⬆️ Bump org.bouncycastle:bcprov-jdk18on from 1.80 to 1.84 in /weixin-java-cp#3966
Conversation
Bumps [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) from 1.80 to 1.84. - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) --- updated-dependencies: - dependency-name: org.bouncycastle:bcprov-jdk18on dependency-version: '1.84' dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
🤖 Augment PR SummarySummary: Updates BouncyCastle 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| <groupId>org.bouncycastle</groupId> | ||
| <artifactId>bcprov-jdk18on</artifactId> | ||
| <version>1.80</version> | ||
| <version>1.84</version> |
There was a problem hiding this comment.
weixin-java-cp/pom.xml:99 — This bumps bcprov-jdk18on to 1.84, but the root pom.xml still manages bcpkix-jdk18on at 1.80; mixing BouncyCastle versions can lead to dependency convergence issues or runtime NoSuchMethodError when multiple modules are used together. Consider aligning the BouncyCastle artifact versions across the build to avoid a split-brain dependency tree.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| <dependency> | ||
| <groupId>org.bouncycastle</groupId> | ||
| <artifactId>bcprov-jdk18on</artifactId> | ||
| <version>1.80</version> | ||
| <version>1.84</version> | ||
| </dependency> |
There was a problem hiding this comment.
这里把 bcprov-jdk18on 升到 1.84，但根 pom.xml 的 dependencyManagement 里仍固定了 bcpkix-jdk18on 为 1.80。由于其他模块（pay/channel/miniapp 等）依赖 bcpkix-jdk18on（并通过 dependencyManagement 解析版本），当用户同时引入 weixin-java-cp 与这些模块时，Maven 可能会产生 BouncyCastle 版本分裂（bcprov 1.84 vs bcpkix 1.80 及其传递依赖），存在运行期 NoSuchMethodError / ClassNotFound 的风险。建议将 BouncyCastle 版本在父 pom 统一管理（例如抽成 bouncycastle.version 属性，并同时升级 bcpkix-jdk18on 与 bcprov-jdk18on 到同一版本），然后在此处去掉显式 或对齐到同一版本来源。
|
@copilot apply changes based on the comments in this thread |
Agent-Logs-Url: https://github.com/binarywang/WxJava/sessions/a329d84f-ac4f-49ba-bee1-ddf33ed35afd Co-authored-by: binarywang <1343140+binarywang@users.noreply.github.com>
已在 38229b3 中完成以下变更：
|
|
@copilot resolve the merge conflicts in this pull request |
Co-authored-by: binarywang <1343140+binarywang@users.noreply.github.com>
binarywang
deleted the
dependabot/maven/weixin-java-cp/org.bouncycastle-bcprov-jdk18on-1.84
branch
Bumps org.bouncycastle:bcprov-jdk18on from 1.80 to 1.84.
Changelog
Sourced from org.bouncycastle:bcprov-jdk18on's changelog.
... (truncated)
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.