Apache Camel 4.22

Apply the Java 25 prompt first. These rules cover Apache Camel 4.22 LTS on Java 25 and were checked against 4.22.0. Camel also supports Java 17 and 21. Apply component-specific rules only when that component is enabled.

Version and production configuration

• Run the newest patch of the 4.22 LTS line, and move to a newer LTS line before the Camel download page stops listing 4.22: that page lists only supported releases, and an LTS line gets bug and security fixes for up to a year. Align core and component artifacts through camel-bom so every component moves with that patch, and read the 4.22.0 rules below as limits of 4.22.0 that a later patch may already remove.
• Set camel.main.profile=prod and require camel.security.policy=fail. The production profile defaults to failure, while no profile defaults to warnings. Review category overrides and camel.security.allowedProperties, which exempts named properties from checks. These checks detect annotated configuration risks; they do not authorize messages or sandbox routes.
• Treat route DSL, Kamelets, route templates, registry beans, scripts, and dependency declarations as executable application configuration. Keep their sources and reload locations writable only by trusted deployers; do not load tenant-submitted routes into a privileged shared CamelContext.
• Resolve endpoint credentials through controlled property placeholders or Camel vault functions. Do not supply fallback credentials for missing secrets. Placeholder syntax avoids the literal-secret check but does not establish secure storage, authorization,