Breadcrumbs

IM 8.1.0 — Customer-facing Breaking Changes

Every change in this document can be observed by a customer integration. Items are numbered §3.N to match the house style of the previous upgrade guide.

Impact summary — 24 items: 6 HIGH · 11 MEDIUM · 7 LOW.

Each item is tagged with how it shows up:

tag

meaning

DEPLOY-FAIL

the route/script no longer deploys — you find it by deploying

RUNTIME

throws when the route runs

SILENT

runs without error, but behaves differently — the dangerous category

The deep dives live in separate pages: Groovy 4→5 · Jackson 2→3 · Camel 4.18→4.22 · Library inventory

HIGH impact

3.1 Groovy 4 → 5: silent behaviour changes in customer scripts (SILENT) — HIGH

Groovy is the language your mappers, filters and expressions are written in. Several Groovy 5 changes alter results without any error:

  • File / Path truthiness now means "exists on disk", not "not null"

  • property access on Map-implementing classes now prefers a declared field over the map entry

  • % dispatches to remainder() instead of mod() on custom types

  • @CompileStatic may now select a different overload

  • findIndexValues returns an Iterator; chop no longer pads

Action. Read Groovy 4→5 §1 and run the search patterns in §4. This is the item most likely to change behaviour without telling you.

3.2 Groovy sandbox: Jackson classes changed package (DEPLOY-FAIL) — HIGH

Scripts may use tools.jackson.databind.JsonNode, tools.jackson.core.JsonParser and tools.jackson.core.JsonToken. The com.fasterxml.jackson.* equivalents are no longer on the sandbox allow-list.

Groovy
import com.fasterxml.jackson.databind.JsonNode   // rejected on IM 8.1.0
import tools.jackson.databind.JsonNode           // correct

Note that com.fasterxml.jackson.annotation.* is unchanged and still correct — Jackson 3 shares that package. See Jackson 2→3 §2.1.

3.3 Jackson: catch (IOException) around JSON parsing is now dead code (SILENT) — HIGH

Jackson 3 throws unchecked tools.jackson.core.JacksonException instead of checked IOException / JsonProcessingException. A catch (IOException e) block still compiles but never matches, so a malformed payload that used to be handled gracefully now propagates as an unhandled error.

See Jackson 2→3 §2.3.

3.4 camel-cxf: operationName header renamed (SILENT) — HIGH

operationName → CamelCxfOperationName, operationNamespace → CamelCxfOperationNamespace. Because the new names start with Camel, they are also stripped at transport boundaries by the default header filter.

See Camel 4.18→4.22 §1.1.

3.5 camel-cxf: WS-Security / SAML libraries removed from the runtime (RUNTIME) — HIGH

Camel 4.21 made cxf-rt-ws-security optional, so wss4j, opensaml, xmlsec, shibboleth and cryptacular are no longer on the IM classpath.

If your SOAP services use WS-Security (UsernameToken, signing, encryption, SAML), raise a ticket before upgrading — the libraries must be added back to the image explicitly. IM itself never used them, so this affects customer CXF configuration only.

See Camel 4.18→4.22 §1.2.

3.6 camel-mail: header-driven recipients ignored unless opted in (SILENT) — HIGH

To, From, Subject, Reply-To set via message headers are ignored unless useHeaderRecipients / useHeaderFrom / useHeaderSubject / useHeaderReplyTo is set to true on the endpoint. Mail is still sent — to the endpoint's configured address.

See Camel 4.18→4.22 §1.3.

MEDIUM impact

3.7 Groovy: duplicate imports now fail compilation (DEPLOY-FAIL) — MEDIUM

Previously tolerated, now an error. Deploy every script to find them.

3.8 Groovy: java.time.* auto-imported (DEPLOY-FAIL) — MEDIUM

A customer class named Duration, Period, Instant or Clock in the default package now clashes. Rename or fully-qualify.

3.9 Groovy: stricter generics under @CompileStatic (DEPLOY-FAIL) — MEDIUM

Wildcard capture is now implemented, matching javac. Previously-compiling unsafe code (Collection<?> c; c.add(obj)) is rejected.

3.10 Jackson: ObjectMapper is immutable (DEPLOY-FAIL) — MEDIUM

configure(...), registerModule(...), setDateFormat(...) after construction are gone. Build the mapper with JsonMapper.builder(). JavaTimeModule no longer exists — java.time is built in.

3.11 Jackson: JSON property order is alphabetical by default (SILENT) — MEDIUM

SORT_PROPERTIES_ALPHABETICALLY defaults to on in Jackson 3.

IM disables it for Pricefx API traffic, so pfx-api: calls are byte-compatible with IM 8.0.x. It still applies to the jackson dataformat in your own routes — relevant if the receiving system or your tests are order-sensitive.

3.12 Jackson: unknown properties no longer fail by default (SILENT) — MEDIUM

FAIL_ON_UNKNOWN_PROPERTIES is off by default in Jackson 3. If you used the resulting exception as payload validation, enable it explicitly.

3.13 Jackson: trailing content rejected by default (RUNTIME) — MEDIUM

FAIL_ON_TRAILING_TOKENS is on by default. IM disables it for filter definitions and for pfx-client responses to keep IM 8.0.x leniency; your own mappers get the Jackson 3 default.

3.14 Jackson: maximum nesting depth lowered (RUNTIME) — MEDIUM

Jackson 3 lowered the default StreamReadConstraints nesting limit from 1000 to 500. Deeply nested JSON that parsed before can now be rejected. The integration.jackson.max-string-length setting you already have continues to apply to both Jackson majors.

3.15 Camel: toD / enrich no longer resolve {{...}} at runtime (SILENT) — MEDIUM

Placeholders in a per-message computed URI are now literal text. recipientList, routingSlip, dynamicRouter are unaffected.

3.16 Camel: XSLT Saxon secure processing always on (RUNTIME) — MEDIUM

Blocks external DTD/stylesheet access and Java extension functions. Set secureProcessing=false explicitly if you use extension functions.

3.17 Camel: zip/tar CamelFileName stripped to base name (SILENT) — MEDIUM

Directory structure is no longer reconstructable from that header — use zipFileName / CamelTarFileEntryName.

LOW impact

3.18 Camel: removed components (DEPLOY-FAIL) — LOW

camel-cloud / serviceCall EIP, camel-service, camel-stomp, camel-aws-xray, camel-guava-eventbus, camel-grape, camel-elytron, camel-github, camel-google-pubsub-lite. csimple is deprecated.

3.19 Camel: mail dispatch header renames (SILENT) — LOW

copyTo → CamelMailCopyTo, moveTo → CamelMailMoveTo, delete → CamelMailDelete.

3.20 Camel: component default changes (SILENT) — LOW

  • camel-spring-rabbitmq: component replyTimeout 5 s → 30 s; auto-declared queues durable=true

  • camel-aws2-s3: listObjects uses ListObjectsV2 (affects pojoRequest=true only)

  • camel-openapi-java: base.path now wins for the generated server URL

  • camel-jsonpath: writeAsString serialises objects correctly instead of stringifying map values

  • camel-file/ftp: preSort is now a string (name, modified, size, -name, …); true still works

3.21 Camel: Simple language (DEPLOY-FAIL / SILENT) — LOW

floor/ceil return long; the $init{...}init$ block requires a semicolon and newline per statement with no trailing comments.

3.22 Camel: monitoring output changed (SILENT) — LOW

camel-micrometer always emits the routeId tag (empty string when unknown, previously absent); JMX Throughput is now EWMA-smoothed. Update dashboards that match on label absence.

3.23 Java 21 → 25 runtime (RUNTIME) — LOW

IM now runs on Java 25. Scripts using APIs removed or restricted since Java 21 need review; the Security Manager is disabled. IM's CI and runtime images already ran Corretto 25 before this change, so the JVM itself is not new to the platform.

3.24 Removed transitive libraries (DEPLOY-FAIL) — LOW

Beyond WS-Security (§3.5): javax.annotation:javax.annotation-api and com.google.code.findbugs:jsr305 are gone — anything importing javax.annotation.* must move to jakarta.annotation.*. ehcache / javax.cache and httpclient5-cache also left the classpath. Full inventory in Library upgrade details §3.

What IM handles for you

These changed underneath IM but are not customer-facing — no action required:

  • Spring Boot 3.5 → 4.1, Spring Framework 6.2 → 7.0, Spring Security 6.5 → 7.1, Spring Cloud 2025.0 → 2025.1, Spring Integration 6.5 → 7.1, Spring AMQP 3.2 → 4.1, Spring WS 4.1 → 5.0. IM absorbed the module split, the package moves and the removed requiresChannel security API.

  • Tomcat 10.1 → 11, Servlet 6.0 → 6.1, JAX-RS 3.1 → 4.0, Hibernate Validator 8 → 9.

  • Jackson 2 → 3 inside IM's own code and the pfx-client API model, including the Pricefx String→number coercion and the property-order preservation described in §3.11.

  • CXF 4.1.5 → 4.2.3 and the Jetty 12.0 → 12.1 bump underneath the SOAP TLS listener.

  • The management.metrics.export.prometheus.enabled property was renamed to management.prometheus.metrics.export.enabled in IM's shipped defaults.

If you override Spring properties in your instance configuration, review them against the Spring Boot 4 release notes — removed or renamed properties are the one place this internal work can reach your configuration.