This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new b74fcd1ae8d1 CAMEL-24576: sync 4.22 and 4.18 upgrade guides with the
dynamic-router backports (#26020)
b74fcd1ae8d1 is described below
commit b74fcd1ae8d17a9fd74322b02127c9bd4b41faef
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Sep 2 09:23:15 2026 +0200
CAMEL-24576: sync 4.22 and 4.18 upgrade guides with the dynamic-router
backports (#26020)
The upgrade guides for every release line live on main, so the backports of
#25992 to camel-4.22.x (#26018) and camel-4.18.x (#26019) carry no guide
edit.
Add the matching entries here.
The 4.18 entry notes that the line does not carry allowedSchemes or the
insecure:dev marker, since neither exists on that branch.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013xhhhvd8YPrPXuXxL1ULdt
Signed-off-by: Andrea Cosentino <[email protected]>
---
.../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 29 +++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 33 ++++++++++++++++++++++
2 files changed, 62 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 773d6e0c0297..d0780934c477 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -13,6 +13,35 @@ See the xref:camel-upgrade-recipes-tool.adoc[documentation]
page for details.
== Upgrading from 4.18.4 to 4.18.5
+=== camel-dynamic-router
+
+The `dynamic-router-control` endpoint no longer takes the subscription
`predicate`, or the
+`expressionLanguage` used to compile it, from the incoming control message. A
control message that
+supplies either is now rejected with an `IllegalArgumentException`.
+
+The predicate is compiled and then evaluated against every exchange on the
channel, so letting the
+control message choose both the language and the expression means the sender
of that message decides
+what runs inside the Camel process. Only enable this when control messages can
only come from a
+trusted source:
+
+[source,java]
+----
+from("kafka:subscriptions")
+ .unmarshal().json(DynamicRouterControlMessage.class)
+ .to("dynamic-router-control:subscribe?allowPredicateFromMessage=true");
+----
+
+Two alternatives avoid the flag entirely. A control message may still name a
`predicateBean`, which
+selects a `Predicate` that the route author bound in the registry; that path
is unchanged. The
+control endpoint may also carry `predicate` and `expressionLanguage` as URI
parameters, in which case
+every subscription made through that endpoint uses the route author's
expression. Subscription
+parameters that the control message does not carry now fall back to the values
configured on the
+endpoint.
+
+Note that this release line does not carry the `allowedSchemes` option added
to the `dynamic-router`
+endpoint on newer lines, nor the `security = "insecure:dev"` marker on
`allowPredicateFromMessage`,
+because neither the option allow-list nor the security policy framework exists
in 4.18.
+
=== camel-ftp, camel-sftp, camel-ftps, camel-mina-sftp, camel-azure-files,
camel-smb
The remote-file consumers now ensure the path resolved for a polled file stays
within the directory being
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 91118ac92bf5..9ad31f1f55c9 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -13,6 +13,39 @@ See the xref:camel-upgrade-recipes-tool.adoc[documentation]
page for details.
== Upgrading from 4.22.0 to 4.22.1
+=== camel-dynamic-router
+
+The `dynamic-router-control` endpoint no longer takes the subscription
`predicate`, or the
+`expressionLanguage` used to compile it, from the incoming control message. A
control message that
+supplies either is now rejected with an `IllegalArgumentException`.
+
+The predicate is compiled and then evaluated against every exchange on the
channel, so letting the
+control message choose both the language and the expression means the sender
of that message decides
+what runs inside the Camel process. Only enable this when control messages can
only come from a
+trusted source:
+
+[source,java]
+----
+from("kafka:subscriptions")
+ .unmarshal().json(DynamicRouterControlMessage.class)
+ .to("dynamic-router-control:subscribe?allowPredicateFromMessage=true");
+----
+
+Two alternatives avoid the flag entirely. A control message may still name a
`predicateBean`, which
+selects a `Predicate` that the route author bound in the registry; that path
is unchanged. The
+control endpoint may also carry `predicate` and `expressionLanguage` as URI
parameters, in which case
+every subscription made through that endpoint uses the route author's
expression. Subscription
+parameters that the control message does not carry now fall back to the values
configured on the
+endpoint.
+
+The option is annotated `security = "insecure:dev"`, so with
`camel.main.profile = prod` the default
+policy for that category is `fail`, and an endpoint that sets
`allowPredicateFromMessage=true` will
+not start unless you relax `camel.security.insecureDevPolicy`.
+
+The `dynamic-router` endpoint gained an `allowedSchemes` option, an optional
comma-separated
+allow-list of component schemes that a subscription destination may resolve
to. It is unset by
+default, which allows any scheme, matching the previous behaviour.
+
=== camel-exec
`allowControlHeaders` is now annotated `security = "insecure:dev"`.
