Camel 4.21.0 shipped on 1 July with 32 security fixes. 4.18.3 followed on 3 July with 34, and 4.14.8 on 4 July with 27. All three supported release lines were patched inside four days, and every finding got a signed public advisory. A batch of 32 gets noticed, usually for the wrong reason. So I want to write about the process that produced it rather than walk through the list. If you are running Camel in production, the number of advisories in a release tells you very little.

Continue reading ❯

SECURITY

If your security or compliance team has started asking “does it ship with an SBOM?”, you are not alone. The EU Cyber Resilience Act (CRA) will require SBOM delivery for software sold in the EU, US Executive Order 14028 and NIST guidance make SBOMs a federal procurement expectation, and enterprise evaluation checklists increasingly treat SBOM availability as a gate. Apache Camel has shipped SBOMs with every release since 4.0.3 — long before these regulations finalized.

Continue reading ❯

SECURITY