From 52935281d135a1eb8a6eadb6639ab8ebedb15bc4 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 16:18:29 +0000 Subject: [PATCH 1/2] [RUN-0000] Update gradle minor/patch dependencies --- gradle/libs.versions.toml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index ce2e7c6..0871841 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,17 +1,17 @@ [versions] sshj = "0.40.0" asnOne = "0.6.0" -bouncycastle = "1.85" +bouncycastle = "1.85.2" expectit = "0.9.0" commonsIo = "2.22.0" -rundeckCore = "6.1.0-SNAPSHOT" +rundeckCore = "6.1.0-20260803" slf4j = "2.0.18" junit = "4.13.2" -groovy = "4.0.32" +groovy = "4.0.33" spock = "2.4-groovy-4.0" cglib = "3.3.0" -objenesis = "3.5" -axionRelease = "1.21.2" +objenesis = "3.6" +axionRelease = "1.21.3" # Security overrides for transitive dependencies commonsLang3 = "3.20.0" From fffafb37c6234dacf046517dd55b2e170b65729f Mon Sep 17 00:00:00 2001 From: Rundeck CI Date: Tue, 18 Aug 2026 08:07:12 -0700 Subject: [PATCH 2/2] Decouple bcprov/bcpkix versions; bcpkix-jdk18on has no 1.85.2 release Renovate bumped the shared bouncycastle version to 1.85.2 because bcprov-jdk18on published that patch, but bcpkix-jdk18on's latest is still 1.85 (confirmed against Maven Central's metadata) -- there is no bcpkix-jdk18on:1.85.2, so the shared bump broke dependency resolution entirely. Split them into independent version variables so bcprov can take its patch release without waiting on a bcpkix release that may not be coming. Verified: bcprov-jdk18on resolves to 1.85.2 and bcpkix-jdk18on to 1.85, with Gradle correctly resolving the transitive bcprov pulled in via bcpkix -> bcutil to the same 1.85.2, so there's no split version on the runtime classpath. Build and full test suite (37 tests) pass. --- gradle/libs.versions.toml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 0871841..877bb5d 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,7 +1,13 @@ [versions] sshj = "0.40.0" asnOne = "0.6.0" -bouncycastle = "1.85.2" +# bcprov and bcpkix don't always cut releases in lockstep -- bcprov-jdk18on +# has shipped 1.85.2 but bcpkix-jdk18on's latest is still 1.85 (confirmed +# against Maven Central's metadata), so these must be tracked independently +# rather than sharing one version, or a routine bump to one breaks resolution +# of the other. See rundeck-plugins/sshj-plugin#154. +bcprovVersion = "1.85.2" +bcpkixVersion = "1.85" expectit = "0.9.0" commonsIo = "2.22.0" rundeckCore = "6.1.0-20260803" @@ -18,8 +24,8 @@ commonsLang3 = "3.20.0" [libraries] sshj = { group = "com.hierynomus", name = "sshj", version.ref = "sshj" } asnOne = { group = "com.hierynomus", name = "asn-one", version.ref = "asnOne" } -bcpkix = { group = "org.bouncycastle", name = "bcpkix-jdk18on", version.ref = "bouncycastle" } -bcprov = { group = "org.bouncycastle", name = "bcprov-jdk18on", version.ref = "bouncycastle" } +bcpkix = { group = "org.bouncycastle", name = "bcpkix-jdk18on", version.ref = "bcpkixVersion" } +bcprov = { group = "org.bouncycastle", name = "bcprov-jdk18on", version.ref = "bcprovVersion" } expectitCore = { group = "net.sf.expectit", name = "expectit-core", version.ref = "expectit" } commonsIo = { group = "commons-io", name = "commons-io", version.ref = "commonsIo" } rundeckCore = { group = "org.rundeck", name = "rundeck-core", version.ref = "rundeckCore" }