Update org.bouncycastle:bcprov-lts8on

[scottf]

Update to 2.73.12.1 to resolve several CVEs. See Issue #1621

[synadia-claude-reviewer]

Claude finished @scottf's task in 49s —— View job

---

PR Review: Update org.bouncycastle:bcprov-lts8on

• Gather context
• Review PR diff
• Analyze security implications of CVEs addressed
• Post review findings

---

Summary

This is a targeted security patch — a single-line version bump of org.bouncycastle:bcprov-lts8on from 2.73.10 → 2.73.12.1 in build.gradle, addressing 10 CVEs reported in Issue #1621.

Change is correct and appropriate. No issues found.

Details

Correctness: The version bump is a maintenance update within the LTS branch for Java 8+. Skipping 2.73.11 is normal (intermediate releases sometimes exist only briefly before a follow-on patch). The lts8on artifact is the correct variant for this project's Java 8 target (sourceCompatibility = JavaVersion.VERSION_1_8).

Dependency scope: bcprov-lts8on is declared as api (not implementation), so the patched version will be transitively exposed to downstream consumers — which is appropriate since BouncyCastle types appear in the public API.

CVEs addressed: All 10 CVEs listed in Issue #1621 are resolved by this version. The fix is minimal and focused, with no unrelated changes bundled in — exactly the right scope for a security patch.

No concerns with thread safety, API compatibility, or build configuration.