Repository navigation
Conversation
vharseko
added
dependencies
maximthomas
approved these changes
Oct 13, 2026
commons 3.2.2-SNAPSHOT manages bc-jdk18on-bom 1.86 (commons PR OpenIdentityPlatform#326), which fixes CVE-2026-8763 and CVE-2026-13506 in bcprov-jdk18on 1.84. OpenDJ itself uses only the FIPS artifacts, already at bc-fips 2.1.3; the bump reaches OpenICF, which imports opendj-parent as its BOM.
…ord it leaves The pre-roles srs phase (OpenIdentityPlatform#1184) recreates dj-1 on a volume that reports itself healthy at once, and the password check right after it found the join's /dev/shm password file while join.sh was still in joined(). Wait until no bootstrap script runs in the container before checking.
vharseko
force-pushed
the
bump-commons-3.2.2-snapshot
branch
from
October 14, 2026 07:28
e7b8cb8 to
9b93501
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
commons.versionfrom 3.2.1 to 3.2.2-SNAPSHOT.commons 3.2.2-SNAPSHOT manages
bc-jdk18on-bom1.86 (OpenIdentityPlatform/commons#326), which fixes CVE-2026-8763 (critical) and CVE-2026-13506 inbcprov-jdk18on1.84.OpenDJ itself uses only the FIPS artifacts, and
bc.fips.versionis already 2.1.3 on master. The bump matters for OpenICF: it importsopendj-parentas its BOM, and that is where itsbcprov-jdk18onversion comes from. Trivy flagsbcprov-jdk18on-1.84.jarin OpenICF'slib/framework.Between 3.2.1 and 3.2.2-SNAPSHOT the commons parent changes nothing else that it manages: the BouncyCastle BOM is the only version that moves.
Merge order: this PR's CI resolves commons 3.2.2-SNAPSHOT from the snapshot repository, so it goes green only after commons#326 is merged and the snapshot is deployed. The OpenICF PR that moves
opendj.versionto 5.2.0-SNAPSHOT follows this one.