[Snyk] Upgrade org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85

[martin-lindstrom]

Snyk has created this PR to upgrade org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.

• The recommended version was released 22 days ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[martin-lindstrom]

This is a minor version upgrade, but it includes significant API hardening and security fixes that introduce behavioral changes, warranting a medium risk assessment.

Key Changes:

• API Hardening: The release notes mention a "significant hardening of the APIs" due to findings from advanced code analysis tools. This implies stricter validation and parsing, which may cause previously accepted but malformed inputs to be rejected.
• Behavioral Changes from CVE Fixes: Several security fixes alter default behaviors that could impact existing applications:
  • CVE-2026-59638: The JSSE hostname verifier no longer enables CN-fallback by default. Applications relying on this undocumented behavior for hostname verification may fail.
  • CVE-2026-59639: CMS verifySignatures will now correctly return false for a SignedData object that contains zero signers, whereas it previously returned true.
  • CVE-2026-59641: The S/MIME validator no longer trusts the signingTime asserted by the signer for certificate path validation.
• New Features: The release also adds new features, including expanded Post-Quantum Cryptography (PQC) support and a new high-level CAdES API for advanced electronic signatures.

Recommendation:
Given the API hardening and specific behavioral changes, it is crucial to perform regression testing after this upgrade, paying close attention to areas involving PKI validation, CMS signature verification, and S/MIME processing.

Source: Bouncy Castle 1.85 Release Announcement

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.