[1.0] fix(deps): bump jruby-openssl to 0.16.2 for BC 1.85 CVE cluster (#484) - #489
Merged
Conversation
Part of elastic/security#13614 Part of elastic/security#13615 Part of elastic/security#13616 Part of elastic/security#13617 Part of elastic/security#13618 Part of elastic/security#13619 Part of elastic/security#13620 Part of elastic/security#13621 Part of elastic/security#13622 Part of elastic/security#13624 Part of elastic/security#13625 Part of elastic/security#13626 Part of elastic/security#13627 Part of elastic/security#13628 Part of elastic/security#13629 Part of elastic/security#13630 Part of elastic/security#13631 Part of elastic/security#13632 Part of elastic/security#13633 Part of elastic/security#13634 Part of elastic/security#13635 Part of elastic/security#13636 Part of elastic/security#13639 Bump `jruby-openssl` from `0.16.0` to `0.16.2` so the gem-bundled Bouncy Castle jars move from **1.84 → 1.85**, clearing the full BC 1.84 CVE cluster flagged by Snyk on `docker.elastic.co/integrations/crawler:1.0.0-SNAPSHOT`. Snyk finding path (example): `/usr/local/bundle/gems/jruby-openssl-0.16.0-java/lib/org/bouncycastle/bcprov-jdk18on/1.84` (`Jarfile` already pins BC 1.85 under `vendor/jars`; the gem-bundled copy was the remaining hit.) - **`0.16.2`** (2026-07-20): explicit `[deps] upgrade BC to version 1.85` — minimal fix for this group. - **`0.19.0`** exists (newer) but upstream marks it as a **beta**-class release (BC JSSE by default, large TLS/X.509 rewrite). Not taken for this security patch. Baseline: `jruby-openssl` **0.16.0** (BC **1.84** gem jars) → **0.16.2** (BC **1.85**). Method: Snyk jar scan on the four Bouncy Castle artifacts extracted from each gem (`bcprov`, `bcpkix`, `bctls`, `bcutil`). Trivy/pip-audit not applicable (Java gem jars). | CVE | Severity | Issue | Before | After | |-----|----------|-------|--------|-------| | CVE-2026-58062 | Critical | [#13627](elastic/security#13627) | reported | clear | | CVE-2026-59638 | Critical | [#13629](elastic/security#13629) | reported | clear | | CVE-2026-59650 | Critical | [#13635](elastic/security#13635) | reported | clear | | CVE-2026-8763 | Critical | [#13639](elastic/security#13639) | reported | clear | | CVE-2026-12185 | High | [#13614](elastic/security#13614) | reported | clear | | CVE-2026-12802 | High | [#13615](elastic/security#13615) | reported | clear | | CVE-2026-12803 | High | [#13616](elastic/security#13616) | reported | clear | | CVE-2026-12816 | High | [#13617](elastic/security#13617) | reported | clear | | CVE-2026-12860 | High | [#13618](elastic/security#13618) | reported | clear | | CVE-2026-13506 | High | [#13619](elastic/security#13619) | reported | clear | | CVE-2026-14682 | High | [#13621](elastic/security#13621) | reported | clear | | CVE-2026-58059 | High | [#13624](elastic/security#13624) | reported | clear | | CVE-2026-58060 | High | [#13625](elastic/security#13625) | reported | clear | | CVE-2026-58061 | High | [#13626](elastic/security#13626) | reported | clear | | CVE-2026-59639 | High | [#13630](elastic/security#13630) | reported | clear | | CVE-2026-59642 | High | [#13631](elastic/security#13631) | reported | clear | | CVE-2026-59645 | High | [#13632](elastic/security#13632) | reported | clear | | CVE-2026-59646 | High | [#13633](elastic/security#13633) | reported | clear | | CVE-2026-59651 | High | [#13636](elastic/security#13636) | reported | clear | | CVE-2026-13586 | Medium | [#13620](elastic/security#13620) | reported | clear | | CVE-2026-15055 | Medium | [#13622](elastic/security#13622) | reported | clear | | CVE-2026-58063 | Medium | [#13628](elastic/security#13628) | reported | clear | | CVE-2026-59647 | Medium | [#13634](elastic/security#13634) | reported | clear | **23/23 CVEs: reported → clear.** Container re-publish + `snyk container monitor` still needed for dashboard refresh. - [x] This PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check `crawler.yml.example` and `elasticsearch.yml.example`) - [x] This PR has a meaningful title - [x] This PR links to all relevant GitHub issues that it fixes or partially addresses - [x] this PR has a thorough description - [ ] Covered the changes with automated tests - [x] Tested the changes locally (`make install`, `make lint`, `make test` — 690 examples, 0 failures) - [x] Added a label for each target release version (example: `v0.1.0`) - [ ] Considered corresponding documentation changes - [ ] Contributed any configuration settings changes to the configuration reference - [x] Ran `make notice` if any dependencies have been added - [x] Security-related changes (encryption, TLS, SSRF, etc) N/A Bump jruby-openssl to 0.16.2 to pick up Bouncy Castle 1.85 (CVE-2026-12185 and sibling BC 1.84 CVEs).
Jan-Kazlouski-elastic
requested review from
artem-shelkovnikov and
erikcurrin-elastic
August 28, 2026 09:29
erikcurrin-elastic
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #484 to
1.0.Auto-backport failed due to
Jarfileconflict (1.0 lacked BC pin block; resolved manually, kepthttpclient5at 5.6.2 — see #487 for that bump).Part of https://github.com/elastic/security/issues/13614 (+ 22 sibling BC issues linked in #484).