From a84cde57d74924d909dde22515e5c29a373528e7 Mon Sep 17 00:00:00 2001
From: Bertrand Martin <bertrand@sentrysoftware.com>
Date: Fri, 24 Jul 2026 01:38:12 +0200
Subject: [PATCH 1/2] Force bcprov-jdk18on 1.85 to fix Dependabot alerts

smbj 0.14.0 pulls in bcprov-jdk18on 1.79 transitively, which is
affected by GHSA-574f-3g2m-x479 (critical, GOST 28147 keystream
reuse) and GHSA-c3fc-8qff-9hwx (moderate, LDAP injection). Pin the
version to 1.85 via dependencyManagement.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pom.xml b/pom.xml
index e3742fa..71cfa83 100644
--- a/pom.xml
+++ b/pom.xml
@@ -89,6 +89,12 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+			<!-- Override the vulnerable version pulled transitively by smbj (GHSA-574f-3g2m-x479, GHSA-c3fc-8qff-9hwx) -->
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.85</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 

From 60c2cb4f5dabbac96ec878cbc16c1e7a241815ba Mon Sep 17 00:00:00 2001
From: Bertrand Martin <bertrand@sentrysoftware.com>
Date: Fri, 24 Jul 2026 11:31:59 +0200
Subject: [PATCH 2/2] Declare bcprov-jdk18on as a direct runtime dependency

dependencyManagement entries in a library POM are not inherited by
consumers of the published artifact, so downstream projects would
still resolve the vulnerable 1.79 from smbj. A direct runtime
dependency propagates 1.85 transitively (nearest-wins).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 pom.xml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pom.xml b/pom.xml
index 71cfa83..70980d9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -89,12 +89,6 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
-			<!-- Override the vulnerable version pulled transitively by smbj (GHSA-574f-3g2m-x479, GHSA-c3fc-8qff-9hwx) -->
-			<dependency>
-				<groupId>org.bouncycastle</groupId>
-				<artifactId>bcprov-jdk18on</artifactId>
-				<version>1.85</version>
-			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
@@ -114,6 +108,14 @@
 			<artifactId>smbj</artifactId>
 			<version>0.14.0</version>
 		</dependency>
+		<!-- Override the vulnerable version pulled transitively by smbj (GHSA-574f-3g2m-x479, GHSA-c3fc-8qff-9hwx);
+		     declared as a direct runtime dependency so downstream consumers get the fixed version too -->
+		<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcprov-jdk18on</artifactId>
+			<version>1.85</version>
+			<scope>runtime</scope>
+		</dependency>
 		<dependency>
 			<groupId>org.mockito</groupId>
 			<artifactId>mockito-inline</artifactId>