Skip to content

fix(deps): upgrade Bouncy Castle past CVE-2025-14813 (critical) and CVE-2026-5598 #1715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FelixTJDietrich merged 1 commit into from
Sep 1, 2026
+30 −0
Merged

fix(deps): upgrade Bouncy Castle past CVE-2025-14813 (critical) and CVE-2026-5598 #1715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/patched-server-image-crypto-library.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"hephaestus": patch
---

The server image no longer ships a cryptography library with a known critical vulnerability, so it passes a high- and critical-severity image scan with nothing left to disposition. Deployments that talk to a TLS-protected Docker daemon keep working unchanged.
25 changes: 25 additions & 0 deletions server/application/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,12 @@
<nullaway.version>0.14.0</nullaway.version>
<shedlock.version>7.9.0</shedlock.version>
<bucket4j.version>8.19.0</bucket4j.version>
<!-- Transitive only, via docker-java-core: bcpkix -> bcutil -> bcprov. Not managed by the
Spring Boot BOM, so the version it resolves to is docker-java's, and 1.82 carries
CVE-2025-14813 (critical) and CVE-2026-5598, both fixed in 1.84. Managed here so the
image scan stays clean and Renovate keeps it current; drop it once docker-java ships a
fixed floor of its own. -->
<bouncycastle.version>1.84</bouncycastle.version>
<maven.build.cache.skipCache>true</maven.build.cache.skipCache>
<maven.build.cache.skipSave>true</maven.build.cache.skipSave>
</properties>
Expand Down Expand Up @@ -403,6 +409,25 @@
<scope>import</scope>
<type>pom</type>
</dependency>
<!-- All three move together: Bouncy Castle only supports a matched provider, util and
PKIX set. docker-java's TLS path (CertificateUtils, LocalDirectorySSLConfig) is the
only consumer, and it links against PEMParser, JcaPEMKeyConverter,
JcaX509CertificateConverter and BouncyCastleProvider, all unchanged in 1.84. -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcutil-jdk18on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk18on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
</dependencies>
</dependencyManagement>
<build>
Expand Down
Loading