CVE‐2025‐12194 While the situation with the JVM garbage collector overrun for Java 17 and Java 21 greatly improved with the changes in 2.1.1, we’ve still had some reports that can only be related to the use of the disposal daemon (#593)

Author: prthakre

opendj-embedded/pom.xml

@@ -38,7 +38,7 @@
         <dependency>
             <groupId>ch.qos.logback</groupId>
             <artifactId>logback-core</artifactId>
-            <version>1.5.26</version>
+            <version>1.5.29</version>
             <exclusions>
                 <exclusion>
                     <artifactId>slf4j-api</artifactId>
@@ -49,7 +49,7 @@
         <dependency>
             <groupId>ch.qos.logback</groupId>
             <artifactId>logback-classic</artifactId>
-            <version>1.5.26</version>
+            <version>1.5.29</version>
             <exclusions>
                 <exclusion>
                     <artifactId>slf4j-api</artifactId>

pom.xml

@@ -39,8 +39,8 @@
         <freemarker.version>2.3.34</freemarker.version>
         <metrics-core.version>4.2.30</metrics-core.version>
         <bc.fips.version>2.1.2</bc.fips.version>
-        <bctls.fips.version>2.1.20</bctls.fips.version>
-        <bcpkix.fips.version>2.1.9</bcpkix.fips.version>
+        <bctls.fips.version>2.1.22</bctls.fips.version>
+        <bcpkix.fips.version>2.1.10</bcpkix.fips.version>
         <maven.compiler.target>11</maven.compiler.target>
         <maven.compiler.source>11</maven.compiler.source>
         <!-- OSGi bundles properties -->