From b836d49a3101bef486705ac386c2379d57455658 Mon Sep 17 00:00:00 2001
From: sophia chen <sophia.chen@thetradedesk.com>
Date: Wed, 28 Oct 2026 16:04:46 +1100
Subject: [PATCH] UID2-8214: upgrade bouncycastle to 1.85 (CVE-2026-8763,
 CVE-2026-13506)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 pom.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 0aebcc6e..19085610 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,22 +55,22 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <!-- Force bouncycastle to 1.84 to fix CVE-2026-5598 (private key leakage via non-constant-time comparisons). -->
+            <!-- Force bouncycastle to 1.85 to fix CVE-2026-5598 (private key leakage via non-constant-time comparisons). -->
             <!-- Pulled in transitively via okta-jwt-verifier → sslcontext-kickstart-for-pem. -->
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcprov-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcpkix-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
                 <artifactId>bcutil-jdk18on</artifactId>
-                <version>1.84</version>
+                <version>1.85</version>
             </dependency>
         </dependencies>
     </dependencyManagement>