From a1fa31054fe257e513c3b909f1e2b1995813b089 Mon Sep 17 00:00:00 2001
From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com>
Date: Fri, 28 Aug 2026 10:09:45 -0400
Subject: [PATCH] fix(deps): migrate BouncyCastle from bc*-jdk18on to
 bc*-jdk15to18 1.85

Switches all five BouncyCastle artifacts (bcmail, bcpg, bcpkix, bcprov,
bctls) from the jdk18on line to the jdk15to18 line, which BC explicitly
publishes as 'Compiled classes for Java 1.5 to Java 1.8'. The jdk15to18
line is the only one that ships Java 5 bytecode (major version 49) and
runs natively on a Java 8 JVM without multi-release jar shenanigans.

Why not just pin jdk18on 1.77 (PR #75)?
  - The jdk15to18 line stays current (1.85 picks up all 1.78+ CVE
    fixes), where the 1.77 fallback re-introduces those CVEs.
  - The artifact IDs are the only thing that changes; the BC classes
    live in the same org.bouncycastle.* packages with the same APIs.
  - major version 49 is single-release Java 5 bytecode, which Java 8
    runs natively and won't trip the multi-release jar path the
    1.78+ jdk18on jars triggered.

Touched files (artifact ID only, no code changes):
  - pom.xml (root): <bc.version> 1.83 -> 1.85; 5 dependencyManagement
    entries renamed to jdk15to18
  - system/pom.xml: 4 dep entries (missed by the original #76 list)
  - WebUI/pom.xml: 5 dep entries
  - deliverytiersuite/delivery-tier-suite/common/pom.xml: 1 dep entry
  - modules/perc-security-utils/pom.xml: 1 dep entry
  - modules/CMLight-Main-cactus-tests/pom.xml: 3 exclusion entries
  - .github/dependabot.yml: add org.bouncycastle* / org.bouncycastle:*
    to the full-ignore list so dependabot does not re-bundle the
    jdk18on line

Supersedes:
  - PR #75 (jdk18on 1.83 -> 1.77 was the conservative fallback; we
    skip the downgrade and pick the correct artifact line instead)
  - Issue #74 (the original bug report; closes as superseded)
  - The BC half of the bug. Note: the Shiro 2.1.0 -> 1.13.0 part of
    #74 is intentionally left out of this PR per the issue's scope;
    that needs a separate fix.

Verification:
  - ./mvn-env.sh clean install -DskipTests: BUILD SUCCESS (3:56)
  - javap -v on every resolved bc*-jdk15to18-1.85.jar: major version 49
  - No UnsupportedClassVersionError in build log

Fixes #76

> Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
---
 .github/dependabot.yml                               |  5 +++++
 WebUI/pom.xml                                        | 10 +++++-----
 deliverytiersuite/delivery-tier-suite/common/pom.xml |  2 +-
 modules/CMLight-Main-cactus-tests/pom.xml            |  6 +++---
 modules/perc-security-utils/pom.xml                  |  2 +-
 pom.xml                                              | 12 ++++++------
 system/pom.xml                                       |  8 ++++----
 7 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4dca3d3149..d230c95b3a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -95,6 +95,11 @@ updates:
       # Shiro 2.x jars are already Java 11 bytecode; freeze automated bumps.
       - dependency-name: "org.apache.shiro*"
       - dependency-name: "org.apache.shiro:*"
+      # Bouncy Castle `jdk18on` 1.78+ is Java 11 bytecode; we pin the
+      # `jdk15to18` line via <bc.version> in the root pom (Java 5 bytecode).
+      # Block Dependabot from re-bundling the wrong artifact line.
+      - dependency-name: "org.bouncycastle*"
+      - dependency-name: "org.bouncycastle:*"
       # Jackrabbit 2.21+ is Java 11 (2.20.x is last Java 8 line we track).
       - dependency-name: "org.apache.jackrabbit*"
       - dependency-name: "org.apache.jackrabbit:*"
diff --git a/WebUI/pom.xml b/WebUI/pom.xml
index 6fec8b1582..187f289e24 100644
--- a/WebUI/pom.xml
+++ b/WebUI/pom.xml
@@ -434,23 +434,23 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcmail-jdk18on</artifactId>
+            <artifactId>bcmail-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpg-jdk18on</artifactId>
+            <artifactId>bcpg-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk18on</artifactId>
+            <artifactId>bcpkix-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk18on</artifactId>
+            <artifactId>bcprov-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bctls-jdk18on</artifactId>
+            <artifactId>bctls-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>javax.servlet</groupId>
diff --git a/deliverytiersuite/delivery-tier-suite/common/pom.xml b/deliverytiersuite/delivery-tier-suite/common/pom.xml
index 74f5638960..1b24bdff95 100644
--- a/deliverytiersuite/delivery-tier-suite/common/pom.xml
+++ b/deliverytiersuite/delivery-tier-suite/common/pom.xml
@@ -150,7 +150,7 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk18on</artifactId>
+            <artifactId>bcprov-jdk15to18</artifactId>
             <version>${bc.version}</version>
             <scope>compile</scope>
         </dependency>
diff --git a/modules/CMLight-Main-cactus-tests/pom.xml b/modules/CMLight-Main-cactus-tests/pom.xml
index 681cc99a1f..50fbb79c0d 100644
--- a/modules/CMLight-Main-cactus-tests/pom.xml
+++ b/modules/CMLight-Main-cactus-tests/pom.xml
@@ -281,15 +281,15 @@
                 </exclusion>
                 <exclusion>
                     <groupId>org.bouncycastle</groupId>
-                    <artifactId>bcmail-jdk18on</artifactId>
+                    <artifactId>bcmail-jdk15to18</artifactId>
                 </exclusion>
                 <exclusion>
                     <groupId>org.bouncycastle</groupId>
-                    <artifactId>bcprov-jdk18on</artifactId>
+                    <artifactId>bcprov-jdk15to18</artifactId>
                 </exclusion>
                 <exclusion>
                     <groupId>org.bouncycastle</groupId>
-                    <artifactId>bcpg-jdk18on</artifactId>
+                    <artifactId>bcpg-jdk15to18</artifactId>
                 </exclusion>
             </exclusions>
             <scope>test</scope>
diff --git a/modules/perc-security-utils/pom.xml b/modules/perc-security-utils/pom.xml
index 8538a38f9d..2f9f1b0c3e 100644
--- a/modules/perc-security-utils/pom.xml
+++ b/modules/perc-security-utils/pom.xml
@@ -54,7 +54,7 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk18on</artifactId>
+            <artifactId>bcprov-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.jasypt</groupId>
diff --git a/pom.xml b/pom.xml
index ecbdd3458e..6bb4b9583b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,7 +78,7 @@
         <axis.version>1.4.1</axis.version>
         <axiscore.version>1.4.2</axiscore.version>
         <batik.version>1.19</batik.version>
-        <bc.version>1.83</bc.version>
+        <bc.version>1.85</bc.version>
         <build.helper.maven.plugin.version>3.6.1</build.helper.maven.plugin.version>
         <build.profile.id>dev</build.profile.id>
         <buildId>0</buildId>
@@ -1958,27 +1958,27 @@
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcmail-jdk18on</artifactId>
+                <artifactId>bcmail-jdk15to18</artifactId>
                 <version>${bc.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcpg-jdk18on</artifactId>
+                <artifactId>bcpg-jdk15to18</artifactId>
                 <version>${bc.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcpkix-jdk18on</artifactId>
+                <artifactId>bcpkix-jdk15to18</artifactId>
                 <version>${bc.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcprov-jdk18on</artifactId>
+                <artifactId>bcprov-jdk15to18</artifactId>
                 <version>${bc.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bctls-jdk18on</artifactId>
+                <artifactId>bctls-jdk15to18</artifactId>
                 <version>${bc.version}</version>
             </dependency>
             <dependency>
diff --git a/system/pom.xml b/system/pom.xml
index d400b74d87..d9a71d4442 100644
--- a/system/pom.xml
+++ b/system/pom.xml
@@ -906,19 +906,19 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk18on</artifactId>
+            <artifactId>bcprov-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bctls-jdk18on</artifactId>
+            <artifactId>bctls-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk18on</artifactId>
+            <artifactId>bcpkix-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpg-jdk18on</artifactId>
+            <artifactId>bcpg-jdk15to18</artifactId>
         </dependency>
         <dependency>
             <groupId>com.amazonaws</groupId>