dependabot[bot] opened a new pull request, #939: URL: https://github.com/apache/mina-sshd/pull/939
Bumps [org.c02e.jpgpj:jpgpj](https://github.com/justinludwig/jpgpj) from 1.3 to 2.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/justinludwig/jpgpj/releases";>org.c02e.jpgpj:jpgpj's releases</a>.</em></p> <blockquote> <h2>JPGPJ 2.1.0</h2> <h3>Added</h3> <ul> <li>Public-key algorithm support for DSA, ECDSA, and Ed25519 (tags 22, 27, 28) signing and verification; ECDH/Cv25519 encryption subkeys.</li> <li>Test fixtures and round-trip tests for DSA, ECDSA, and Ed25519 keys; GnuPG interop golden files for decrypt/verify.</li> <li>README section on supported public-key algorithms, hash pairings, and FIPS caveats.</li> <li>PIT mutation testing via <code>./gradlew pitest</code> (<code>info.solidsoft.pitest</code> 1.19.0, JUnit 5 plugin 1.2.2).</li> <li><code>TestEnvironmentListener</code> so PIT's forked JVM matches the <code>line.separator</code> used by unit tests.</li> <li>OpenPGP modern encryption API: <code>EncryptionProtection</code>, <code>AeadAlgorithm</code>, <code>AeadPacketStyle</code>, <code>PassphraseKeyDerivation</code>, <code>Argon2Parameters</code>, <code>OpenPgpProfile</code>.</li> <li><code>HashingAlgorithm.SHA3_256</code> and <code>SHA3_512</code> with explicit OpenPGP tag mapping via <code>getOpenPgpTag()</code>.</li> <li><code>Encryptor.withModernDefaults()</code> preset (AES256, AEAD-OCB v6, Argon2 S2K).</li> <li><code>EncryptionDetails</code> metadata on <code>FileMetadata</code> after decryption (protection mode, cipher, AEAD, Argon2, detected profile).</li> <li><code>FileMetadata.Signature.getHashAlgorithm()</code> populated during verification.</li> </ul> <h3>Changed</h3> <ul> <li><code>HashingAlgorithm</code>, <code>EncryptionAlgorithm</code>, and <code>CompressionAlgorithm</code> use explicit OpenPGP tags instead of <code>enum.ordinal()</code>.</li> <li><code>JcaContextHelper</code> configures <code>SecureRandom</code> on passphrase encryption generators (required for Argon2).</li> </ul> <h2>2.0.0</h2> <h3>Breaking changes</h3> <ul> <li><strong>Java 17+ required.</strong> Java 8/11 support has been dropped.</li> <li>Bouncy Castle artifacts updated from <code>jdk15on:1.70</code> to <code>jdk18on:1.84</code>.</li> <li>Groovy/Spock test stack removed; tests are now JUnit 5 only.</li> </ul> <h3>Added</h3> <ul> <li><code>JcaContextHelper</code> lazy provider resolution with FIPS provider auto-detection.</li> <li>System property <code>jpgpj.security.provider</code> for explicit provider class selection.</li> <li>Fail-fast when both standard and FIPS Bouncy Castle providers are on the classpath.</li> <li>GitHub Actions CI (Java 17 and 21).</li> <li><code>maven-publish</code> and <code>signing</code> Gradle plugins (replaces legacy <code>mavenCentral.gradle</code>).</li> </ul> <h3>Changed</h3> <ul> <li>SLF4J updated from 1.7.x to 2.0.17.</li> <li>Gradle updated from 4.10.2 to 8.12.1.</li> <li><code>bcprov-jdk18on</code> and <code>bcutil-jdk18on</code> are now explicit dependencies.</li> </ul> <h3>Migration from 1.3</h3> <ol> <li>Upgrade your JVM to Java 17 or later.</li> <li>Update Maven/Gradle dependencies to <code>org.c02e.jpgpj:jpgpj:2.0.0</code>.</li> <li>Ensure Bouncy Castle <code>jdk18on</code> artifacts (1.84+) are on the classpath.</li> <li>For FIPS deployments, replace standard BC jars with <code>bc-fips</code>, <code>bcutil-fips</code>, and <code>bcpg-fips</code>; call <code>JcaContextHelper.setSecurityProvider(new BouncyCastleFipsProvider())</code> before any JPGPJ operation. Standard and FIPS BC jars must not coexist in the same JVM.</li> </ol> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/justinludwig/jpgpj/blob/master/CHANGELOG.md";>org.c02e.jpgpj:jpgpj's changelog</a>.</em></p> <blockquote> <h2>2.1.0 - 2026-06-20</h2> <h3>Added</h3> <ul> <li>Public-key algorithm support for DSA, ECDSA, and Ed25519 (tags 22, 27, 28) signing and verification; ECDH/Cv25519 encryption subkeys.</li> <li>Test fixtures and round-trip tests for DSA, ECDSA, and Ed25519 keys; GnuPG interop golden files for decrypt/verify.</li> <li>README section on supported public-key algorithms, hash pairings, and FIPS caveats.</li> <li>PIT mutation testing via <code>./gradlew pitest</code> (<code>info.solidsoft.pitest</code> 1.19.0, JUnit 5 plugin 1.2.2).</li> <li><code>TestEnvironmentListener</code> so PIT's forked JVM matches the <code>line.separator</code> used by unit tests.</li> <li>OpenPGP modern encryption API: <code>EncryptionProtection</code>, <code>AeadAlgorithm</code>, <code>AeadPacketStyle</code>, <code>PassphraseKeyDerivation</code>, <code>Argon2Parameters</code>, <code>OpenPgpProfile</code>.</li> <li><code>HashingAlgorithm.SHA3_256</code> and <code>SHA3_512</code> with explicit OpenPGP tag mapping via <code>getOpenPgpTag()</code>.</li> <li><code>Encryptor.withModernDefaults()</code> preset (AES256, AEAD-OCB v6, Argon2 S2K).</li> <li><code>EncryptionDetails</code> metadata on <code>FileMetadata</code> after decryption (protection mode, cipher, AEAD, Argon2, detected profile).</li> <li><code>FileMetadata.Signature.getHashAlgorithm()</code> populated during verification.</li> </ul> <h3>Changed</h3> <ul> <li><code>HashingAlgorithm</code>, <code>EncryptionAlgorithm</code>, and <code>CompressionAlgorithm</code> use explicit OpenPGP tags instead of <code>enum.ordinal()</code>.</li> <li><code>JcaContextHelper</code> configures <code>SecureRandom</code> on passphrase encryption generators (required for Argon2).</li> </ul> <h2>2.0.0</h2> <h3>Breaking changes</h3> <ul> <li><strong>Java 17+ required.</strong> Java 8/11 support has been dropped.</li> <li>Bouncy Castle artifacts updated from <code>jdk15on:1.70</code> to <code>jdk18on:1.84</code>.</li> <li>Groovy/Spock test stack removed; tests are now JUnit 5 only.</li> </ul> <h3>Added</h3> <ul> <li><code>JcaContextHelper</code> lazy provider resolution with FIPS provider auto-detection.</li> <li>System property <code>jpgpj.security.provider</code> for explicit provider class selection.</li> <li>Fail-fast when both standard and FIPS Bouncy Castle providers are on the classpath.</li> <li>GitHub Actions CI (Java 17 and 21).</li> <li><code>maven-publish</code> and <code>signing</code> Gradle plugins (replaces legacy <code>mavenCentral.gradle</code>).</li> </ul> <h3>Changed</h3> <ul> <li>SLF4J updated from 1.7.x to 2.0.17.</li> <li>Gradle updated from 4.10.2 to 8.12.1.</li> <li><code>bcprov-jdk18on</code> and <code>bcutil-jdk18on</code> are now explicit dependencies.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/justinludwig/jpgpj/commit/4a893205203a04b1539ee77cbabcd4f0f5704e3a";><code>4a89320</code></a> Adjust publish task for manual publishing to maven</li> <li><a href="https://github.com/justinludwig/jpgpj/commit/c880a1ee9bdb3638f69fdce7aeb35a8a31a48ba2";><code>c880a1e</code></a> Added release notes from old versions to changelog</li> <li><a href="https://github.com/justinludwig/jpgpj/commit/9aadee5dbbace49ad8da0df2095c65e39b09f5f2";><code>9aadee5</code></a> Created JPGPJ v2 (<a href="https://redirect.github.com/justinludwig/jpgpj/issues/43";>#43</a>)</li> <li>See full diff in <a href="https://github.com/justinludwig/jpgpj/compare/v1.3...v2.1.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
