Skip to content

chore(deps): Bump the "all-dependencies" group with 2 updates across multiple ecosystems - #48

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/all_dependencies-d2eedf465a
Closed

chore(deps): Bump the "all-dependencies" group with 2 updates across multiple ecosystems#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/all_dependencies-d2eedf465a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown

Bumps the all-dependencies group with 6 updates:

Package From To
actions/setup-java 5.7.0 6.1.0
gradle/actions/setup-gradle 6.3.0 6.4.0
actions/upload-artifact 7.0.1 7.0.2
github/codeql-action/init 4.37.6 4.39.0
github/codeql-action/analyze 4.37.6 4.39.0
actions/deploy-pages 5.0.0 5.0.1

Updates actions/setup-java from 5.7.0 to 6.1.0

Release notes

Sourced from actions/setup-java's releases.

v6.1.0

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

v6.0.1

What's Changed

New Contributors

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

v6.0.0

What's Changed

... (truncated)

Commits
  • b843ebf Support Maven plugin repositories in generated settings.xml (#1286)
  • 2a69be2 feat: support Maven server credential origins (#1282)
  • d0e6e4d chore(deps): bump the monthly-npm-updates group with 13 updates (#1276)
  • b24925b chore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)
  • 47b3648 Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)
  • 74920aa Prefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)
  • a78ec39 Stop GPG agent before removing signature-verification home (#1273)
  • 97c5a5e Support Temurin on Linux RISC-V (#1269)
  • 1aa87b6 Preserve compound Liberica build versions from .sdkmanrc (#1268)
  • de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
  • Additional commits viewable in compare view

Updates gradle/actions/setup-gradle from 6.3.0 to 6.4.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.4.0

Highlights

Gradle version support status in the Job Summary

The actions now report the support status of every Gradle version used in a workflow, as job annotations and in the Job Summary (#1057). Thanks to @​ov7a for the contribution.

version kind job annotation version table below the table
End-of-life — two or more major versions behind the latest release warning ⚠️ expandable section naming the affected release lines, pointing at the Gradle Security Subscription
Out of date — one major behind, or more than two minors behind on the current major notice ℹ️ one-line legend pointing at the Gradle release lifecycle docs
Current none — —

Deliberately not reported: patch releases (being on 9.7.0 when 9.7.1 exists is not flagged) and pre-releases (release candidates, milestones and snapshots never produce annotations). The latest Gradle release is determined from the wrapper checksum data already bundled with the action, so no network access is required.

Note that these annotations are emitted independently of the add-job-summary setting: setting add-job-summary: 'never' suppresses the Job Summary itself, but the warning and notice annotations remain.

Gradle itself is now reported in the dependency graph

The dependency-submission action now applies v1.5.0 of the GitHub Dependency Graph Gradle Plugin (up from v1.4.2) (#1069).

The headline change is that the Gradle Build Tool running the build is now reported as an org.gradle:gradle-core dependency, so that GitHub can surface known vulnerabilities in the version of Gradle used to run your build. These are the coordinates that GitHub advisories for the Gradle Build Tool are published against.

Details worth knowing:

  • The entry is always reported as a direct dependency with development scope.
  • It is not affected by the project, configuration or scope filters, so it appears even in graphs that filter aggressively.
  • Expect dependency graphs to gain this one new entry the first time a build runs after upgrading.

A new Gradle signing key, if you use dependency verification

[!IMPORTANT] If your build has dependency verification enabled, you must add a second trusted key before upgrading, or Dependency Graph generation will fail signature verification.

github-dependency-graph-gradle-plugin 1.5.0 is signed with a new Gradle signing subkey, and the key previously documented in our setup guide has been revoked upstream:

... (truncated)

Commits
  • 3f5f9ad Document the new Gradle signing key for dependency verification (#1071)
  • b031f6d [bot] Update dist directory
  • 5bc4175 Bump dependency-graph-gradle-plugin to 1.5.0 (#1069)
  • f3ff59b Combined automated updates: wrapper checksums, npm dependencies, setup-java (...
  • 7927085 Update .tool-versions: node 24.18.0, gradle 9.7.1, java 17 (#1068)
  • c3897a4 [bot] Update dist directory
  • 6b92be1 Update dependencies (#1065)
  • 0d208da [bot] Update dist directory
  • e49d0a3 Report EOL and maintenance status for Gradle versions (#1057)
  • 575435b Use the root-qualified :wrapper task (#1064)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Updates github/codeql-action/init from 4.37.6 to 4.39.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

... (truncated)

Commits
  • 6f2ac81 Merge pull request #4239 from github/update-v4.39.0-d63383a73
  • eb1c428 Trigger workflows
  • 4443333 Update changelog for v4.39.0
  • d63383a Merge pull request #4233 from github/mbg/start-proxy/report-version
  • 8dec0b9 Rename path to result in tests
  • 4eabea6 Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version
  • 57938b8 Merge pull request #4201 from github/mario-campos/automate-changenotes-assemble
  • ee07b50 Merge pull request #4236 from github/mbg/add-missing-changenotes
  • a897ed5 Add change note for #4206
  • c8bd019 Add change note for #4198
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.6 to 4.39.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

v4.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

... (truncated)

Commits
  • 6f2ac81 Merge pull request #4239 from github/update-v4.39.0-d63383a73
  • eb1c428 Trigger workflows
  • 4443333 Update changelog for v4.39.0
  • d63383a Merge pull request #4233 from github/mbg/start-proxy/report-version
  • 8dec0b9 Rename path to result in tests
  • 4eabea6 Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version
  • 57938b8 Merge pull request #4201 from github/mario-campos/automate-changenotes-assemble
  • ee07b50 Merge pull request #4236 from github/mbg/add-missing-changenotes
  • a897ed5 Add change note for #4206
  • c8bd019 Add change note for #4198
  • Additional commits viewable in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits
  • 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
  • 7e97763 Validate deployment polling intervals
  • 0143e11 Add backoff and jitter to deployment polling
  • 5e98f10 Merge pull request #440 from actions/user/adwitiya
  • 8b0625a Improve deployment request test coverage
  • See full diff in compare view

Bumps the all-dependencies group with 20 updates:

Package From To
com.android.application 9.3.1 9.4.1
com.android.library 9.3.1 9.4.1
org.bouncycastle:bcprov-jdk18on 1.85 1.86
org.bouncycastle:bcpkix-jdk18on 1.85 1.86
org.bouncycastle:bcutil-jdk18on 1.85 1.86
org.bitbucket.b_c:jose4j 0.9.6 0.9.7
org.apache.commons:commons-lang3 3.20.0 3.21.0
io.netty:netty-common 4.2.17.Final 4.2.19.Final
io.netty:netty-buffer 4.2.17.Final 4.2.19.Final
io.netty:netty-codec 4.2.17.Final 4.2.19.Final
io.netty:netty-codec-http 4.2.17.Final 4.2.19.Final
io.netty:netty-codec-http2 4.2.17.Final 4.2.19.Final
io.netty:netty-codec-socks 4.2.17.Final 4.2.19.Final
io.netty:netty-handler 4.2.17.Final 4.2.19.Final
io.netty:netty-handler-proxy 4.2.17.Final 4.2.19.Final
io.netty:netty-resolver 4.2.17.Final 4.2.19.Final
io.netty:netty-transport 4.2.17.Final 4.2.19.Final
io.netty:netty-transport-native-unix-common 4.2.17.Final 4.2.19.Final
androidx.core:core 1.17.0 1.19.1
gradle-wrapper 9.7.0 9.8.1

Updates com.android.application from 9.3.1 to 9.4.1

Updates com.android.library from 9.3.1 to 9.4.1

Updates org.bouncycastle:bcprov-jdk18on from 1.85 to 1.86

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry: isKeyEntry() returned false for it, so KeyStore.getEntry() returned null rather than a SecretKeyEntry, although getKey() recovered it. The PBE key entry type added for github #2164 was missing from engineIsKeyEntry, and is now included.

  • The CMS content-type decoders SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData and EncryptedData read their mandatory fields by index or enumeration with no lower-bound size check, so a ContentInfo whose inner content was an empty or too-short SEQUENCE - malformed but DER-parseable - left the decode as an unchecked NoSuchElementException or ArrayIndexOutOfBoundsException rather than the CMSException the CMSSignedData, CMSEnvelopedData, CMSAuthenticatedData and CMSAuthEnvelopedData constructors declare (the IllegalArgumentException CMSEncryptedData documents). Each now rejects a short sequence with IllegalArgumentException before reading, as the sibling content types CompressedData and DigestedData already did, so the wrappers surface it as their declared exception; the case that claims an OPTIONAL field and then truncates the mandatory ones after it is covered too. The streaming parsers CMSSignedDataParser, CMSEnvelopedDataParser, CMSAuthenticatedDataParser, CMSAuthEnvelopedDataParser and CMSCompressedDataParser had the same gap and more: an absent or truncated inner SEQUENCE, a mandatory field of the wrong type, or absent encapsulated or encrypted content escaped as NullPointerException, ClassCastException, IllegalArgumentException or IllegalStateException. The asn1.cms stream parsers now report a missing mandatory field as an IOException, and the CMS parsers report malformed content as CMSException ("Malformed content." / "Missing content.") or the IOException they declare.

  • A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.

  • Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.

  • A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.

  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.

  • The lightweight SubjectPublicKeyInfoFactory and PrivateKeyInfoFactory encoded a GOST R 34.10-2012 key on one of the legacy CryptoPro curves under id-GostR3410-2001, although RFC 9215 sec. 4.2 permits those curves for 2012 keys. The digestParamSet now decides: a GOST R 34.11-94 parameter set means 2001 (RFC 4491 sec. 2.3.2), a GOST R 34.11-2012 digest or none means 2012 with 256/512 taken from the curve field size, and any other value is rejected. GOST3410PublicKeyAlgParameters treats digestParamSet as OPTIONAL on both read and write per RFC 9215, and PrivateKeyInfoFactory now passes attributes through for ECGOST3410 keys (bc-csharp github #707).

  • The name-constraint host canonicalisation removed a single RFC 1034 root-label dot, the only empty label a name may legally carry, but nothing refused the ones that are not legal: a dNSName, rfc822Name host or uniformResourceIdentifier host such as "example.com.." kept a phantom empty label after the strip and so matched no constraint at all, escaping an excluded subtree naming the host it appears to carry. A tested name whose host carries an empty label - a second trailing dot, a doubled dot or a leading dot - is now refused outright wherever a constraint of that type is in force, rather than canonicalised into a name it is not: removing the extra dots would decide on the caller's behalf that "example.com.." names example.com, which is not how a consumer resolving or comparing the name reads it, and refusing fails closed in both directions where canonicalising would newly admit such a name under a permitted subtree. The single trailing dot is canonicalised as before, a bare "." remains the root label rather than an empty one, and the guard is scoped to the host, so the doubled dot a quoted local part may legally carry is unaffected. Constraints are untouched - one may still begin with a dot, which is how this implementation spells "subdomains only" (github PR #2436).

  • SSLContext.createSSLEngine() from the BCJSSE provider in the 1.86 bctls jar failed with NoSuchMethodError on every JDK from 9 up, leaving engine-based users of the provider (Netty, Vert.x and the like) unable to open a connection. The jdk1.5 and jdk1.9 copies of the package-private SSLEngineUtil had declared create(ContextData) with different return types since 2019 - SSLEngine and ProvSSLEngine - and the root ProvSSLContextSpi, compiled against the first, is paired at runtime with the versions/9 copy on any modern JDK. Until 1.86 the java9 compile had hidden this by implicitly recompiling the whole base tree into META-INF/versions/9 (447 classes, ProvSSLContextSpi among them); the -implicit:none added in 1.86 to stop that duplication exposed the mismatch. The jdk1.9 copy now declares the same return type as the root one, a JDK 25 test creates engines against the built jar, and a new multiReleaseCheck Gradle task on every distributed jar reads the constant pool of each class in the jar and in the sibling BC jars it depends on and fails the build when a member reference does not resolve against the copy of its target that a JDK would pair it with, so the class of defect cannot ship again; the same check runs on arbitrary jars, a published release included, as multiReleaseCheckJar (github #2448).

  • The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, while writing the p the caller configured out to the store: BcFKSKeyStoreSpi passed getBlockSize() to SCrypt.generate for both arguments and never read the encoded parallelization parameter at all, so every store whose ScryptConfig gave a p other than its r encoded parameters that do not derive its own keys. The store was self-consistent - BC read back what BC wrote - but a conformant RFC 7914 reader computed a different key and so failed the integrity check and the store decryption, and BC could not open such a store written by anyone else. Derivation now follows RFC 7914. A store written by 1.86 or earlier is still read: the integrity check is retried under the old convention, and where a signature check leaves no MAC to settle it the store decryption is retried instead, in both cases reporting the failure of the encoded parameters rather than of the fallback. The write side is governed by org.bouncycastle.bcfks.scrypt_p_eq_r, default true, which writes p equal to r whatever the ScryptConfig asked for: the two conventions then agree, so a store written here is both RFC 7914 correct and readable by 1.86 and earlier. Clearing the property honours the configured p, which those releases cannot read unless p already equals r; the default is intended to become false in a later release, once enough of the installed base is writing parameters that describe themselves. Loading with a BCFKSLoadStoreParameter carrying a ScryptConfig accepts an encoded p equal to either the configured p or the block size, so a store round trips under the configuration that wrote it whichever way the property was set; every other parameter is compared as before. The parallelization parameter is now bounded alongside the cost parameter before the derivation, as the PKCS#8 and PKCS#12 scrypt paths already bound it.

  • Building an evidence record was cubic in the number of data objects: SortedHashList and SortedIndexedHashList held their hashes in a LinkedList and found each insertion point by walking it with get(index), so a single add() was quadratic in the position it inserted at and building a list of n hashes cubic, and both lists sit on the generation path - the reduced hash tree of ERSArchiveTimeStampGenerator, the Merkle tree of BinaryTreeRootCalculator.computeRootHash(), and the hash list of every ERSDataGroup. Each now collects its hashes and sorts them once, in toList(); the sort is stable and the old insertion placed a hash after the last one comparing equal to it, which is where a stable sort puts it, so the order of the leaves and every root hash are unchanged. getFirst() answers with a scan rather than a sort and toList() sorts a copy, so neither accessor disturbs what has been added. Generating a time-stamp request over 8,000 data objects goes from about 210 seconds to under a tenth of a second, and 100,000 objects, which the old code could not reach in any practical time, takes about 0.2 seconds (github #2456).

  • An ERSDataGroup recomputed its hash on every request rather than taking it from the cache ERSCachingData exists to provide: the group overrode getHash(), which left the calculateHash() the cache calls unreachable - and wrong, as it copied the member hashes with a loop bounded by the size of the empty list it was copying into, so it would have digested nothing had anyth...

    Description has been truncated

@dependabot
chore(deps): bump the all-dependencies group with 6 updates
0ae68ee 
Bumps the all-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.1.0` |
| [gradle/actions/setup-gradle](https://github.com/gradle/actions) | `6.3.0` | `6.4.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.6` | `4.39.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.6` | `4.39.0` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `5.0.0` | `5.0.1` |


Updates `actions/setup-java` from 5.7.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@b6effb0...b843ebf)

Updates `gradle/actions/setup-gradle` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@9c97196...3f5f9ad)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `github/codeql-action/init` from 4.37.6 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5595cca...6f2ac81)

Updates `github/codeql-action/analyze` from 4.37.6 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5595cca...6f2ac81)

Updates `actions/deploy-pages` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@cd2ce8f...368f825)
chore(deps): bump the all-dependencies group with 20 updates

Bumps the all-dependencies group with 20 updates:

| Package | From | To |
| --- | --- | --- |
| com.android.application | `9.3.1` | `9.4.1` |
| com.android.library | `9.3.1` | `9.4.1` |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [org.bouncycastle:bcutil-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [org.bitbucket.b_c:jose4j](https://bitbucket.org/b_c/jose4j) | `0.9.6` | `0.9.7` |
| org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` |
| [io.netty:netty-common](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-buffer](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-codec](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-codec-http](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-codec-http2](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-codec-socks](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-handler](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-handler-proxy](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-resolver](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-transport](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| [io.netty:netty-transport-native-unix-common](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` |
| androidx.core:core | `1.17.0` | `1.19.1` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `9.7.0` | `9.8.1` |


Updates `com.android.application` from 9.3.1 to 9.4.1

Updates `com.android.library` from 9.3.1 to 9.4.1

Updates `org.bouncycastle:bcprov-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcutil-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bitbucket.b_c:jose4j` from 0.9.6 to 0.9.7
- [Changelog](https://bitbucket.org/b_c/jose4j/src/master/Release Notes.md)
- [Commits](https://bitbucket.org/b_c/jose4j/branches/compare/jose4j-0.9.7..jose4j-0.9.6)

Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0

Updates `io.netty:netty-common` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-buffer` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-codec` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-codec-http` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-codec-http2` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-codec-socks` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-handler` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-handler-proxy` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-resolver` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-transport` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `io.netty:netty-transport-native-unix-common` from 4.2.17.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final)

Updates `androidx.core:core` from 1.17.0 to 1.19.1

Updates `gradle-wrapper` from 9.7.0 to 9.8.1
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.7.0...v9.8.1)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: gradle/actions/setup-gradle
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: actions/deploy-pages
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: com.android.application
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: com.android.library
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: org.bouncycastle:bcutil-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: org.bitbucket.b_c:jose4j
  dependency-version: 0.9.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-common
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-buffer
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-codec
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-codec-http
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-codec-http2
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-codec-socks
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-handler
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-handler-proxy
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-resolver
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-transport
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-transport-native-unix-common
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: androidx.core:core
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: gradle-wrapper
  dependency-version: 9.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 19, 2026
1window2
1window2 requested changes Oct 19, 2026
View reviewed changes

@1window2 1window2 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not now

1window2 added a commit that referenced this pull request Oct 19, 2026
@1window2
chore(deps): take security pins and CodeQL from #48, slow Dependabot …
0fe8818 
…to every two months
@1window2

1window2 commented Oct 19, 2026

Copy link
Copy Markdown
Owner

Took the security-relevant parts into v2.6.0 (#49): bouncycastle 1.86, jose4j 0.9.7, commons-lang3 3.21.0, netty 4.2.19 build-classpath pins and codeql-action 4.39.0. Skipped androidx.core 1.19.1 (needs compileSdk 37, which is why this build failed) and the AGP/Gradle/action major bumps for now. Dependabot now runs every two months.

@1window2 1window2 closed this Oct 19, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/all_dependencies-d2eedf465a branch October 19, 2026 05:10
@1window2 1window2 mentioned this pull request Oct 19, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@1window2 1window2 1window2 requested changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@1window2