[Snyk] Security upgrade org.bouncycastle:bcjmail-jdk18on from 1.83 to 1.85

[mo-auto]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• jans-core/service/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Upgrade
	Insufficient Verification of Data Authenticity SNYK-JAVA-ORGBOUNCYCASTLE-18512864	org.bouncycastle:bcjmail-jdk18on: 1.83 -> 1.85 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[mo-auto]

This upgrade from version 1.83 to 1.85 is a minor version update but spans two significant feature and security releases. While no major API removals are documented, the nature of the changes introduces a medium risk of behavioral changes.

Key Changes:

• Version 1.84: Introduced an updated OpenPGP implementation to align with new draft RFCs and added a new FIPS-compliant keystore. [2]
• Version 1.85: This is a large security-focused release that includes fixes for over 30 CVEs. [5] The release notes describe it as a "significant hardening of the APIs," particularly around cryptographic parsers and validation. [1, 4]

Potential Impact:
The API "hardening" and numerous security fixes, especially those related to stricter validation in keystore and message parsing, could alter behavior that applications may have inadvertently relied upon. [1] These are technically bug fixes, but they can break systems that depend on the previous, more lenient behavior.

Recommendation:
Developers should verify application functionality after the upgrade, paying close attention to areas that use OpenPGP or involve parsing externally supplied cryptographic data or keystores.

Source: Bouncy Castle Release Announcements

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0fcedeb1-76cd-479a-9dd6-95b5d5ff49b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mo-auto]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.