You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spark.apache.org by ya...@apache.org on 2026/10/01 06:00:27 UTC

(spark) branch master updated: [SPARK-59894][BUILD][TEST] Upgrade bouncycastle to 1.85

This is an automated email from the ASF dual-hosted git repository.

LuciferYang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git


The following commit(s) were added to refs/heads/master by this push:
     new 3910fb55cdb3 [SPARK-59894][BUILD][TEST] Upgrade bouncycastle to 1.85
3910fb55cdb3 is described below

commit 3910fb55cdb3123ca7eb41d578e78c87e784b228
Author: YangJie <ya...@baidu.com>
AuthorDate: Thu Oct 1 14:00:15 2026 +0800

    [SPARK-59894][BUILD][TEST] Upgrade bouncycastle to 1.85
    
    ### What changes were proposed in this pull request?
    
    This bumps the `bouncycastle.version` property in `pom.xml` from 1.84 to 1.85. The property drives both `bcprov-jdk18on` and `bcpkix-jdk18on`, which are declared `test` scope, so this is a test-only dependency.
    
    ### Why are the changes needed?
    
    Bouncy Castle 1.85 fixes two advisories against `bcprov-jdk18on`:
    
    - [GHSA-9pwp-9qqc-pr26](https://github.com/advisories/GHSA-9pwp-9qqc-pr26) (critical): Name Constraints bypass via a trailing dot in `rfc822Name` and URI.
    - [GHSA-qp49-qgx5-5m26](https://github.com/advisories/GHSA-qp49-qgx5-5m26) (high): a lazily evaluated ASN.1 sequence resets the nesting-depth guard.
    
    Release notes: https://www.bouncycastle.org/download/bouncy-castle-java/?filter=java%3Drelease-1-85
    
    This addresses https://github.com/apache/spark/security/dependabot/242 and https://github.com/apache/spark/security/dependabot/243.
    
    ### Does this PR introduce _any_ user-facing change?
    
    No.
    
    ### How was this patch tested?
    
    No new tests. Bouncy Castle is a test-scope dependency; the suites that exercise it run in GitHub Actions against 1.85.
    
    ### Was this patch authored or co-authored using generative AI tooling?
    
    Generated-by: Claude Opus 4.8
    
    Closes #59157 from LuciferYang/SPARK-59894.
    
    Lead-authored-by: YangJie <ya...@baidu.com>
    Co-authored-by: reviewer <re...@local>
    Signed-off-by: yangjie01 <ya...@baidu.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index f8b1dc425864..00c705d1ca88 100644
--- a/pom.xml
+++ b/pom.xml
@@ -215,7 +215,7 @@
     <maven-antrun.version>3.1.0</maven-antrun.version>
     <commons-crypto.version>1.1.0</commons-crypto.version>
     <commons-cli.version>1.11.0</commons-cli.version>
-    <bouncycastle.version>1.84</bouncycastle.version>
+    <bouncycastle.version>1.85</bouncycastle.version>
     <tink.version>1.23.0</tink.version>
     <!--
       TODO: Once upgrade datasketches to a version that supports Java 25,


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org