Daily automated monitoring of upstream security activity for libraries we run in out-of-support, pinned versions (currently Apache Camel 4.8.8), so that fixes can be backported in-house.
A scheduled Claude Code cloud routine runs every morning, follows the methodology in AGENT.md, and:
- sweeps GitHub Security Advisories, NVD, the project's security page, Apache Jira, and the upstream GitHub repo for new security-relevant items,
- assesses whether each finding affects our pinned version and the components we actually use (config/libraries.yaml),
- locates the official upstream fix (PR/commit) and assesses its backportability,
- commits a daily report to reports/ and updates the dedup state in state/seen.json,
- delivers the result by email / Teams (targets are configured in the routine, not in this repo).
| Path | Purpose |
|---|---|
AGENT.md |
The agent's methodology — edit this to tune behaviour |
config/libraries.yaml |
Which libraries/versions/components to watch |
state/seen.json |
Findings already reported (dedup across runs) |
reports/YYYY-MM-DD.md |
One report per day, committed by the agent |
Add an entry to config/libraries.yaml (a commented Spring Framework template is
included). No other change is required.