camel-salesforce CVE-2026-49099

Upgrade org.apache.camel:camel-salesforce to version 4.14.8 (for the 4.14.x LTS stream), 4.18.3 (for the 4.18.x stream), or 4.21.0 (latest), as confirmed by the Apache Camel security advisory at https://camel.apache.org/security/CVE-2026-49099.html. The fix renames 39 producer-read Exchange header constants to the CamelSalesforce* naming convention (e.g., sObjectQuery becomes CamelSalesforceSObjectQuery, apexUrl becomes CamelSalesforceApexUrl, apexQueryParam.* becomes CamelSalesforceApexQueryParam.*), bringing them under the HttpHeaderFilterStrategy's blocking namespace. After upgrading, any route logic that programmatically sets these headers using the old names must be updated to the new CamelSalesforce-prefixed names; endpoint-option configuration spelling is unchanged. For deployments that cannot upgrade immediately, add removeHeaders('sObject*') and removeHeaders('apex*') steps at the very start of any route containing an HTTP consumer feeding into a salesforce: producer to strip attacker-controlled headers before they reach the Salesforce component; note that this workaround strips all such headers, so any legitimate route logic that sets operation parameters via these header names must be refactored to use trusted internal sources (e.g., set headers explicitly from a trusted bean or constant after the strip). The fix commits are publicly available on GitHub (PR #23887, commits 3445c57e, 578eb2a0, 48880af9) for teams that need to apply patches to custom builds.