[
https://issues.apache.org/jira/browse/KNOX-3555?focusedWorklogId=1053233&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053233
]
ASF GitHub Bot logged work on KNOX-3555:
----------------------------------------
Author: ASF GitHub Bot
Created on: 07/Nov/26 12:52
Start Date: 07/Nov/26 12:52
Worklog Time Spent: 10m
Work Description: smolnar82 merged PR #1495:
URL: https://github.com/apache/knox/pull/1495
Issue Time Tracking
-------------------
Worklog Id: (was: 1053233)
Time Spent: 0.5h (was: 20m)
> Bump bcpkix-jdk18on to 1.85 to align BouncyCastle versions
> ----------------------------------------------------------
>
> Key: KNOX-3555
> URL: https://issues.apache.org/jira/browse/KNOX-3555
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Dependabot [PR #1418|https://github.com/apache/knox/pull/1418] bumped
> {{bcprov-jdk18on}} from 1.84 to 1.85, but {{bcpkix-jdk18on}} was left at 1.84:
> {code:xml}
> <bcprov-jdk18on.version>1.85</bcprov-jdk18on.version>
> <bcpkix-jdk18on.version>1.84</bcpkix-jdk18on.version>
> {code}
> {{bcpkix-jdk18on}} 1.84 depends on {{bcutil-jdk18on}} 1.84, whose POM
> declares {{bcprov-jdk18on}} 1.84. Maven's dependencyManagement overrides it,
> so the build resolves and packages bcprov 1.85:
> {noformat}
> \- org.bouncycastle:bcpkix-jdk18on:jar:1.84:compile
> \- org.bouncycastle:bcutil-jdk18on:jar:1.84:compile
> \- (org.bouncycastle:bcprov-jdk18on:jar:1.85:compile - version managed
> from 1.84; omitted for duplicate)
> {noformat}
> However:
> * dependency scanners that read the declared dependency graph still report
> {{bcprov-jdk18on}} 1.84;
> * Knox ships a mixed BouncyCastle set (bcprov 1.85 with bcpkix/bcutil 1.84),
> which BouncyCastle does not support - all BC modules are meant to be used at
> the same release.
> *Proposed change:* bump {{bcpkix-jdk18on}} to 1.85 ({{bcutil-jdk18on}}
> follows transitively). Optionally, use a single BouncyCastle version property
> for bcprov and bcpkix so the two can't be bumped independently again.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
