This is an automated email from the ASF dual-hosted git repository.
LuciferYang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 3910fb55cdb3 [SPARK-59894][BUILD][TEST] Upgrade bouncycastle to 1.85
3910fb55cdb3 is described below
commit 3910fb55cdb3123ca7eb41d578e78c87e784b228
Author: YangJie <[email protected]>
AuthorDate: Thu Oct 1 14:00:15 2026 +0800
[SPARK-59894][BUILD][TEST] Upgrade bouncycastle to 1.85
### What changes were proposed in this pull request?
This bumps the `bouncycastle.version` property in `pom.xml` from 1.84 to
1.85. The property drives both `bcprov-jdk18on` and `bcpkix-jdk18on`, which are
declared `test` scope, so this is a test-only dependency.
### Why are the changes needed?
Bouncy Castle 1.85 fixes two advisories against `bcprov-jdk18on`:
- [GHSA-9pwp-9qqc-pr26](https://github.com/advisories/GHSA-9pwp-9qqc-pr26)
(critical): Name Constraints bypass via a trailing dot in `rfc822Name` and URI.
- [GHSA-qp49-qgx5-5m26](https://github.com/advisories/GHSA-qp49-qgx5-5m26)
(high): a lazily evaluated ASN.1 sequence resets the nesting-depth guard.
Release notes:
https://www.bouncycastle.org/download/bouncy-castle-java/?filter=java%3Drelease-1-85
This addresses https://github.com/apache/spark/security/dependabot/242 and
https://github.com/apache/spark/security/dependabot/243.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
No new tests. Bouncy Castle is a test-scope dependency; the suites that
exercise it run in GitHub Actions against 1.85.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Opus 4.8
Closes #59157 from LuciferYang/SPARK-59894.
Lead-authored-by: YangJie <[email protected]>
Co-authored-by: reviewer <reviewer@local>
Signed-off-by: yangjie01 <[email protected]>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index f8b1dc425864..00c705d1ca88 100644
--- a/pom.xml
+++ b/pom.xml
@@ -215,7 +215,7 @@
<maven-antrun.version>3.1.0</maven-antrun.version>
<commons-crypto.version>1.1.0</commons-crypto.version>
<commons-cli.version>1.11.0</commons-cli.version>
- <bouncycastle.version>1.84</bouncycastle.version>
+ <bouncycastle.version>1.85</bouncycastle.version>
<tink.version>1.23.0</tink.version>
<!--
TODO: Once upgrade datasketches to a version that supports Java 25,
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
