Bump bc-fips to 2.1.3 to fix CVE-2026-8149

[Rishikesh1159]

Description

Bumps org.bouncycastle:bc-fips from 2.1.2 to 2.1.3 (via the bouncycastle_jce version reference in gradle/libs.versions.toml) to remediate CVE-2026-8149 (GHSA-mx76-r943-rf8g).

bc-fips versions 2.1.0–2.1.2 are affected: on Intel CPUs with AES PAA instruction sets (AVX / VAES / AVX-512f), the native AES/GCM implementation can intermittently produce an incorrect authentication-tag
verification result during decryption when ciphertext is supplied through a mix of update() calls followed by doFinal(). 2.1.3 is the patched release.

Since bc-fips is declared once in the version catalog and every consumer (server, clients, FIPS tooling, distribution bundles, plugins, and tests) resolves it through ${versions.bouncycastle_jce}, this
single-line bump updates all affected classpaths.

• CVE: CVE-2026-8149
• Advisory: GHSA-mx76-r943-rf8g
• Severity: Moderate / MEDIUM (CVSS 4.0: 5.1)
• Affected: org.bouncycastle:bc-fips 2.1.0–2.1.2
• Fixed in: 2.1.3

The sibling FIPS artifacts (bctls-fips, bcpkix-fips, bcpg-fips, bcutil-fips) are not in scope of the advisory and are left unchanged; bc-fips 2.1.3 is compatible with the existing 2.1.x versions of those
artifacts.

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

• Functionality includes testing.
• API changes companion pull request created, if applicable.
• Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 6039f1c.

Path	Line	Severity	Description
gradle/libs.versions.toml	72	high	Dependency version change: bouncycastle_jce bumped from 2.1.2 to 2.1.3. Per mandatory supply chain policy, all dependency version changes must be flagged for maintainer verification of artifact authenticity regardless of whether the name appears legitimate.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit d46fdba)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[owaiskazi19]

@Rishikesh1159 can you run ./gradlew updateShas to generate new SHAs file?

[github-actions]

❌ Gradle check result for 6039f1c: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

Persistent review updated to latest commit d46fdba

[Rishikesh1159]

@Rishikesh1159 can you run ./gradlew updateShas to generate new SHAs file?

Sure updated the PR with new changes