From 068563ffb5a77c7cc5aee4ddf1770dda3c7b845b Mon Sep 17 00:00:00 2001 From: Fei Chen Date: Mon, 17 Aug 2026 12:21:13 -0700 Subject: [PATCH] Upgrade org.bouncycastle:bcprov-jdk18on to 1.85 Snyk flagged bcprov-jdk18on 1.78.1 (pulled in transitively via robolectric and the android test plugin) for multiple CVEs, all fixed in 1.85. Bump the forced version in android/forceVersions.gradle and e2e/android/forceVersions.gradle, including the related bcprov-jdk15to18 and bcutil-jdk15to18 modules in the e2e gradle to keep bouncycastle versions consistent. --- android/forceVersions.gradle | 2 +- e2e/android/forceVersions.gradle | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/android/forceVersions.gradle b/android/forceVersions.gradle index 17767f25..a3b03eea 100644 --- a/android/forceVersions.gradle +++ b/android/forceVersions.gradle @@ -1,7 +1,7 @@ def forceVersions(ConfigurationContainer configurations) { configurations.configureEach { configuration -> configuration.resolutionStrategy { - force 'org.bouncycastle:bcprov-jdk18on:1.84.0' + force 'org.bouncycastle:bcprov-jdk18on:1.85' force 'io.netty:netty-handler:4.1.135.Final' force 'io.netty:netty-codec-http:4.1.135.Final' force 'io.netty:netty-codec-http2:4.1.135.Final' diff --git a/e2e/android/forceVersions.gradle b/e2e/android/forceVersions.gradle index 9306d7fb..82fe18b1 100644 --- a/e2e/android/forceVersions.gradle +++ b/e2e/android/forceVersions.gradle @@ -6,9 +6,9 @@ def forceVersions(ConfigurationContainer configurations) { force 'org.xerial:sqlite-jdbc:3.44.1.0' force 'com.google.code.gson:gson:2.10.1' force 'org.json:json:20231013' - force 'org.bouncycastle:bcutil-jdk15to18:1.78.1' - force 'org.bouncycastle:bcprov-jdk15to18:1.78.1' - force 'org.bouncycastle:bcprov-jdk18on:1.78.1' + force 'org.bouncycastle:bcutil-jdk15to18:1.85' + force 'org.bouncycastle:bcprov-jdk15to18:1.85' + force 'org.bouncycastle:bcprov-jdk18on:1.85' force 'org.robolectric:robolectric:4.12.2' force 'junit:junit:4.13.2' force 'commons-io:commons-io:2.15.1'