[deps] Migrate Bouncy Castle from jdk18on to jdk15to18 (Java 1.5 to 1.8) artifact line

[natechadwick-intsof]

Summary

PR #75 downgrades org.bouncycastle:bc*-jdk18on from 1.83 to 1.77 to avoid Java 11 bytecode. That's the conservative fix — it keeps the existing artifact IDs and walks BC backward to the last jdk18on line that still ships Java 9 bytecode.

This issue tracks the correct long-term fix: switch the Bouncy Castle coordinates from the jdk18on line to the jdk15to18 line, which BC explicitly publishes as "Compiled classes, sources and JavaDoc for Java 1.5 to Java 1.8". This is what the official download page recommends for projects that need a version specific to Java 1.8.

Why this is a better fix

Aspect	#75 (jdk18on 1.83 → 1.77)	This issue (jdk18on → jdk15to18)
Bytecode	Java 9 (major 53)	Java 5 (major 49) — single-release, no multi-release concerns
Security patches	Regresses to Jan 2024 (CVE fixes from 1.78+ are lost)	Stays current: 1.85/1.85.2 (Aug 2026) — all 1.78+ CVEs picked up
Artifact ID	Unchanged (just version)	Renamed: bc*-jdk18on → bc*-jdk15to18
Diff size	+2 / −2 across 2 files	~+9 / −9 across 5 files
Risk	Lowest (no API surface change)	Low — same org.bouncycastle group, same package, same classes; just a different published jar line
Future Dependabot	Still needs org.bouncycastle* ignore in dependabot.yml	Same

The artifact ID is the only thing that changes. The contents are the same BC provider classes (same package org.bouncycastle.*, same BouncyCastleProvider, same APIs).

Bytecode evidence

I downloaded the jars from Maven Central and inspected the class-file major version:

bcprov-jdk15to18-1.85.2.jar  → major version 49 (Java 5)
bcpkix-jdk15to18-1.85.jar    → major version 49 (Java 5)

For comparison, bcprov-jdk18on-1.78+ ships major 55 (Java 11), and bcprov-jdk18on-1.77 ships major 53 (Java 9). jdk15to18 is the only line that compiles cleanly to bytecode safe on a Java 1.8 JVM without being a multi-release jar.

Affected files

The artifact name changes, so the diff must touch every place that declares a BC artifact (not just the property file). All five currently use ${bc.version} from the root pom and have no local version override.

File	Current declarations (after #75)	Change
pom.xml (root)	<bc.version>1.77</bc.version>	1.77 → 1.85 (sibling artifacts cap at 1.85; bcprov reaches 1.85.2 but pinning 1.85 across all five keeps the versions in lockstep)
WebUI/pom.xml	bcmail-jdk18on, bcpg-jdk18on, bcpkix-jdk18on, bcprov-jdk18on, bctls-jdk18on (5 dependencies)	Rename all 5 to bc*-jdk15to18
WebUI/pom.xml (tika-parsers <exclusion> block)	excludes bcmail-jdk18on, bcprov-jdk18on, bcpg-jdk18on	Rename the 3 exclusion coordinates to bc*-jdk15to18 so the exclusion still matches the transitive dep's actual coordinate
deliverytiersuite/delivery-tier-suite/common/pom.xml	bcprov-jdk18on (1 dependency)	Rename to bcprov-jdk15to18
modules/CMLight-Main-cactus-tests/pom.xml	bcprov-jdk18on (1 dep), bcpg-jdk18on (1 dep), bcmail-jdk18on (1 exclusion)	Rename all 3 to bc*-jdk15to18
modules/perc-security-utils/pom.xml	bcprov-jdk18on (1 dependency)	Rename to bcprov-jdk15to18

Total: 5 files, 9 <artifactId> lines renamed, plus the <bc.version> property.

What does not need to change

• Java/import code in the project. The packages are still org.bouncycastle.*; only the published artifact ID is different. Any import org.bouncycastle.jce.provider.BouncyCastleProvider; still works.
• The root <exclusion> block in pom.xml that excludes transitive bc*-jdk15on from elsewhere — that exclusion list is already on the jdk15on line, which is separate from jdk15to18. (It probably should be expanded to also exclude bc*-jdk15to18 to prevent the jdk18on transitive from sneaking in via other libraries, but that's a hardening pass; out of scope for the core migration.)
• Shiro. PR fix: pin BouncyCastle and Shiro to Java 8-compatible versions #75 already covers Shiro. This issue is Bouncy Castle only.

Acceptance criteria

• All five org.bouncycastle:bc*-jdk15to18 artifacts (bcmail, bcpg, bcpkix, bcprov, bctls) are managed at version 1.85 (or higher, if a future release keeps the siblings in lockstep) via <bc.version> in the root pom.
• The root pom and all module poms that declare BC dependencies use bc*-jdk15to18 coordinates; no bc*-jdk18on (or bc*-jdk15on) coordinates remain in any active dependency declaration in the project tree.
• The <exclusion> blocks in WebUI/pom.xml and modules/CMLight-Main-cactus-tests/pom.xml are updated to match the new artifact IDs.
• A full ./mvn-env.sh clean install -DskipTests succeeds on a Java 1.8 JDK with no UnsupportedClassVersionError.
• javap -v on the resolved jars reports major version: 49 (Java 5 bytecode), which Java 8 runs natively.
• Dependabot config (.github/dependabot.yml) gains a org.bouncycastle* entry so future weekly runs don't re-bundle the jdk18on line. (PR fix: pin BouncyCastle and Shiro to Java 8-compatible versions #75's review already flagged this gap; it can be addressed in the same PR or a follow-up.)

Out of scope

• Closing any CVEs that come back from the BC 1.83 → 1.85 version path — this issue is on the forward direction and only takes security patches forward.
• The deeper question of whether the project should move to Java 11+; that is the parent epic ([epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73) and out of scope here.
• Hardening org.bouncycastle:* exclusions across all transitive dependencies (separate cleanup; tracked in the parent epic).

References

• BC download page: https://www.bouncycastle.org/download/bouncy-castle-java/ — search for "Compiled classes, sources and JavaDoc for Java 1.5 to Java 1.8" vs "for Java 1.8 and later".
• BC release notes: https://www.bouncycastle.org/releasenotes.html — 1.78 release (Sep 2024) explicitly switched bcprov-jdk18on to Java 11 bytecode; the jdk15to18 line has remained on Java 5/8 bytecode throughout.
• OpenRewrite migration recipe: https://docs.openrewrite.org/recipes/java/migrate/bouncycastlefromjdk15ontojdk15to18 — independently confirms jdk15to18 is the up-to-date Java 8 artifact line and jdk15on is legacy.
• PR fix: pin BouncyCastle and Shiro to Java 8-compatible versions #75: fix: pin BouncyCastle and Shiro to Java 8-compatible versions #75 — the conservative fix this issue supersedes (or follows on top of).
• PR fix: pin BouncyCastle and Shiro to Java 8-compatible versions #75 review: fix: pin BouncyCastle and Shiro to Java 8-compatible versions #75 (comment) — flagged the missing org.bouncycastle* entry in dependabot.yml.

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.