[codefish1]

Fixes #12135.

Problem

Testcontainers 2.0.5 embeds Bouncy Castle 1.82 from docker-java-core in the shaded core JAR. A downstream dependency override cannot replace the relocated classes. Version 1.82 is within the affected ranges of CVE-2026-12185, CVE-2026-5598, CVE-2026-58059, and CVE-2026-59645.

Change

• Pin bcprov-jdk18on, bcutil-jdk18on, and bcpkix-jdk18on together at 1.86.
• Update JarFileShadingTest for the LICENSE.md resource supplied by the newer Bouncy Castle JAR.

This branch is based on main and leaves Jackson unchanged. docker-java PR #2696 proposes the same upstream version bump but is still open.

Verification

• :testcontainers:dependencies --configuration shaded resolves all three Bouncy Castle modules at 1.86 while Jackson remains at the main baseline of 2.18.4.
• :testcontainers:build -x :testcontainers:test -x :testcontainers:spotlessJavaCheck passes on the fork's main baseline, including compilation, shaded JAR tests, Checkstyle, Javadoc, and japicmp.
• git diff --check passes.

The Docker integration suite has not completed locally: earlier runs hit Docker Model Runner and MCP gateway failures and an image-context streaming stall. The Java Spotless check could not run because npm is unavailable on this host. CI should run the complete checks before merge.

Summary by CodeRabbit

• Chores
  • Updated cryptography components to version 1.86.
• Tests
  • Updated archive checks to expect license metadata in packaged files.

These are maintenance changes; no user-facing features or behavior changes are noted.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 52b26936-f467-4fc6-86c4-0574b0c2938e

Commits

Reviewing files that changed from the base of the PR and between f74d167 and b28349e.

Files selected for processing: 2

• core/build.gradle
• core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

The core build now forces three Bouncy Castle modules to version 1.86. The shading test’s META-INF listing expectation now includes LICENSE.md.

Changes: Bouncy Castle shaded dependency update

Layer / File(s)	Summary
Pin modules and update shading assertion core/build.gradle, core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java	The build forces bcprov-jdk18on, bcutil-jdk18on, and bcpkix-jdk18on to version 1.86. The shading test now expects LICENSE.md in the META-INF directory listing.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other · Severity of issue fixed: High

Suggested reviewers: eddumelendez

Merge Risk: Minimal · up to b2834

The scoped dependency pinning and shading-test update present no established merge-blocking risk; normal CI should confirm the final shaded resource set.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: patching the shaded Bouncy Castle dependencies.
Description check		The description explains the security problem, identifies the affected versions, describes the dependency pinning and test update, references issue #12135, and documents verification results and remai…
Linked Issues check		Issue #12135 requires a consistent fixed Bouncy Castle set in the shaded core JAR and an updated resource assertion. core/build.gradle now forces bcprov-jdk18on, bcutil-jdk18on, and `bcpkix-jdk1…
Out of Scope Changes check		The whole-PR diff contains only the three Bouncy Castle version forces in core/build.gradle and the related JarFileShadingTest resource expectation. The changes support the scope of #12135. No unr…

Full details: Description check

Explanation

The description explains the security problem, identifies the affected versions, describes the dependency pinning and test update, references issue #12135, and documents verification results and remaining test limitations.

Full details: Linked Issues check

Explanation

Issue #12135 requires a consistent fixed Bouncy Castle set in the shaded core JAR and an updated resource assertion. core/build.gradle now forces bcprov-jdk18on, bcutil-jdk18on, and bcpkix-jdk18on to 1.86. JarFileShadingTest now expects LICENSE.md in the META-INF listing. These changes implement the coding objectives in #12135.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff contains only the three Bouncy Castle version forces in core/build.gradle and the related JarFileShadingTest resource expectation. The changes support the scope of #12135. No unrelated implementation or test changes are present.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}