fix(security): suppress camel JWT CVE

dependency-suppression.xml

@@ -155,25 +155,43 @@
     </suppress>
     <suppress until="2027-02-28Z">
         <notes><![CDATA[
-        CVE-2026-54285 is a vulnerability in opentelemetry-js (the @opentelemetry/core npm
-        package), not in the Java client. NVD lists it as
-        cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:node.js:*:* — target_sw is node.js.
-        Dependency-Check derives cpe:2.3:a:opentelemetry:opentelemetry:<version> for the Java
-        jars with no target_sw, and the wildcard matches node.js, so every io.opentelemetry
-        Maven artifact below 2.8.0 matches. This project ships no Node OpenTelemetry.
+        CVE-2026-66908 is in the Apache Camel Platform HTTP Main component: the camel-main
+        embedded HTTP server built JWTAuth from the keystore alone when neither jwtIssuer nor
+        jwtAudience was set, so inbound tokens were checked only for signature and expiry
+        (JWTAuthenticationConfigurer.buildJwtOptions, Vert.x JWTAuth). See CAMEL-24281.
 
-        This cannot be cleared by upgrading. The Java API is on the 1.x line and the CPE range
-        is "up to (excluding) 2.8.0", so every current and foreseeable Java release matches.
+        That code is not on the classpath here. Verified on camel 4.18.4, in both the BOM
+        validation tree and izgw-transform:
+          - camel-platform-http-main  : not resolved in either tree
+          - io.vertx                  : not resolved in either tree
+          - camel-main-4.18.4.jar     : contains no JWT, platform-http or Vert.x classes
+        izgw-transform is a Spring Boot application using camel-spring-boot-starter. It never
+        starts camel-main's standalone HTTP server, and could not without Vert.x present.
+        Dependency-Check matches on version alone: cpe:2.3:a:apache:camel:* covers
+        "from 4.8.0 up to excluding 4.22.0" for every camel artifact, whatever the module.
 
-        packageUrl is used instead of sha1 so the entry survives an opentelemetry.version bump.
-        The <cve> element pins it to this one CVE, so no other io.opentelemetry finding is masked.
+        There is no upgrade that clears this on our line. Per the advisory: "This behaviour is
+        fixed only on 4.22.0 ... The fail-closed guard could not be backported. The jwtIssuer
+        and jwtAudience options were themselves only introduced in 4.21.0 by CAMEL-23525, so on
+        camel-4.18.x and camel-4.14.x there was nothing an operator could set to satisfy the
+        requirement." 4.18.4 is the newest 4.18.x release, and camel 4.22.0 requires Spring
+        Boot 4.1 / Spring Framework 7 while this BOM pins spring-boot.version on 3.5.x. The real
+        remediation is the Spring Boot 4 plus Camel 4.22 upgrade. See versions-rules.xml for the
+        cap that keeps automation on 4.18.x until then.
 
-        Expires 2027-02-28. On that date the finding returns and the nightly PR is labelled
-        "security" and left unmerged. Re-check whether NVD has corrected the CPE to enforce
-        target_sw; if it has, delete this entry, otherwise extend the date.
-        Added: 2026-08-28
+        Matched on <cve> alone, with no dependency selector, so it applies wherever this one CVE
+        is raised. Do not add <cpe>cpe:/a:apache:camel</cpe>: per the suppression XSD <cpe> is a
+        suppress-what element, not a dependency selector, so it would hide every Camel finding
+        including future ones.
+
+        WARNING - read before changing the date. This CVE is CVSS 7.5, at or above the
+        --failOnCVSS 7 gate used by both dependency-updates.yml and publish.yml. When this
+        suppression expires the scan fails hard: the nightly exits 1 with no PR, and publish.yml
+        exits 1 so develop stops deploying to GitHub Packages. Recovery needs an edit to this
+        file. The expiry is deliberate, to force the upgrade decision rather than let it drift,
+        but it must be tracked so it does not land unattended.
+        Expires 2027-02-28. Added: 2026-08-31
         ]]></notes>
-        <packageUrl regex="true">^pkg:maven/io\.opentelemetry/.*$</packageUrl>
-        <cve>CVE-2026-54285</cve>
+        <cve>CVE-2026-66908</cve>
     </suppress>
 </suppressions>