From 1c4d04c2089f719e8344f6c4f5cd8488c2320e9f Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 2 Nov 2026 10:09:49 +0100 Subject: build(deps): update Bouncy Castle to 1.86 and PGPainless to 1.7.8 Bouncy Castle 1.78.1 is affected by GHSA-574f-3g2m-x479, GHSA-9pwp-9qqc-pr26, GHSA-c3fc-8qff-9hwx and GHSA-qp49-qgx5-5m26, all fixed by 1.85. PGPainless 1.7.8 is the newest 1.x release. A root resolution rule keeps every Bouncy Castle module on the catalog version; before, bcpg 1.77 shipped next to bcprov 1.78.1. The new stack decrypts the OCB (LibrePGP) packets GnuPG 2.3+ emits by default, which the old one rejected as "non-standard AEAD". Drop the NonStandardAEAD error, its bottom sheet and strings, and replace the mislabelled aead_* fixtures (SHA-1 self-signed keys plus a message encrypted to an unrelated key) with a real GnuPG 2.5 key and OCB message that the tests now decrypt. The new fixture is a throwaway test key, so it is allowlisted in .gitleaksignore by fingerprint. Fix KeyUtils.isKeyUsable, which compared a Boolean to null and so accepted every key that parsed, including keys with no encryption subkey. A signing-only key fixture now covers the rejection path. Also: migrate the removed SelectUserId.firstMatch and deprecated addDecryptionPassphrase APIs, keep one copy of the Bouncy Castle META-INF/LICENSE.md in the APK, and move the existing InvalidPackage lint baseline entries to the bcpkix 1.86 jar. Co-Authored-By: Claude Opus 5.5 --- gradle/libs.versions.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'gradle') diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 6bf58a62..6150bb65 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,7 +1,7 @@ [versions] agp = "8.7.0" androidxActivity = "1.9.2" -bouncycastle = "1.78.1" +bouncycastle = "1.86" coroutines = "1.9.0" flowbinding = "1.2.0" hilt = "2.52" @@ -88,7 +88,7 @@ thirdparty-logcat = "com.squareup.logcat:logcat:0.1" thirdparty-modernAndroidPrefs = "de.maxr1998:modernandroidpreferences:2.4.0-beta2" thirdparty-nonfree-googlePlayAuthApiPhone = "com.google.android.gms:play-services-auth-api-phone:18.1.0" thirdparty-nonfree-sentry = "io.sentry:sentry-android:7.15.0" -thirdparty-pgpainless = "org.pgpainless:pgpainless-core:1.6.7" +thirdparty-pgpainless = "org.pgpainless:pgpainless-core:1.7.8" thirdparty-slack-lints = "com.slack.lint:slack-lint-checks:0.8.0" thirdparty-slf4j-api = { module = "org.slf4j:slf4j-api", version = { strictly = "[1.7, 1.8[", prefer = "1.7.36" } } thirdparty-sshj = "com.hierynomus:sshj:0.39.0" -- cgit v1.2.3