[Croway]

Jira: https://issues.apache.org/jira/browse/CAMEL-25984

Follow-up of #28283, as discussed in its review: the fix is backported to camel-4.22.x (#28502) and camel-4.18.x (#28503), so this adds the matching upgrade guide entries on main:

• camel-4x-upgrade-guide-4_22.adoc, under "Upgrading from 4.22.2 to 4.22.3"
• camel-4x-upgrade-guide-4_18.adoc, under "Upgrading from 4.18.5 to 4.18.6"

The text is the same as the 4.24 entry added by #28283, including the null entry. Documentation only.

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[oscerd]

Reviewed — clean, and correctly placed. The entry is added to both the 4.18 and 4.22 guides on main (the right place for a backported change per the project convention), and in each it lands in the newest section — "Upgrading from 4.18.5 to 4.18.6" and "Upgrading from 4.22.2 to 4.22.3" — which matches where the fix is being backported. The heading uses the auto-generated anchor (no explicit [[...]]), and the text is a proper migration note: it states the new behaviour (Access-Control-Allow-Credentials: true only for explicitly listed origins, never with */null/wildcard), what still works (origin allowed, without credentials), and the action for users (list the origin in allowedOrigins to keep credentialed cross-origin requests). No blockers.

(The full build checks are still completing; this is a docs-only change.)

Claude Code on behalf of oscerd

[github-actions]

🧪 CI tested the following changed modules:

• docs

---

🔬 Scalpel shadow comparison — Scalpel: 0 of 707 tested, 0 compile-only — current: 0 all tested

Maveniverse Scalpel detected 0 affected modules (current approach: 0).

Skip-tests mode would test 0 modules (1 direct + 0 downstream), skip tests for 0 (generated code, meta-modules)

Modules Scalpel would test (0)

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

---

⚙️ View full build and test results

[davsclaus]

Thanks @Croway, this looks good. The notes sit at the end of the newest patch sections, "Upgrading from 4.22.2 to 4.22.3" and "Upgrading from 4.18.5 to 4.18.6". The text matches what isNamedOrigins does on the backports (#28502, #28503): no credentials for an unset or * value, a wildcard entry, or a null entry. The reflow also fixes the overlong line from the 4.24 note.

One merge note: #28507 inserts its camel-undertow note at the same spot in camel-4x-upgrade-guide-4_22.adoc, so whichever of the two merges second will need a rebase; the 4.18 hunks don't overlap.

---

Reviewed with Claude Code on behalf of davsclaus. This review was generated by an AI agent and may contain inaccuracies; please verify all suggestions before applying.