snakeyaml`
- `camel-snmp`
- `camel-soap`
- `camel-solr`
- `camel-splunk`
- `camel-splunk-hec`
- `camel-spring`
- `camel-spring-ai-chat`
- `camel-spring-ai-embeddings`
- `camel-spring-ai-image`
- `camel-spring-ai-parent`
- `camel-spring-ai-tools`
- `camel-spring-ai-vector-store`
- `camel-spring-batch`
- `camel-spring-cloud-config`
- `camel-spring-jdbc`
- `camel-spring-ldap`
- `camel-spring-main`
- `camel-spring-parent`
- `camel-spring-rabbitmq`
- `camel-spring-redis`
- `camel-spring-security`
- `camel-spring-ws`
- `camel-spring-xml`
- `camel-sql`
- `camel-ssh`
- `camel-stax`
- `camel-stitch`
- `camel-stream`
- `camel-streamcaching-test`
- `camel-stringtemplate`
- `camel-stripe`
- `camel-stub`
- `camel-support`
- `camel-swift`
- `camel-syslog`
- `camel-tahu`
- `camel-tarfile`
- `camel-telegram`
- `camel-telemetry`
- `camel-telemetry-dev`
- `camel-tensorflow-serving`
- `camel-test-infra-all`
- `camel-test-infra-artemis`
- `camel-test-infra-cli`
- `camel-test-infra-core`
- `camel-test-infra-jetty`
- `camel-test-infra-qdrant`
- `camel-test-infra-smb`
- `camel-test-junit5`
- `camel-test-junit6`
- `camel-test-main-junit5`
- `camel-test-main-junit6`
- `camel-test-parent`
- `camel-test-spring-junit5`
- `camel-test-spring-junit6`
- `camel-threadpoolfactory-vertx`
- `camel-thrift`
- `camel-thymeleaf`
- `camel-tika`
- `camel-timer`
- `camel-tooling-maven`
- `camel-tooling-model`
- `camel-tracing`
- `camel-twilio`
- `camel-twitter`
- `camel-undertow`
- `camel-undertow-spring-security`
- `camel-univocity-parsers`
- `camel-util`
- `camel-validator`
- `camel-velocity`
- `camel-vertx`
- `camel-vertx-common`
- `camel-vertx-http`
- `camel-vertx-parent`
- `camel-vertx-websocket`
- `camel-wal`
- `camel-wasm`
- `camel-weather`
- `camel-weaviate`
- `camel-web3j`
- `camel-webhook`
- `camel-whatsapp`
- `camel-wordpress`
- `camel-workday`
- `camel-xchange`
- `camel-xj`
- `camel-xml-io`
- `camel-xml-io-dsl`
- `camel-xml-io-util`
- `camel-xml-jaxb`
- `camel-xml-jaxb-dsl`
- `camel-xml-jaxb-dsl-test`
- `camel-xml-jaxb-dsl-test-definition`
- `camel-xml-jaxb-dsl-test-spring`
- `camel-xml-jaxp`
- `camel-xml-jaxp-util`
- `camel-xmlsecurity`
- `camel-xmpp`
- `camel-xpath`
- `camel-xslt`
- `camel-xslt-saxon`
- `camel-yaml-dsl-common`
- `camel-yaml-dsl-parent`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
- `camel-yaml-io`
- `camel-zeebe`
- `camel-zendesk`
- `camel-zip-deflater`
- `camel-zipfile`
- `camel-zookeeper`
- `camel-zookeeper-master`
- `components`
- `core`
- `docs`
- `dsl`
- `sync-properties-maven-plugin`
</details>
<details><summary>Modules with tests skipped (27)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-csimple-maven-plugin`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `dummy-component`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
:warning: **Some tests are disabled on GitHub Actions** (`@DisabledIfSystemProperty(named = "ci.env.name")`) and require manual verification:
- `dsl/camel-jbang/camel-jbang-mcp`: 1 test(s) disabled on GitHub Actions
<details><summary>Build reactor — dependencies compiled but only changed modules were tested (596 modules)</summary>
- Camel :: AI :: A2A
- Camel :: AI :: ChatScript
- Camel :: AI :: Deep Java Library
- Camel :: AI :: Docling
- Camel :: AI :: Hugging Face
- Camel :: AI :: KServe
- Camel :: AI :: LangChain4j :: Agent
- Camel :: AI :: LangChain4j :: Agent :: API
- Camel :: AI :: LangChain4j :: Chat
- Camel :: AI :: LangChain4j :: Core
- Camel :: AI :: LangChain4j :: Embedding
- Camel :: AI :: LangChain4j :: Embedding Store :: API
- Camel :: AI :: LangChain4j :: EmbeddingStore
- Camel :: AI :: LangChain4j :: Tokenizer
- Camel :: AI :: LangChain4j :: Tools
- Camel :: AI :: LangChain4j :: Web Search
- Camel :: AI :: Milvus
- Camel :: AI :: Neo4j
- Camel :: AI :: OpenAI
- Camel :: AI :: PGVector
- Camel :: AI :: Parent
- Camel :: AI :: Pinecone
- Camel :: AI :: Qdrant
- Camel :: AI :: TensorFlow Serving
- Camel :: AI :: Weaviate
- Camel :: AMQP
- Camel :: API
- Camel :: AS2 :: API
- Camel :: AS2 :: Component
- Camel :: AS2 :: Parent
- Camel :: ASN.1
- Camel :: AWS :: Common
- Camel :: AWS :: Parent
- Camel :: AWS CloudTrail
- Camel :: AWS Config
- Camel :: AWS Redshift Data
- Camel :: AWS Rekognition
- Camel :: AWS Security Hub
- Camel :: AWS Step Functions
- Camel :: AWS Timestream
- Camel :: AWS2 :: Transcribe
- Camel :: AWS2 Athena
- Camel :: AWS2 Bedrock
- Camel :: AWS2 CW
- Camel :: AWS2 Comprehend
- Camel :: AWS2 DDB
- Camel :: AWS2 EC2
- Camel :: AWS2 ECS
- Camel :: AWS2 EKS
- Camel :: AWS2 Eventbridge
- Camel :: AWS2 IAM
- Camel :: AWS2 KMS
- Camel :: AWS2 Kinesis
- Camel :: AWS2 Lambda
- Camel :: AWS2 MQ
- Camel :: AWS2 MSK
- Camel :: AWS2 Parameter Store
- Camel :: AWS2 Polly
- Camel :: AWS2 S3
- Camel :: AWS2 S3 Vectors
- Camel :: AWS2 SES
- Camel :: AWS2 SNS
- Camel :: AWS2 SQS
- Camel :: AWS2 STS
- Camel :: AWS2 Secrets Manager
- Camel :: AWS2 Textract
- Camel :: AWS2 Translate
- Camel :: ActiveMQ 5.x
- Camel :: ActiveMQ 6.x
- Camel :: All Components Sync point
- Camel :: All Core Sync point
- Camel :: ArangoDB
- Camel :: Archetypes
- Camel :: Archetypes :: API Component
- Camel :: Archetypes :: Component
- Camel :: Archetypes :: Data Format
- Camel :: Archetypes :: Java Router
- Camel :: Archetypes :: Main
- Camel :: Archetypes :: Spring XML Based Router (deprecated)
- Camel :: Assembly
- Camel :: Asterisk
- Camel :: Atmosphere WebSocket Servlet
- Camel :: Atom
- Camel :: Attachments
- Camel :: Avro
- Camel :: Avro RPC
- Camel :: Avro RPC :: Jetty
- Camel :: Avro RPC :: Parent
- Camel :: Avro RPC :: Spi
- Camel :: Azure :: Common
- Camel :: Azure :: CosmosDB
- Camel :: Azure :: Event Grid
- Camel :: Azure :: Event Hubs
- Camel :: Azure :: Files
- Camel :: Azure :: Functions
- Camel :: Azure :: Key Vault
- Camel :: Azure :: Parent
- Camel :: Azure :: Schema Registry
- Camel :: Azure :: ServiceBus
- Camel :: Azure :: Storage Blob
- Camel :: Azure :: Storage Datalake
- Camel :: Azure :: Storage Queue
- Camel :: Barcode
- Camel :: Base
- Camel :: Base Engine
- Camel :: Base64
- Camel :: Bean
- Camel :: Bean validator
- Camel :: BeanIO
- Camel :: Bindy
- Camel :: Bonita
- Camel :: Box :: API
- Camel :: Box :: Component
- Camel :: Box :: Parent
- Camel :: Braintree
- Camel :: Browse
- Camel :: CBOR
- Camel :: CM SMS
- Camel :: CSV
- Camel :: CXF :: Common
- Camel :: CXF :: Common :: Spring
- Camel :: CXF :: Parent
- Camel :: CXF :: REST
- Camel :: CXF :: REST :: Spring
- Camel :: CXF :: SOAP
- Camel :: CXF :: SOAP :: Spring
- Camel :: CXF :: Transport
- Camel :: CXF :: Transport :: Spring
- Camel :: Caffeine
- Camel :: Camunda
- Camel :: Cassandra CQL
- Camel :: Catalog :: CSimple Maven Plugin (deprecated)
- Camel :: Catalog :: Camel Catalog
- Camel :: Catalog :: Camel Report Maven Plugin
- Camel :: Catalog :: Camel Route Parser
- Camel :: Catalog :: Common
- Camel :: Catalog :: Console
- Camel :: Catalog :: Dummy Component
- Camel :: Catalog :: Lucene (deprecated)
- Camel :: Catalog :: Maven
- Camel :: Catalog :: Suggest
- Camel :: Chunk
- Camel :: ClickUp
- Camel :: CloudEvents
- Camel :: Cluster
- Camel :: CoAP
- Camel :: Cometd
- Camel :: Common Telemetry
- Camel :: Common Tracing (deprecated)
- Camel :: Component DSL
- Camel :: Components
- Camel :: Console
- Camel :: Consul
- Camel :: Controlbus
- Camel :: Core
- Camel :: Core Catalog
- Camel :: Core Engine
- Camel :: Core Languages
- Camel :: Core Model
- Camel :: Core Modules
- Camel :: Core Processor
- Camel :: Core Reifier
- Camel :: Core XML
- Camel :: CouchDB
- Camel :: Couchbase
- Camel :: Coverage
- Camel :: Cron
- Camel :: Crypto
- Camel :: Crypto PGP
- Camel :: CyberArk Vault
- Camel :: DFDL
- Camel :: DHIS2
- Camel :: DHIS2 :: Parent
- Camel :: DHIS2 API
- Camel :: DNS
- Camel :: DSL :: CLI Connector
- Camel :: DSL :: CLI Debug
- Camel :: DSL :: Modeline
- Camel :: DSL :: Parent
- Camel :: DSL :: Support
- Camel :: Dapr
- Camel :: DataSet
- Camel :: DataSonnet
- Camel :: Dataformat
- Camel :: Debezium :: Common
- Camel :: Debezium :: Common :: Parent
- Camel :: Debezium :: DB2
- Camel :: Debezium :: Maven Plugin
- Camel :: Debezium :: MongoDB
- Camel :: Debezium :: MySQL
- Camel :: Debezium :: Oracle
- Camel :: Debezium :: Parent
- Camel :: Debezium :: PostgreSQL
- Camel :: Debezium :: SQL Server
- Camel :: Debugging
- Camel :: Dependencies
- Camel :: Diagram
- Camel :: DigitalOcean (deprecated)
- Camel :: Direct
- Camel :: Disruptor
- Camel :: Docker
- Camel :: Docs
- Camel :: Drill
- Camel :: Dropbox
- Camel :: Dynamic Router
- Camel :: Ehcache
- Camel :: ElasticSearch Rest Client
- Camel :: Elasticsearch Java API Client
- Camel :: Endpoint DSL
- Camel :: Endpoint DSL :: Support
- Camel :: Event
- Camel :: Exec
- Camel :: FHIR
- Camel :: FHIR :: API
- Camel :: FHIR :: Parent
- Camel :: FOP
- Camel :: FTP
- Camel :: FTP Common
- Camel :: Fastjson
- Camel :: File
- Camel :: File Watch
- Camel :: FlatPack
- Camel :: Flink
- Camel :: Flowable
- Camel :: Fory
- Camel :: Freemarker
- Camel :: Geocoder
- Camel :: Git
- Camel :: GitHub2
- Camel :: Google :: BigQuery
- Camel :: Google :: Calendar
- Camel :: Google :: Common
- Camel :: Google :: Drive
- Camel :: Google :: Firestore
- Camel :: Google :: Functions
- Camel :: Google :: Mail
- Camel :: Google :: Parent
- Camel :: Google :: PubSub
- Camel :: Google :: Secret Manager
- Camel :: Google :: Sheets
- Camel :: Google :: Speech To Text
- Camel :: Google :: Storage
- Camel :: Google :: Text To Speech
- Camel :: Google :: Vertex AI
- Camel :: Google :: Vision
- Camel :: GraphQL
- Camel :: Grok
- Camel :: Groovy
- Camel :: Gson
- Camel :: HL7
- Camel :: HTTP
- Camel :: HTTP :: Base
- Camel :: HTTP :: Common
- Camel :: HashiCorp :: Key Vault
- Camel :: HazelCast
- Camel :: Headers Map (deprecated)
- Camel :: Health
- Camel :: Huawei Cloud :: Common
- Camel :: Huawei Cloud :: DMS
- Camel :: Huawei Cloud :: FaceRecognition
- Camel :: Huawei Cloud :: FunctionGraph
- Camel :: Huawei Cloud :: IAM
- Camel :: Huawei Cloud :: ImageRecognition
- Camel :: Huawei Cloud :: OBS
- Camel :: Huawei Cloud :: Parent
- Camel :: Huawei Cloud :: SimpleNotification
- Camel :: IBM :: Cloud Object Storage
- Camel :: IBM :: Parent
- Camel :: IBM :: Secrets Manager
- Camel :: IBM :: Watson Discovery
- Camel :: IBM :: Watson Language
- Camel :: IBM :: Watson Speech to Text
- Camel :: IBM :: Watson Text to Speech
- Camel :: IBM :: watsonx.ai
- Camel :: IBM :: watsonx.data
- Camel :: IEC 60870 (deprecated)
- Camel :: IRC (deprecated)
- Camel :: ISO-8583
- Camel :: Iggy
- Camel :: Ignite
- Camel :: Infinispan :: Common
- Camel :: Infinispan :: Embedded
- Camel :: Infinispan :: Parent
- Camel :: Infinispan :: Remote
- Camel :: InfluxDB
- Camel :: InfluxDB2
- Camel :: Integration Tests
- Camel :: Integration Tests :: Stream Caching Tests
- Camel :: IronMQ
- Camel :: JAXB
- Camel :: JBang :: Console
- Camel :: JBang :: Core
- Camel :: JBang :: Integration tests
- Camel :: JBang :: MCP
- Camel :: JBang :: Main
- Camel :: JBang :: Parent
- Camel :: JBang :: Plugin :: Edit
- Camel :: JBang :: Plugin :: Generate
- Camel :: JBang :: Plugin :: Kubernetes
- Camel :: JBang :: Plugin :: MCP
- Camel :: JBang :: Plugin :: Route Parser
- Camel :: JBang :: Plugin :: TUI
- Camel :: JBang :: Plugin :: Testing
- Camel :: JBang :: Plugin :: Validate
- Camel :: JCR
- Camel :: JCache
- Camel :: JDBC
- Camel :: JGroups
- Camel :: JGroups Raft
- Camel :: JIRA
- Camel :: JMS
- Camel :: JMX
- Camel :: JOOQ
- Camel :: JPA
- Camel :: JQ
- Camel :: JSON validator
- Camel :: JSON-B
- Camel :: JSONATA
- Camel :: JSon Path
- Camel :: JSonApi
- Camel :: JSoup
- Camel :: JTA
- Camel :: Jackson
- Camel :: Jackson 3
- Camel :: Jackson 3 Avro
- Camel :: Jackson 3 Protobuf
- Camel :: Jackson 3 XML
- Camel :: Jackson Avro
- Camel :: Jackson Protobuf
- Camel :: Jackson XML
- Camel :: Jandex
- Camel :: Jasypt
- Camel :: Java DSL IO
- Camel :: Java DSL with jOOR
- Camel :: Java Flight Recorder
- Camel :: Java Template Engine
- Camel :: Java Toolbox for IBM i
- Camel :: JavaScript
- Camel :: Jetty
- Camel :: Jetty :: Common
- Camel :: Jolt
- Camel :: Jsch
- Camel :: Jslt
- Camel :: JsonPatch (deprecated)
- Camel :: Kafka
- Camel :: Kamelet
- Camel :: Kamelet Main
- Camel :: Kamelet Main :: Support
- Camel :: Keycloak
- Camel :: Knative :: Parent
- Camel :: Knative API
- Camel :: Knative Component
- Camel :: Knative HTTP
- Camel :: Kubernetes
- Camel :: Kudu
- Camel :: LDAP
- Camel :: LDIF
- Camel :: LZF
- Camel :: Language
- Camel :: Launcher
- Camel :: Launcher :: Container
- Camel :: LevelDB (deprecated)
- Camel :: Log
- Camel :: Long-Running-Action
- Camel :: Lucene
- Camel :: Lumberjack
- Camel :: MDC
- Camel :: MINA
- Camel :: MINA SFTP
- Camel :: MLLP
- Camel :: MVEL
- Camel :: Mail
- Camel :: Mail :: Microsoft OAuth
- Camel :: Main
- Camel :: Management
- Camel :: Management API
- Camel :: MapStruct
- Camel :: Master
- Camel :: Maven Plugins :: Camel API Component Plugin
- Camel :: Maven Plugins :: Camel Maven Component
- Camel :: Maven Plugins :: Camel Maven Package
- Camel :: Maven Plugins :: Camel Maven Plugin
- Camel :: Maven Plugins :: OpenApi REST DSL Generator
- Camel :: Maven Plugins :: Sync Properties
- Camel :: Maven Plugins :: XML DSL Doc Enricher
- Camel :: Metrics
- Camel :: MicroProfile :: Config
- Camel :: MicroProfile :: Fault Tolerance
- Camel :: MicroProfile :: Health
- Camel :: MicroProfile :: Parent
- Camel :: Micrometer
- Camel :: Micrometer :: Observability 2
- Camel :: Micrometer :: Observation (deprecated)
- Camel :: Micrometer :: Prometheus
- Camel :: Milo
- Camel :: MinIO
- Camel :: Mock
- Camel :: MongoDB
- Camel :: MongoDB GridFS
- Camel :: Mustache
- Camel :: MyBatis
- Camel :: Nats
- Camel :: Netty
- Camel :: Netty HTTP
- Camel :: OAIPMH
- Camel :: OAuth
- Camel :: OCSF
- Camel :: OGNL (deprecated)
- Camel :: Observability Services
- Camel :: Olingo2 (Deprecated) :: API
- Camel :: Olingo2 (Deprecated) :: Component
- Camel :: Olingo2 (Deprecated) :: Parent
- Camel :: Olingo4 (Deprecated) :: API
- Camel :: Olingo4 (Deprecated) :: Component
- Camel :: Olingo4 (Deprecated) :: Parent
- Camel :: Once
- Camel :: OpenAPI :: Validator
- Camel :: OpenApi Java
- Camel :: OpenSearch Java API Client
- Camel :: OpenStack
- Camel :: OpenTelemetry (deprecated)
- Camel :: Opentelemetry 2
- Camel :: Opentelemetry Metrics
- Camel :: OptaPlanner
- Camel :: PDF
- Camel :: PLC4X
- Camel :: PQC
- Camel :: Paho (deprecated)
- Camel :: Paho MQTT 5
- Camel :: Parquet Avro
- Camel :: PgEvent
- Camel :: PgReplicationSlot
- Camel :: Platform HTTP
- Camel :: Platform HTTP :: Jolokia
- Camel :: Platform HTTP :: Main
- Camel :: Platform HTTP :: Vert.x
- Camel :: Printer
- Camel :: Protobuf
- Camel :: PubNub
- Camel :: Pulsar
- Camel :: Python
- Camel :: Quartz
- Camel :: QuickFIX/J
- Camel :: REST
- Camel :: REST OpenApi
- Camel :: RSS
- Camel :: Reactive Executor :: Tomcat
- Camel :: Reactive Executor :: Vert.x (deprecated)
- Camel :: Reactive Streams
- Camel :: Reactor
- Camel :: Redis
- Camel :: Ref
- Camel :: Resilience4j
- Camel :: Resilience4j :: Micrometer
- Camel :: ResourceResolver GitHub
- Camel :: RobotFramework
- Camel :: RocketMQ
- Camel :: RxJava
- Camel :: SAP NetWeaver
- Camel :: SMB
- Camel :: SMPP
- Camel :: SNMP
- Camel :: SOAP
- Camel :: SQL
- Camel :: SSH
- Camel :: SWIFT
- Camel :: Saga
- Camel :: Salesforce
- Camel :: Salesforce :: CodeGen
- Camel :: Salesforce :: Maven Plugin
- Camel :: Salesforce :: Parent
- Camel :: Saxon
- Camel :: Scheduler
- Camel :: Schematron
- Camel :: Seda
- Camel :: ServiceNow :: Component
- Camel :: ServiceNow :: Maven Plugin
- Camel :: ServiceNow :: Parent
- Camel :: Servlet
- Camel :: Shell
- Camel :: Shiro
- Camel :: Simple JMS
- Camel :: Simple JMS2
- Camel :: Slack
- Camel :: Smooks :: Parent
- Camel :: SnakeYAML
- Camel :: Solr
- Camel :: Splunk (deprecated)
- Camel :: Splunk HEC
- Camel :: Spring
- Camel :: Spring :: Parent
- Camel :: Spring AI :: Chat
- Camel :: Spring AI :: Embeddings
- Camel :: Spring AI :: Image
- Camel :: Spring AI :: Parent
- Camel :: Spring AI :: Tools
- Camel :: Spring AI :: Vector Store
- Camel :: Spring Batch
- Camel :: Spring Cloud Config
- Camel :: Spring JDBC
- Camel :: Spring LDAP
- Camel :: Spring Main
- Camel :: Spring RabbitMQ
- Camel :: Spring Redis
- Camel :: Spring Security
- Camel :: Spring Web Services
- Camel :: Spring XML
- Camel :: StAX
- Camel :: Stitch
- Camel :: Stream
- Camel :: StringTemplate
- Camel :: Stripe
- Camel :: Stub
- Camel :: Support
- Camel :: Syslog
- Camel :: Tahu
- Camel :: Tar File
- Camel :: Telegram
- Camel :: Telemetry :: Dev
- Camel :: Test :: JUnit5
- Camel :: Test :: JUnit6
- Camel :: Test :: Main :: JUnit5
- Camel :: Test :: Main :: JUnit6
- Camel :: Test :: Parent
- Camel :: Test :: Spring :: JUnit5
- Camel :: Test Infra :: All test services
- Camel :: Test Infra :: Artemis
- Camel :: Test Infra :: Cli (Camel CLI)
- Camel :: Test Infra :: Core
- Camel :: Test Infra :: Jetty
- Camel :: Test Infra :: Server Message Block
- Camel :: Test Infra :: qdrant
- Camel :: Thread Pool Factory :: Vert.x (deprecated)
- Camel :: Thrift
- Camel :: Thymeleaf
- Camel :: Tika
- Camel :: Timer
- Camel :: Tooling :: Maven
- Camel :: Tooling :: Model
- Camel :: Tooling :: OpenApi REST DSL Generator
- Camel :: Twilio
- Camel :: Twitter
- Camel :: Undertow
- Camel :: Undertow Spring Security
- Camel :: UniVocity Parsers
- Camel :: Util
- Camel :: Validator
- Camel :: Velocity
- Camel :: Vert.x :: Common
- Camel :: Vert.x :: HTTP
- Camel :: Vert.x :: Parent
- Camel :: Vert.x :: WebSocket
- Camel :: Vertx
- Camel :: WAL
- Camel :: Wasm
- Camel :: Weather
- Camel :: Web3j
- Camel :: Webhook
- Camel :: Whatsapp
- Camel :: Wordpress
- Camel :: Workday
- Camel :: XChange
- Camel :: XJ
- Camel :: XML DSL Jaxb :: Test :: Definition
- Camel :: XML DSL Jaxb :: Test :: Spring
- Camel :: XML DSL Jaxb :: Tests
- Camel :: XML DSL with camel-xml-io
- Camel :: XML DSL with camel-xml-jaxb
- Camel :: XML IO
- Camel :: XML IO Util
- Camel :: XML JAXB
- Camel :: XML JAXP
- Camel :: XML JAXP Util
- Camel :: XML Security
- Camel :: XMPP
- Camel :: XPath
- Camel :: XSLT
- Camel :: XSLT Saxon
- Camel :: YAML DSL
- Camel :: YAML DSL :: Common
- Camel :: YAML DSL :: Deserializers
- Camel :: YAML DSL :: Maven Plugins
- Camel :: YAML DSL :: Parent
- Camel :: YAML DSL :: Validator
- Camel :: YAML DSL :: Validator Maven Plugin
- Camel :: YAML IO
- Camel :: Zeebe (deprecated)
- Camel :: Zendesk
- Camel :: Zip Deflater
- Camel :: Zip File
- Camel :: Zookeeper
- Camel :: Zookeeper Master
- Camel :: csimple jOOR (deprecated)
- Camel :: gRPC
- Camel :: iCal
- Camel :: jOOR
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/29082742749)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24573:
URL: https://github.com/apache/camel/pull/24573#issuecomment-4934093296
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #24573:
URL: https://github.com/apache/camel/pull/24573#discussion_r3557893284
##########
tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSecurityAdvisoriesMojo.java:
##########
@@ -0,0 +1,292 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.maven.packaging;
+
+import java.io.File;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.inject.Inject;
+
+import org.apache.camel.tooling.model.JsonMapper;
+import org.apache.camel.tooling.model.SecurityAdvisoryModel;
+import org.apache.camel.util.json.JsonArray;
+import org.apache.camel.util.json.JsonObject;
+import org.apache.camel.util.json.Jsoner;
+import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.project.MavenProjectHelper;
+import org.codehaus.plexus.build.BuildContext;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
+
+/**
+ * Syncs the published Apache Camel CVE security advisories (the sources behind
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a>, maintained as Markdown files with YAML
+ * front matter in the camel-website git repository) into a JSON file shipped with camel-catalog, the same way the known
+ * releases are synced by {@code update-camel-releases}.
+ */
+@Mojo(name = "update-security-advisories", threadSafe = true, defaultPhase = LifecyclePhase.GENERATE_RESOURCES)
+public class UpdateSecurityAdvisoriesMojo extends AbstractGeneratorMojo {
+
+ private static final String GIT_SECURITY_URL
+ = "https://api.github.com/repos/apache/camel-website/contents/content/security";
+ private static final String WEBSITE_BASE_URL = "https://camel.apache.org";
+
+ private static final Pattern ADVISORY_FILE = Pattern.compile("CVE-\\d{4}-\\d{4,}\\.md");
+ private static final Pattern COMPONENT_TOKEN = Pattern.compile("camel-[a-z0-9]+(?:-[a-z0-9]+)*");
+ private static final Pattern CVE_ID = Pattern.compile("CVE-(\\d{4})-(\\d+)");
+
+ /**
+ * The output directory for the generated catalog advisories file
+ */
+ @Parameter(defaultValue = "${project.basedir}/src/generated/resources/org/apache/camel/catalog/advisories")
+ protected File outDir;
+
+ @Inject
+ public UpdateSecurityAdvisoriesMojo(MavenProjectHelper projectHelper, BuildContext buildContext) {
+ super(projectHelper, buildContext);
+ }
+
+ @Override
+ public void execute() throws MojoExecutionException, MojoFailureException {
+ if (outDir == null) {
+ outDir = new File(project.getBasedir(), "src/generated/resources");
+ }
+
+ try {
+ getLog().info("Updating Camel security advisories from camel-website");
+ List<String> links = fetchAdvisoryLinks();
+ List<SecurityAdvisoryModel> advisories = processAdvisories(links);
+ advisories.sort(Comparator.comparingLong(UpdateSecurityAdvisoriesMojo::cveOrdinal));
+ getLog().info("Found " + advisories.size() + " published security advisories");
+
+ JsonArray arr = new JsonArray();
+ for (SecurityAdvisoryModel advisory : advisories) {
+ arr.add(JsonMapper.asJsonObject(advisory));
+ }
+ String json = Jsoner.serialize(arr);
+ json = Jsoner.prettyPrint(json, 4);
+
+ Path path = outDir.toPath();
+ updateResource(path, "camel-security-advisories.json", json);
+ addResourceDirectory(path);
+ } catch (Exception e) {
+ throw new MojoExecutionException(e);
+ }
+ }
+
+ private List<SecurityAdvisoryModel> processAdvisories(List<String> urls) throws Exception {
+ List<SecurityAdvisoryModel> answer = new ArrayList<>();
+
+ try (CloseableHttpClient hc = new CloseableHttpClient()) {
+ for (String url : urls) {
+ HttpResponse<String> res
+ = hc.send(HttpRequest.newBuilder(new URI(url)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ if (res.statusCode() == 200) {
+ SecurityAdvisoryModel model = parseAdvisory(res.body());
+ if (model != null) {
+ answer.add(model);
+ }
+ }
+ }
+ }
+
+ return answer;
+ }
+
+ /**
+ * Parse one advisory Markdown file (YAML front matter). Returns {@code null} for drafts, non-advisory pages and
+ * files without parseable front matter, so only published advisories are included.
+ */
+ static SecurityAdvisoryModel parseAdvisory(String content) {
+ Map<String, Object> frontMatter = frontMatter(content);
+ if (frontMatter == null) {
+ return null;
+ }
+ if (!"security-advisory".equals(str(frontMatter.get("type")))) {
+ return null;
+ }
+ Object draft = frontMatter.get("draft");
+ if (Boolean.TRUE.equals(draft) || "true".equalsIgnoreCase(str(draft))) {
+ return null;
+ }
+ String cve = str(frontMatter.get("cve"));
+ if (cve == null || cve.isBlank()) {
+ return null;
+ }
+
+ SecurityAdvisoryModel model = new SecurityAdvisoryModel();
+ model.setCve(cve.trim());
+ model.setDate(trimmed(frontMatter.get("date")));
+ String severity = str(frontMatter.get("severity"));
+ if (severity != null) {
+ model.setSeverity(severity.trim().toUpperCase(Locale.ROOT));
+ }
+ model.setSummary(trimmed(frontMatter.get("summary")));
+ model.setAffected(trimmed(frontMatter.get("affected")));
+ model.setFixed(trimmed(frontMatter.get("fixed")));
+ model.setMitigation(trimmed(frontMatter.get("mitigation")));
+
+ String url = str(frontMatter.get("url"));
+ if (url == null || url.isBlank()) {
+ url = "/security/" + model.getCve() + ".html";
+ }
+ if (url.startsWith("/")) {
+ url = WEBSITE_BASE_URL + url;
+ }
+ model.setUrl(url.trim());
+
+ model.setComponents(extractComponents(str(frontMatter.get("title")), model.getSummary(),
+ str(frontMatter.get("description")), model.getMitigation()));
+ return model;
+ }
+
+ @SuppressWarnings("unchecked")
+ static Map<String, Object> frontMatter(String content) {
+ if (content == null) {
+ return null;
+ }
+ String trimmedContent = content.stripLeading();
+ if (!trimmedContent.startsWith("---")) {
+ return null;
+ }
+ int start = trimmedContent.indexOf('\n');
+ if (start < 0) {
+ return null;
+ }
+ int end = trimmedContent.indexOf("\n---", start);
+ if (end < 0) {
+ return null;
+ }
+ String yaml = trimmedContent.substring(start + 1, end);
+ try {
+ Object parsed = new Load(LoadSettings.builder().build()).loadFromString(yaml);
+ return parsed instanceof Map ? (Map<String, Object>) parsed : null;
+ } catch (Exception e) {
+ return null;
+ }
+ }
+
+ /**
+ * The Camel components named by the advisory text, as {@code camel-*} tokens (best-effort: some older advisories do
+ * not name components at all).
+ */
+ static List<String> extractComponents(String... texts) {
+ TreeSet<String> found = new TreeSet<>();
+ for (String text : texts) {
+ if (text == null) {
+ continue;
+ }
+ Matcher matcher = COMPONENT_TOKEN.matcher(text.toLowerCase(Locale.ROOT));
+ while (matcher.find()) {
+ found.add(matcher.group());
+ }
+ }
+ return new ArrayList<>(found);
+ }
+
+ private List<String> fetchAdvisoryLinks() throws Exception {
+ List<String> answer = new ArrayList<>();
+
+ // use JDK http client to call github api
+ try (CloseableHttpClient hc = new CloseableHttpClient()) {
+ HttpResponse<String> res = hc.send(
+ HttpRequest.newBuilder(new URI(GIT_SECURITY_URL)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ // follow redirect
+ if (res.statusCode() == 302) {
+ String loc = res.headers().firstValue("location").orElse(null);
+ if (loc != null) {
+ res = hc.send(HttpRequest.newBuilder(new URI(loc)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+ }
+ }
+
+ if (res.statusCode() == 200) {
+ JsonArray root = (JsonArray) Jsoner.deserialize(res.body());
+ for (Object o : root) {
+ JsonObject jo = (JsonObject) o;
+ String name = jo.getString("name");
+ if (name != null && ADVISORY_FILE.matcher(name).matches()) {
+ String url = jo.getString("download_url");
+ if (url != null) {
+ answer.add(url);
+ }
Review Comment:
The `COMPONENT_TOKEN` regex `camel-[a-z0-9]+(?:-[a-z0-9]+)*` extracts false-positive component names from advisory text. The generated `camel-security-advisories.json` contains bogus components including:
- **JIRA issue IDs**: `camel-10894`, `camel-12444`, `camel-23200`, `camel-23212`, `camel-23372`, `camel-23506` — extracted from prose like `CAMEL-12444` in mitigation URLs
- **Generic English words**: `camel-internal` (×10), `camel-prefixed` (×13), `camel-specific`, `camel-side`, `camel-namespace` — extracted from phrases like "Camel-namespace filter" and "camel-internal headers"
For example, CVE-2018-8027 has components `["camel-10894", "camel-12444"]` which are JIRA ticket IDs, not actual Camel component artifacts.
Consider:
1. Adding a negative lookahead to filter JIRA IDs: `camel-(?!\d+\b)[a-z][a-z0-9]+(?:-[a-z0-9]+)*`
2. Validating extracted tokens against the catalog's known artifact IDs
3. Adding a denylist for known false positives (`camel-internal`, `camel-prefixed`, etc.)
Option 1 alone fixes the JIRA IDs but not the English words. Option 2 would be the most comprehensive.
```suggestion
private static final Pattern COMPONENT_TOKEN = Pattern.compile("camel-(?!\\d+\\b)[a-z][a-z0-9]+(?:-[a-z0-9]+)*");
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #24573:
URL: https://github.com/apache/camel/pull/24573
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #24573:
URL: https://github.com/apache/camel/pull/24573#discussion_r3559342680
##########
tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSecurityAdvisoriesMojo.java:
##########
@@ -0,0 +1,292 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.maven.packaging;
+
+import java.io.File;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.inject.Inject;
+
+import org.apache.camel.tooling.model.JsonMapper;
+import org.apache.camel.tooling.model.SecurityAdvisoryModel;
+import org.apache.camel.util.json.JsonArray;
+import org.apache.camel.util.json.JsonObject;
+import org.apache.camel.util.json.Jsoner;
+import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.project.MavenProjectHelper;
+import org.codehaus.plexus.build.BuildContext;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
+
+/**
+ * Syncs the published Apache Camel CVE security advisories (the sources behind
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a>, maintained as Markdown files with YAML
+ * front matter in the camel-website git repository) into a JSON file shipped with camel-catalog, the same way the known
+ * releases are synced by {@code update-camel-releases}.
+ */
+@Mojo(name = "update-security-advisories", threadSafe = true, defaultPhase = LifecyclePhase.GENERATE_RESOURCES)
+public class UpdateSecurityAdvisoriesMojo extends AbstractGeneratorMojo {
+
+ private static final String GIT_SECURITY_URL
+ = "https://api.github.com/repos/apache/camel-website/contents/content/security";
+ private static final String WEBSITE_BASE_URL = "https://camel.apache.org";
+
+ private static final Pattern ADVISORY_FILE = Pattern.compile("CVE-\\d{4}-\\d{4,}\\.md");
+ private static final Pattern COMPONENT_TOKEN = Pattern.compile("camel-[a-z0-9]+(?:-[a-z0-9]+)*");
+ private static final Pattern CVE_ID = Pattern.compile("CVE-(\\d{4})-(\\d+)");
+
+ /**
+ * The output directory for the generated catalog advisories file
+ */
+ @Parameter(defaultValue = "${project.basedir}/src/generated/resources/org/apache/camel/catalog/advisories")
+ protected File outDir;
+
+ @Inject
+ public UpdateSecurityAdvisoriesMojo(MavenProjectHelper projectHelper, BuildContext buildContext) {
+ super(projectHelper, buildContext);
+ }
+
+ @Override
+ public void execute() throws MojoExecutionException, MojoFailureException {
+ if (outDir == null) {
+ outDir = new File(project.getBasedir(), "src/generated/resources");
+ }
+
+ try {
+ getLog().info("Updating Camel security advisories from camel-website");
+ List<String> links = fetchAdvisoryLinks();
+ List<SecurityAdvisoryModel> advisories = processAdvisories(links);
+ advisories.sort(Comparator.comparingLong(UpdateSecurityAdvisoriesMojo::cveOrdinal));
+ getLog().info("Found " + advisories.size() + " published security advisories");
+
+ JsonArray arr = new JsonArray();
+ for (SecurityAdvisoryModel advisory : advisories) {
+ arr.add(JsonMapper.asJsonObject(advisory));
+ }
+ String json = Jsoner.serialize(arr);
+ json = Jsoner.prettyPrint(json, 4);
+
+ Path path = outDir.toPath();
+ updateResource(path, "camel-security-advisories.json", json);
+ addResourceDirectory(path);
+ } catch (Exception e) {
+ throw new MojoExecutionException(e);
+ }
+ }
+
+ private List<SecurityAdvisoryModel> processAdvisories(List<String> urls) throws Exception {
+ List<SecurityAdvisoryModel> answer = new ArrayList<>();
+
+ try (CloseableHttpClient hc = new CloseableHttpClient()) {
+ for (String url : urls) {
+ HttpResponse<String> res
+ = hc.send(HttpRequest.newBuilder(new URI(url)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ if (res.statusCode() == 200) {
+ SecurityAdvisoryModel model = parseAdvisory(res.body());
+ if (model != null) {
+ answer.add(model);
+ }
+ }
+ }
+ }
+
+ return answer;
+ }
+
+ /**
+ * Parse one advisory Markdown file (YAML front matter). Returns {@code null} for drafts, non-advisory pages and
+ * files without parseable front matter, so only published advisories are included.
+ */
+ static SecurityAdvisoryModel parseAdvisory(String content) {
+ Map<String, Object> frontMatter = frontMatter(content);
+ if (frontMatter == null) {
+ return null;
+ }
+ if (!"security-advisory".equals(str(frontMatter.get("type")))) {
+ return null;
+ }
+ Object draft = frontMatter.get("draft");
+ if (Boolean.TRUE.equals(draft) || "true".equalsIgnoreCase(str(draft))) {
+ return null;
+ }
+ String cve = str(frontMatter.get("cve"));
+ if (cve == null || cve.isBlank()) {
+ return null;
+ }
+
+ SecurityAdvisoryModel model = new SecurityAdvisoryModel();
+ model.setCve(cve.trim());
+ model.setDate(trimmed(frontMatter.get("date")));
+ String severity = str(frontMatter.get("severity"));
+ if (severity != null) {
+ model.setSeverity(severity.trim().toUpperCase(Locale.ROOT));
+ }
+ model.setSummary(trimmed(frontMatter.get("summary")));
+ model.setAffected(trimmed(frontMatter.get("affected")));
+ model.setFixed(trimmed(frontMatter.get("fixed")));
+ model.setMitigation(trimmed(frontMatter.get("mitigation")));
+
+ String url = str(frontMatter.get("url"));
+ if (url == null || url.isBlank()) {
+ url = "/security/" + model.getCve() + ".html";
+ }
+ if (url.startsWith("/")) {
+ url = WEBSITE_BASE_URL + url;
+ }
+ model.setUrl(url.trim());
+
+ model.setComponents(extractComponents(str(frontMatter.get("title")), model.getSummary(),
+ str(frontMatter.get("description")), model.getMitigation()));
+ return model;
+ }
+
+ @SuppressWarnings("unchecked")
+ static Map<String, Object> frontMatter(String content) {
+ if (content == null) {
+ return null;
+ }
+ String trimmedContent = content.stripLeading();
+ if (!trimmedContent.startsWith("---")) {
+ return null;
+ }
+ int start = trimmedContent.indexOf('\n');
+ if (start < 0) {
+ return null;
+ }
+ int end = trimmedContent.indexOf("\n---", start);
+ if (end < 0) {
+ return null;
+ }
+ String yaml = trimmedContent.substring(start + 1, end);
+ try {
+ Object parsed = new Load(LoadSettings.builder().build()).loadFromString(yaml);
+ return parsed instanceof Map ? (Map<String, Object>) parsed : null;
+ } catch (Exception e) {
+ return null;
+ }
+ }
+
+ /**
+ * The Camel components named by the advisory text, as {@code camel-*} tokens (best-effort: some older advisories do
+ * not name components at all).
+ */
+ static List<String> extractComponents(String... texts) {
+ TreeSet<String> found = new TreeSet<>();
+ for (String text : texts) {
+ if (text == null) {
+ continue;
+ }
+ Matcher matcher = COMPONENT_TOKEN.matcher(text.toLowerCase(Locale.ROOT));
+ while (matcher.find()) {
+ found.add(matcher.group());
+ }
+ }
+ return new ArrayList<>(found);
+ }
+
+ private List<String> fetchAdvisoryLinks() throws Exception {
+ List<String> answer = new ArrayList<>();
+
+ // use JDK http client to call github api
+ try (CloseableHttpClient hc = new CloseableHttpClient()) {
+ HttpResponse<String> res = hc.send(
+ HttpRequest.newBuilder(new URI(GIT_SECURITY_URL)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ // follow redirect
+ if (res.statusCode() == 302) {
+ String loc = res.headers().firstValue("location").orElse(null);
+ if (loc != null) {
+ res = hc.send(HttpRequest.newBuilder(new URI(loc)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+ }
+ }
+
+ if (res.statusCode() == 200) {
+ JsonArray root = (JsonArray) Jsoner.deserialize(res.body());
+ for (Object o : root) {
+ JsonObject jo = (JsonObject) o;
+ String name = jo.getString("name");
+ if (name != null && ADVISORY_FILE.matcher(name).matches()) {
+ String url = jo.getString("download_url");
+ if (url != null) {
+ answer.add(url);
+ }
Review Comment:
Fixed in 3531d80ee6ed with a combination of your options 1 and 3: the token regex now requires the first segment to start with a letter (`camel-[a-z][a-z0-9]+(?:-[a-z0-9]+)*`, which subsumes the digit lookahead and drops all 6 lowercased JIRA ids), plus a denylist for the English prose tokens (`camel-internal`, `camel-prefixed`, `camel-specific`, `camel-side`, `camel-namespace`, and a few likely future ones such as `camel-case`/`camel-based`). Regenerated JSON verified: exactly the 11 bogus tokens (32 occurrences) are gone and 78 legitimate tokens remain; regression test added.
On option 2 (validating against the catalog's known artifact ids) — I measured it and deliberately did not adopt it: strict validation would silently drop 10 legitimate component names across 9 CVEs, because old advisories name components that have since been removed or renamed: `camel-xstream` (CVE-2015-5344), `camel-hessian` (CVE-2017-12633), `camel-castor` (CVE-2017-12634), `camel-xmljson` (CVE-2019-0188), `camel-stomp` (CVE-2025-27636), and the legacy `camel-cxf`/`camel-cxfrs`/`camel-cxf-common`/`camel-cxf-transport`/`camel-knative-http` artifact names. For a security tool those are exactly the components users on older versions need to be able to filter by, so the denylist approach keeps them while removing all observed false positives. This rationale is documented in a code comment on the denylist.
_Claude Code on behalf of oscerd_
##########
tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSecurityAdvisoriesMojo.java:
##########
@@ -0,0 +1,292 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.maven.packaging;
+
+import java.io.File;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.inject.Inject;
+
+import org.apache.camel.tooling.model.JsonMapper;
+import org.apache.camel.tooling.model.SecurityAdvisoryModel;
+import org.apache.camel.util.json.JsonArray;
+import org.apache.camel.util.json.JsonObject;
+import org.apache.camel.util.json.Jsoner;
+import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.project.MavenProjectHelper;
+import org.codehaus.plexus.build.BuildContext;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
+
+/**
+ * Syncs the published Apache Camel CVE security advisories (the sources behind
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a>, maintained as Markdown files with YAML
+ * front matter in the camel-website git repository) into a JSON file shipped with camel-catalog, the same way the known
+ * releases are synced by {@code update-camel-releases}.
+ */
+@Mojo(name = "update-security-advisories", threadSafe = true, defaultPhase = LifecyclePhase.GENERATE_RESOURCES)
+public class UpdateSecurityAdvisoriesMojo extends AbstractGeneratorMojo {
+
+ private static final String GIT_SECURITY_URL
+ = "https://api.github.com/repos/apache/camel-website/contents/content/security";
+ private static final String WEBSITE_BASE_URL = "https://camel.apache.org";
+
+ private static final Pattern ADVISORY_FILE = Pattern.compile("CVE-\\d{4}-\\d{4,}\\.md");
+ private static final Pattern COMPONENT_TOKEN = Pattern.compile("camel-[a-z0-9]+(?:-[a-z0-9]+)*");
+ private static final Pattern CVE_ID = Pattern.compile("CVE-(\\d{4})-(\\d+)");
+
+ /**
+ * The output directory for the generated catalog advisories file
+ */
+ @Parameter(defaultValue = "${project.basedir}/src/generated/resources/org/apache/camel/catalog/advisories")
+ protected File outDir;
+
+ @Inject
+ public UpdateSecurityAdvisoriesMojo(MavenProjectHelper projectHelper, BuildContext buildContext) {
+ super(projectHelper, buildContext);
+ }
+
+ @Override
+ public void execute() throws MojoExecutionException, MojoFailureException {
+ if (outDir == null) {
+ outDir = new File(project.getBasedir(), "src/generated/resources");
+ }
+
+ try {
+ getLog().info("Updating Camel security advisories from camel-website");
+ List<String> links = fetchAdvisoryLinks();
+ List<SecurityAdvisoryModel> advisories = processAdvisories(links);
+ advisories.sort(Comparator.comparingLong(UpdateSecurityAdvisoriesMojo::cveOrdinal));
+ getLog().info("Found " + advisories.size() + " published security advisories");
+
+ JsonArray arr = new JsonArray();
+ for (SecurityAdvisoryModel advisory : advisories) {
+ arr.add(JsonMapper.asJsonObject(advisory));
+ }
+ String json = Jsoner.serialize(arr);
+ json = Jsoner.prettyPrint(json, 4);
+
+ Path path = outDir.toPath();
+ updateResource(path, "camel-security-advisories.json", json);
+ addResourceDirectory(path);
+ } catch (Exception e) {
+ throw new MojoExecutionException(e);
+ }
+ }
+
+ private List<SecurityAdvisoryModel> processAdvisories(List<String> urls) throws Exception {
+ List<SecurityAdvisoryModel> answer = new ArrayList<>();
+
+ try (CloseableHttpClient hc = new CloseableHttpClient()) {
+ for (String url : urls) {
+ HttpResponse<String> res
+ = hc.send(HttpRequest.newBuilder(new URI(url)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ if (res.statusCode() == 200) {
+ SecurityAdvisoryModel model = parseAdvisory(res.body());
+ if (model != null) {
+ answer.add(model);
+ }
+ }
+ }
+ }
+
+ return answer;
+ }
+
+ /**
+ * Parse one advisory Markdown file (YAML front matter). Returns {@code null} for drafts, non-advisory pages and
+ * files without parseable front matter, so only published advisories are included.
+ */
+ static SecurityAdvisoryModel parseAdvisory(String content) {
+ Map<String, Object> frontMatter = frontMatter(content);
+ if (frontMatter == null) {
+ return null;
+ }
+ if (!"security-advisory".equals(str(frontMatter.get("type")))) {
+ return null;
+ }
+ Object draft = frontMatter.get("draft");
+ if (Boolean.TRUE.equals(draft) || "true".equalsIgnoreCase(str(draft))) {
+ return null;
+ }
+ String cve = str(frontMatter.get("cve"));
+ if (cve == null || cve.isBlank()) {
+ return null;
+ }
+
+ SecurityAdvisoryModel model = new SecurityAdvisoryModel();
+ model.setCve(cve.trim());
+ model.setDate(trimmed(frontMatter.get("date")));
+ String severity = str(frontMatter.get("severity"));
+ if (severity != null) {
+ model.setSeverity(severity.trim().toUpperCase(Locale.ROOT));
+ }
+ model.setSummary(trimmed(frontMatter.get("summary")));
+ model.setAffected(trimmed(frontMatter.get("affected")));
+ model.setFixed(trimmed(frontMatter.get("fixed")));
+ model.setMitigation(trimmed(frontMatter.get("mitigation")));
+
+ String url = str(frontMatter.get("url"));
+ if (url == null || url.isBlank()) {
+ url = "/security/" + model.getCve() + ".html";
+ }
+ if (url.startsWith("/")) {
+ url = WEBSITE_BASE_URL + url;
+ }
+ model.setUrl(url.trim());
+
+ model.setComponents(extractComponents(str(frontMatter.get("title")), model.getSummary(),
+ str(frontMatter.get("description")), model.getMitigation()));
+ return model;
+ }
+
+ @SuppressWarnings("unchecked")
+ static Map<String, Object> frontMatter(String content) {
+ if (content == null) {
+ return null;
+ }
+ String trimmedContent = content.stripLeading();
+ if (!trimmedContent.startsWith("---")) {
+ return null;
+ }
+ int start = trimmedContent.indexOf('\n');
+ if (start < 0) {
+ return null;
+ }
+ int end = trimmedContent.indexOf("\n---", start);
+ if (end < 0) {
+ return null;
+ }
+ String yaml = trimmedContent.substring(start + 1, end);
+ try {
+ Object parsed = new Load(LoadSettings.builder().build()).loadFromString(yaml);
+ return parsed instanceof Map ? (Map<String, Object>) parsed : null;
+ } catch (Exception e) {
+ return null;
+ }
+ }
+
+ /**
+ * The Camel components named by the advisory text, as {@code camel-*} tokens (best-effort: some older advisories do
+ * not name components at all).
+ */
+ static List<String> extractComponents(String... texts) {
+ TreeSet<String> found = new TreeSet<>();
Review Comment:
Fixed in 3531d80ee6ed: took your "at minimum" blocklist option, strengthened by a letter-first regex (`camel-[a-z][a-z0-9]+...`) that removes the `camel-\d+` JIRA ids without a separate pattern. Regenerated JSON verified: exactly the 11 spurious tokens (32 occurrences across 25 entries) are gone, 78 legitimate tokens remain, and `camel_security_advisories(component="internal")` now returns nothing. I deliberately did not post-filter against the current catalog's component list because old advisories legitimately name removed/renamed components (`camel-xstream`, `camel-hessian`, `camel-castor`, `camel-xmljson`, legacy `camel-cxf`/`camel-cxfrs` artifacts) which would otherwise become unfilterable — details in the reply to Guillaume's comment and in a code comment on the denylist. Regression test added.
_Claude Code on behalf of oscerd_
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/AdvisoryTools.java:
##########
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.dsl.jbang.core.commands.mcp;
+
+import java.util.List;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import io.quarkiverse.mcp.server.Tool;
+import io.quarkiverse.mcp.server.ToolArg;
+import io.quarkiverse.mcp.server.ToolCallException;
+import org.apache.camel.tooling.model.SecurityAdvisoryModel;
+
+/**
+ * MCP Tool exposing the published Apache Camel CVE security advisories from
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a> (shipped with the Camel catalog).
+ * <p>
+ * Lets an LLM answer questions such as "is my Camel 4.10.1 project affected by known CVEs?" or "which CVEs were
+ * published for camel-kafka and in which versions are they fixed?".
+ */
+@ApplicationScoped
+public class AdvisoryTools {
+
+ @Inject
+ AdvisoryService advisoryService;
+
+ @Tool(annotations = @Tool.Annotations(readOnlyHint = true, destructiveHint = false, openWorldHint = false),
+ description = "List published Apache Camel CVE security advisories (the data behind "
+ + "https://camel.apache.org/security/), optionally filtered by Camel version, component and "
+ + "severity. When camelVersion is set, advisories whose parsed affected ranges exclude that "
+ + "version are dropped; advisories whose ranges cannot be parsed are kept with "
+ + "affectsGivenVersion unset - judge those from the 'affected' text. The advisory data ships "
+ + "with the Camel catalog (synced from the published advisories when Camel is released), so "
+ + "advisories published after this Camel version was released are not included - check the "
+ + "web page for the very latest.")
+ public AdvisoriesResult camel_security_advisories(
+ @ToolArg(description = "Camel version to check, e.g. 4.10.1 (optional)") String camelVersion,
+ @ToolArg(description = "Component to filter by, e.g. kafka or camel-kafka (optional; best-effort match "
+ + "against components named in the advisory text - older advisories may not name "
+ + "components)") String component,
+ @ToolArg(description = "Severity to filter by as published, e.g. LOW, MEDIUM, MODERATE, IMPORTANT or "
+ + "CRITICAL (optional)") String severity) {
Review Comment:
Fixed in 3531d80ee6ed, applied your suggested wording. Verified against the regenerated JSON: the actual severity set is exactly LOW, MEDIUM, HIGH, CRITICAL.
_Claude Code on behalf of oscerd_
##########
catalog/camel-catalog/src/main/java/org/apache/camel/catalog/CamelCatalog.java:
##########
@@ -663,6 +664,13 @@ default BaseModel<? extends BaseOptionModel> model(Kind kind, String name) {
*/
List<ReleaseModel> camelQuarkusReleases();
+ /**
+ * Load all published Camel CVE security advisories from catalog (the data behind
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a>, synced into the catalog when it was
+ * built).
+ */
+ List<SecurityAdvisoryModel> camelSecurityAdvisories();
Review Comment:
Added `@since 4.22` in 3531d80ee6ed.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #24573:
URL: https://github.com/apache/camel/pull/24573#discussion_r3557899904
##########
dsl/camel-jbang/camel-jbang-mcp/src/main/java/org/apache/camel/dsl/jbang/core/commands/mcp/AdvisoryTools.java:
##########
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.dsl.jbang.core.commands.mcp;
+
+import java.util.List;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import io.quarkiverse.mcp.server.Tool;
+import io.quarkiverse.mcp.server.ToolArg;
+import io.quarkiverse.mcp.server.ToolCallException;
+import org.apache.camel.tooling.model.SecurityAdvisoryModel;
+
+/**
+ * MCP Tool exposing the published Apache Camel CVE security advisories from
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a> (shipped with the Camel catalog).
+ * <p>
+ * Lets an LLM answer questions such as "is my Camel 4.10.1 project affected by known CVEs?" or "which CVEs were
+ * published for camel-kafka and in which versions are they fixed?".
+ */
+@ApplicationScoped
+public class AdvisoryTools {
+
+ @Inject
+ AdvisoryService advisoryService;
+
+ @Tool(annotations = @Tool.Annotations(readOnlyHint = true, destructiveHint = false, openWorldHint = false),
+ description = "List published Apache Camel CVE security advisories (the data behind "
+ + "https://camel.apache.org/security/), optionally filtered by Camel version, component and "
+ + "severity. When camelVersion is set, advisories whose parsed affected ranges exclude that "
+ + "version are dropped; advisories whose ranges cannot be parsed are kept with "
+ + "affectsGivenVersion unset - judge those from the 'affected' text. The advisory data ships "
+ + "with the Camel catalog (synced from the published advisories when Camel is released), so "
+ + "advisories published after this Camel version was released are not included - check the "
+ + "web page for the very latest.")
+ public AdvisoriesResult camel_security_advisories(
+ @ToolArg(description = "Camel version to check, e.g. 4.10.1 (optional)") String camelVersion,
+ @ToolArg(description = "Component to filter by, e.g. kafka or camel-kafka (optional; best-effort match "
+ + "against components named in the advisory text - older advisories may not name "
+ + "components)") String component,
+ @ToolArg(description = "Severity to filter by as published, e.g. LOW, MEDIUM, MODERATE, IMPORTANT or "
+ + "CRITICAL (optional)") String severity) {
Review Comment:
The description lists `MODERATE` and `IMPORTANT` as valid severity values, but the generated JSON only uses `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` (the mojo normalizes with `toUpperCase`). Listing non-existent values will confuse the LLM into using filter values that never match.
```suggestion
@ToolArg(description = "Severity to filter by: LOW, MEDIUM, HIGH, or CRITICAL "
+ "(optional)") String severity) {
```
##########
tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSecurityAdvisoriesMojo.java:
##########
@@ -0,0 +1,292 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.maven.packaging;
+
+import java.io.File;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import javax.inject.Inject;
+
+import org.apache.camel.tooling.model.JsonMapper;
+import org.apache.camel.tooling.model.SecurityAdvisoryModel;
+import org.apache.camel.util.json.JsonArray;
+import org.apache.camel.util.json.JsonObject;
+import org.apache.camel.util.json.Jsoner;
+import org.apache.maven.plugin.MojoExecutionException;
+import org.apache.maven.plugin.MojoFailureException;
+import org.apache.maven.plugins.annotations.LifecyclePhase;
+import org.apache.maven.plugins.annotations.Mojo;
+import org.apache.maven.plugins.annotations.Parameter;
+import org.apache.maven.project.MavenProjectHelper;
+import org.codehaus.plexus.build.BuildContext;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
+
+/**
+ * Syncs the published Apache Camel CVE security advisories (the sources behind
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a>, maintained as Markdown files with YAML
+ * front matter in the camel-website git repository) into a JSON file shipped with camel-catalog, the same way the known
+ * releases are synced by {@code update-camel-releases}.
+ */
+@Mojo(name = "update-security-advisories", threadSafe = true, defaultPhase = LifecyclePhase.GENERATE_RESOURCES)
+public class UpdateSecurityAdvisoriesMojo extends AbstractGeneratorMojo {
+
+ private static final String GIT_SECURITY_URL
+ = "https://api.github.com/repos/apache/camel-website/contents/content/security";
+ private static final String WEBSITE_BASE_URL = "https://camel.apache.org";
+
+ private static final Pattern ADVISORY_FILE = Pattern.compile("CVE-\\d{4}-\\d{4,}\\.md");
+ private static final Pattern COMPONENT_TOKEN = Pattern.compile("camel-[a-z0-9]+(?:-[a-z0-9]+)*");
+ private static final Pattern CVE_ID = Pattern.compile("CVE-(\\d{4})-(\\d+)");
+
+ /**
+ * The output directory for the generated catalog advisories file
+ */
+ @Parameter(defaultValue = "${project.basedir}/src/generated/resources/org/apache/camel/catalog/advisories")
+ protected File outDir;
+
+ @Inject
+ public UpdateSecurityAdvisoriesMojo(MavenProjectHelper projectHelper, BuildContext buildContext) {
+ super(projectHelper, buildContext);
+ }
+
+ @Override
+ public void execute() throws MojoExecutionException, MojoFailureException {
+ if (outDir == null) {
+ outDir = new File(project.getBasedir(), "src/generated/resources");
+ }
+
+ try {
+ getLog().info("Updating Camel security advisories from camel-website");
+ List<String> links = fetchAdvisoryLinks();
+ List<SecurityAdvisoryModel> advisories = processAdvisories(links);
+ advisories.sort(Comparator.comparingLong(UpdateSecurityAdvisoriesMojo::cveOrdinal));
+ getLog().info("Found " + advisories.size() + " published security advisories");
+
+ JsonArray arr = new JsonArray();
+ for (SecurityAdvisoryModel advisory : advisories) {
+ arr.add(JsonMapper.asJsonObject(advisory));
+ }
+ String json = Jsoner.serialize(arr);
+ json = Jsoner.prettyPrint(json, 4);
+
+ Path path = outDir.toPath();
+ updateResource(path, "camel-security-advisories.json", json);
+ addResourceDirectory(path);
+ } catch (Exception e) {
+ throw new MojoExecutionException(e);
+ }
+ }
+
+ private List<SecurityAdvisoryModel> processAdvisories(List<String> urls) throws Exception {
+ List<SecurityAdvisoryModel> answer = new ArrayList<>();
+
+ try (CloseableHttpClient hc = new CloseableHttpClient()) {
+ for (String url : urls) {
+ HttpResponse<String> res
+ = hc.send(HttpRequest.newBuilder(new URI(url)).timeout(Duration.ofSeconds(20)).build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ if (res.statusCode() == 200) {
+ SecurityAdvisoryModel model = parseAdvisory(res.body());
+ if (model != null) {
+ answer.add(model);
+ }
+ }
+ }
+ }
+
+ return answer;
+ }
+
+ /**
+ * Parse one advisory Markdown file (YAML front matter). Returns {@code null} for drafts, non-advisory pages and
+ * files without parseable front matter, so only published advisories are included.
+ */
+ static SecurityAdvisoryModel parseAdvisory(String content) {
+ Map<String, Object> frontMatter = frontMatter(content);
+ if (frontMatter == null) {
+ return null;
+ }
+ if (!"security-advisory".equals(str(frontMatter.get("type")))) {
+ return null;
+ }
+ Object draft = frontMatter.get("draft");
+ if (Boolean.TRUE.equals(draft) || "true".equalsIgnoreCase(str(draft))) {
+ return null;
+ }
+ String cve = str(frontMatter.get("cve"));
+ if (cve == null || cve.isBlank()) {
+ return null;
+ }
+
+ SecurityAdvisoryModel model = new SecurityAdvisoryModel();
+ model.setCve(cve.trim());
+ model.setDate(trimmed(frontMatter.get("date")));
+ String severity = str(frontMatter.get("severity"));
+ if (severity != null) {
+ model.setSeverity(severity.trim().toUpperCase(Locale.ROOT));
+ }
+ model.setSummary(trimmed(frontMatter.get("summary")));
+ model.setAffected(trimmed(frontMatter.get("affected")));
+ model.setFixed(trimmed(frontMatter.get("fixed")));
+ model.setMitigation(trimmed(frontMatter.get("mitigation")));
+
+ String url = str(frontMatter.get("url"));
+ if (url == null || url.isBlank()) {
+ url = "/security/" + model.getCve() + ".html";
+ }
+ if (url.startsWith("/")) {
+ url = WEBSITE_BASE_URL + url;
+ }
+ model.setUrl(url.trim());
+
+ model.setComponents(extractComponents(str(frontMatter.get("title")), model.getSummary(),
+ str(frontMatter.get("description")), model.getMitigation()));
+ return model;
+ }
+
+ @SuppressWarnings("unchecked")
+ static Map<String, Object> frontMatter(String content) {
+ if (content == null) {
+ return null;
+ }
+ String trimmedContent = content.stripLeading();
+ if (!trimmedContent.startsWith("---")) {
+ return null;
+ }
+ int start = trimmedContent.indexOf('\n');
+ if (start < 0) {
+ return null;
+ }
+ int end = trimmedContent.indexOf("\n---", start);
+ if (end < 0) {
+ return null;
+ }
+ String yaml = trimmedContent.substring(start + 1, end);
+ try {
+ Object parsed = new Load(LoadSettings.builder().build()).loadFromString(yaml);
+ return parsed instanceof Map ? (Map<String, Object>) parsed : null;
+ } catch (Exception e) {
+ return null;
+ }
+ }
+
+ /**
+ * The Camel components named by the advisory text, as {@code camel-*} tokens (best-effort: some older advisories do
+ * not name components at all).
+ */
+ static List<String> extractComponents(String... texts) {
+ TreeSet<String> found = new TreeSet<>();
Review Comment:
The `COMPONENT_TOKEN` regex `camel-[a-z0-9]+(?:-[a-z0-9]+)*` matches any `camel-*` token in the advisory text, producing **9 distinct spurious component entries across 32 occurrences in 25 CVE entries**:
- **JIRA ticket numbers:** `camel-10894`, `camel-12444`, `camel-23200`, `camel-23212`, `camel-23372`, `camel-23506` — from prose like "CAMEL-23212 fix" lowercased to match.
- **English words from prose:** `camel-internal` (10 CVEs), `camel-prefixed` (13 CVEs), `camel-specific`, `camel-namespace`, `camel-side` — from phrases like "camel-internal headers", "non-Camel-prefixed names".
These pollute filtering — e.g. `camel_security_advisories(component="internal")` returns 10 false matches, and `matchAdvisories()` in HardenTools would try to match route components against `camel-internal`.
Suggestion: post-filter extracted tokens against a known-component list from the catalog, or at minimum add a blocklist for common false positives (`camel-internal`, `camel-prefixed`, `camel-specific`, `camel-side`, `camel-namespace`, and tokens matching `camel-\d+`).
##########
catalog/camel-catalog/src/main/java/org/apache/camel/catalog/CamelCatalog.java:
##########
@@ -663,6 +664,13 @@ default BaseModel<? extends BaseOptionModel> model(Kind kind, String name) {
*/
List<ReleaseModel> camelQuarkusReleases();
+ /**
+ * Load all published Camel CVE security advisories from catalog (the data behind
+ * <a href="https://camel.apache.org/security/">camel.apache.org/security</a>, synced into the catalog when it was
+ * built).
+ */
+ List<SecurityAdvisoryModel> camelSecurityAdvisories();
Review Comment:
Minor: per project conventions, new public methods on API interfaces should include a `@since` Javadoc tag. Consider adding `@since 4.22` to the method Javadoc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23979: Expose published CVE security advisories via camel-catalog and camel-jbang-mcp [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on PR #24573:
URL: https://github.com/apache/camel/pull/24573#issuecomment-4936299503
⏺ The PR failed due to a flaky test in camel-milvus — completely unrelated to the PR's changes.
The PR touches camel-catalog, camel-jbang-mcp, camel-tooling-model, and camel-package-maven-plugin (security advisories feature). The failure is in components/camel-ai/camel-milvus integration tests
(maven-failsafe-plugin:verify), which has nothing to do with any of those modules.
This is a known-flaky area — Milvus tests depend on a Testcontainers-managed vector DB that can be unreliable in CI. You can safely re-run the CI workflow or ignore the failure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org