chore(deps): automated dependency updates 2026-08-28 - #162
Merged
Conversation
The 2026-08-28 nightly failed its post-update CVE scan with 8 findings: 7 in camel-core-engine 4.18.3, up to CRITICAL, plus one MEDIUM. Bump camel.version to 4.18.4, the 4.18.x LTS patch that fixes all 7 (CVE-2026-71300, -78329, -66906, -66907, -59230, -60093, -63621). Do not follow the advisories to 4.22.0. Camel 4.19.0 and later build against Spring Boot 4: 4.19.0 and 4.20.0 pull Spring Boot 4.0.5, 4.21.0 and 4.22.0 pull Spring Boot 4.1.0 with Spring Framework 7. This BOM pins spring-boot.version on 3.5.x, so 4.18.4 is the only version that clears all 7 and keeps Spring Boot 3. versions-rules.xml now caps Camel at 4.18.x so the automation cannot cross that line on its own. Root cause of the stale version: the dependencyManagement entry declared org.apache.camel:camel-spring-boot-starter. The correct groupId is org.apache.camel.springboot. The org.apache.camel coordinate exists on Central but stops at 3.0.0-RC3, and versions-rules.xml ignores RC versions, so versions-maven-plugin found no acceptable version for one artifact on ${camel.version} and logged "Leaving unchanged as 4.18.3" every night. camel.version has been silently unmaintained. The starter is now also declared in validation/pom.xml, so the coordinate is resolution-checked and CVE-scanned. Suppress the remaining MEDIUM, CVE-2026-54285, as a wrong-ecosystem CPE match. It is an opentelemetry-js flaw in the @opentelemetry/core npm package; NVD scopes it to target_sw=node.js, but Dependency-Check derives a target_sw-less CPE for the Java jars, so the wildcard matches. No Node OpenTelemetry ships here, and no Java release can satisfy the "fixed in 2.8.0" range. The entry is keyed on packageUrl rather than sha1 so it survives an opentelemetry.version bump, is pinned to this one CVE, and expires 2027-02-28 to force a re-review. Verified locally: mvn -B validate BUILD SUCCESS mvn -B clean package -f validation/pom.xml BUILD SUCCESS xmllint --schema dependency-suppression.1.3.xsd validates dependency:tree camel-core 4.18.4, camel-spring-boot-starter 4.18.4, spring-boot 3.5.16, spring-core 6.2.19 (unchanged) versions:display-property-updates ${camel.version} ... 4.18.4 (newest available)
izg-dependency-bot
Bot
added
dependencies
austinmoody
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Dependency Updates
This PR was created automatically by the
Automated Dependency Updatesworkflow.Version Changes (property-backed)
aws-sdk2.54.52.54.6Transitive Dependencies Auto-fixed
None — all transitives are already property-backed.
Transitives Requiring Manual Action
None.
Dependency Tree Changes
Excluded Libraries (not updated automatically)
org.bouncycastle:bc-fips(manually managed — not updated automatically)org.bouncycastle:bcpkix-fips(manually managed — not updated automatically)org.bouncycastle:bctls-fips(manually managed — not updated automatically)CVE Scan Results
dependency-check-report-pre-updateartifact.dependency-check-report-post-updateartifact.Notes
allowMajorUpdates=false).mvn dependency:resolveon the validation project.