This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch camel-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.18.x by this push:
new 11829396d3aa CAMEL-25827: document endpoint factory hardening in
4.18.x upgrade guide (#29116)
11829396d3aa is described below
commit 11829396d3aacd18ee2a67f750a00f05207b93ff
Author: Guillaume Nodet <[email protected]>
AuthorDate: Wed Nov 4 09:21:31 2026 +0100
CAMEL-25827: document endpoint factory hardening in 4.18.x upgrade guide
(#29116)
---
.../user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 6 ++++++
1 file changed, 6 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 4172c2453450..e61fa43cb49f 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -182,6 +182,12 @@ a Saxon PE/EE stylesheet can call Java extension
functions) also restores the pr
replaces the factory, but the strategy's `XsltSaxonBuilder` keeps
`secureProcessing=true`, so the body is still
parsed with the restricted reader.
+On 4.18.x the `xslt-saxon` endpoint factory configuration changes as well, as
it did in 4.22.0: `secureProcessing`
+(default `true`) is now applied to the Saxon `TransformerFactory` also when no
`saxonExtensionFunctions` are
+configured, including a factory set with the `transformerFactory` option, and
a factory the endpoint creates itself
+now has `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_STYLESHEET` set to an empty
string. A Saxon PE/EE stylesheet that
+calls Java extension functions now needs `secureProcessing=false`.
+
=== camel-cometd - the JSONP transport is disabled by default
The CometD JSONP transport (`callback-polling`) is now disabled by default.
Only `long-polling` (and `websocket`,
