Update bouncycastle about spring-security-rsa HOT 6 CLOSED

Yes. We don't get notifications from github sometimes 🤷. I merged the PR, but not sure about what version of this project to use. Should it be a new major release? I suppose there should be very few people left using it with Java <8 so maybe it's safe to just use the next micro release.

from spring-security-rsa.

See #27

from spring-security-rsa.

bcpkix-jdk15on contains a vulnerability
can the PR be merged as soon as possible?

from spring-security-rsa.

@spencergibb , @dsyer : is this repository still maintained?

from spring-security-rsa.

@dsyer : It is nice to see, that this is still maintained.

To answer your question: I would update everything to spring 5 and make a major release and keep the version in sync with spring. The current dependency to spring 4 is totally outdated.
And in a different branch keep up to spring 6.

The main issue is, that the spring projects maintains it's dependencies to bouncycastle through this project. This requires you technically, to monitor bouncycastle updates. The basic question is: Can you maintain this project regularly in the future? There are outstanding MR and issues.
Otherwise, there is the issue #10 , which might be a path forward.

from spring-security-rsa.

#27 is merged and went ahead with 1.0.12.RELEASE which is now available so we can close this issue. Also #22, #23. If you want to discuss general maintenance, open a new issue or comment on #10 maybe?

from spring-security-rsa.