From 8426bab253235c85fe7d5094678890f43e768ec6 Mon Sep 17 00:00:00 2001 From: Liam Date: Thu, 16 Jul 2026 14:32:20 -0400 Subject: [PATCH 1/6] chore: upgrade to latest bouncycastle --- lib/build.gradle | 2 +- lib/gradle.lockfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/build.gradle b/lib/build.gradle index ee65110..8c47cc6 100644 --- a/lib/build.gradle +++ b/lib/build.gradle @@ -32,7 +32,7 @@ dependencies { implementation 'com.google.code.gson:gson:2.8.9' implementation 'com.google.guava:guava:33.6.0-android' - implementation group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.70' + implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.84' implementation group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.14' } diff --git a/lib/gradle.lockfile b/lib/gradle.lockfile index 18a6e47..8611fb9 100644 --- a/lib/gradle.lockfile +++ b/lib/gradle.lockfile @@ -34,7 +34,7 @@ org.apache.httpcomponents.core5:httpcore5:5.1.1=testCompileClasspath,testRuntime org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath org.apiguardian:apiguardian-api:1.1.0=testCompileClasspath,testRuntimeClasspath -org.bouncycastle:bcprov-jdk15on:1.70=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.bouncycastle:bcprov-jdk18on:1.84=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath org.eclipse.jetty.http2:http2-common:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath org.eclipse.jetty.http2:http2-hpack:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath org.eclipse.jetty.http2:http2-server:9.4.44.v20210927=testCompileClasspath,testRuntimeClasspath From f87db41f475dce02390926d3dbfb1b0af4bad02d Mon Sep 17 00:00:00 2001 From: Liam Date: Thu, 16 Jul 2026 15:06:16 -0400 Subject: [PATCH 2/6] chore: add test dep on no op logger --- lib/build.gradle | 1 + lib/gradle.lockfile | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/build.gradle b/lib/build.gradle index 8c47cc6..1347b47 100644 --- a/lib/build.gradle +++ b/lib/build.gradle @@ -29,6 +29,7 @@ dependencies { testImplementation 'org.junit.jupiter:junit-jupiter:5.7.2' testImplementation "com.github.tomakehurst:wiremock-jre8:2.32.0" testImplementation "org.mockito:mockito-core:3.12.4" + testImplementation "org.slf4j:slf4j-nop:1.7.34" implementation 'com.google.code.gson:gson:2.8.9' implementation 'com.google.guava:guava:33.6.0-android' diff --git a/lib/gradle.lockfile b/lib/gradle.lockfile index 8611fb9..2ed5e61 100644 --- a/lib/gradle.lockfile +++ b/lib/gradle.lockfile @@ -72,7 +72,8 @@ org.mockito:mockito-core:3.12.4=testCompileClasspath,testRuntimeClasspath org.objenesis:objenesis:3.2=testCompileClasspath,testRuntimeClasspath org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testRuntimeClasspath org.ow2.asm:asm:9.2=testCompileClasspath,testRuntimeClasspath -org.slf4j:slf4j-api:1.7.32=testCompileClasspath,testRuntimeClasspath +org.slf4j:slf4j-api:1.7.34=testCompileClasspath,testRuntimeClasspath +org.slf4j:slf4j-nop:1.7.34=testCompileClasspath,testRuntimeClasspath org.xmlunit:xmlunit-core:2.8.3=testCompileClasspath,testRuntimeClasspath org.xmlunit:xmlunit-legacy:2.8.3=testCompileClasspath,testRuntimeClasspath org.xmlunit:xmlunit-placeholders:2.8.3=testCompileClasspath,testRuntimeClasspath From b3f84c95bf18d3ebf29f223e55fe8a839215ed4c Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 16 Jul 2026 19:16:38 +0000 Subject: [PATCH 3/6] refactor: add cause-preserving InvalidCipherException(Throwable) overload Introduce a public InvalidCipherException(Throwable) constructor that preserves the cause chain, and deprecate the BouncyCastle-typed constructor which leaked BC into the SDK's public API. Switch the sole internal caller (EncryptionService) to the new overload via a Throwable cast so overload resolution binds to the non-deprecated variant. The deprecated constructor is retained for binary compatibility and scheduled for removal in v5. Co-Authored-By: Claude Opus 4.7 Claude-Session: https://claude.ai/code/session_01PwN3TUtjUNTobcWKt8dZH4 --- .../evervault/exceptions/InvalidCipherException.java | 10 ++++++++++ .../java/com/evervault/services/EncryptionService.java | 5 +++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/lib/src/main/java/com/evervault/exceptions/InvalidCipherException.java b/lib/src/main/java/com/evervault/exceptions/InvalidCipherException.java index 51016ac..5e7fbda 100644 --- a/lib/src/main/java/com/evervault/exceptions/InvalidCipherException.java +++ b/lib/src/main/java/com/evervault/exceptions/InvalidCipherException.java @@ -1,7 +1,17 @@ package com.evervault.exceptions; public class InvalidCipherException extends Exception { + /** + * @deprecated Leaks BouncyCastle into the SDK's public API. Use + * {@link #InvalidCipherException(Throwable)} instead. Retained + * for binary compatibility; scheduled for removal in v5. + */ + @Deprecated public InvalidCipherException(org.bouncycastle.crypto.InvalidCipherTextException originalException) { super(originalException.getMessage()); } + + public InvalidCipherException(Throwable cause) { + super(cause.getMessage(), cause); + } } diff --git a/lib/src/main/java/com/evervault/services/EncryptionService.java b/lib/src/main/java/com/evervault/services/EncryptionService.java index 95146b5..9744e93 100644 --- a/lib/src/main/java/com/evervault/services/EncryptionService.java +++ b/lib/src/main/java/com/evervault/services/EncryptionService.java @@ -121,8 +121,9 @@ public String encryptData(DataHeader header, byte[] generatedEcdhKey, byte[] dat try { cipher.doFinal(cipherText, len); } catch (InvalidCipherTextException e) { - // We don't want to expose Bouncy Castle to the user. - throw new InvalidCipherException(e); + // Cast to Throwable to bind to the non-deprecated overload + // (the BC-typed overload is more specific and would otherwise win). + throw new InvalidCipherException((Throwable) e); } String formatted = encryptFormatProvider.format( From 6e1af10560ab2e6268346c40ef7a3748acae47a8 Mon Sep 17 00:00:00 2001 From: Liam Date: Thu, 16 Jul 2026 15:45:24 -0400 Subject: [PATCH 4/6] chore: add changeset to bump version --- CHANGELOG.md | 26 ++++++++++++++++++++++++++ lib/build.gradle | 2 +- package.json | 2 +- 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e22efb..14a7e9e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,31 @@ # evervault-java +## 4.3.0 + +### Minor Changes + +- Upgrade BouncyCastle from `bcprov-jdk15on:1.70` to `bcprov-jdk18on:1.84` to + pick up outstanding security fixes and move off the unmaintained `jdk15on` + line. + + **Action required for some consumers.** The Maven coordinate changed + (`bcprov-jdk15on` → `bcprov-jdk18on`), but both jars ship classes under + identical `org.bouncycastle.*` packages. If your project also pulls in + `bcprov-jdk15on` directly or transitively via another dependency, you will + end up with both jars on the classpath — build tools don't dedupe across + different artifact ids. Classloader ordering then decides which BC "wins" + at runtime, which can cause subtle crypto failures. Evict any remaining + `bcprov-jdk15on` from your dependency tree (Gradle `exclude`, Maven + ``), or add an explicit dependency on `bcprov-jdk18on` at the + version you want. + + `InvalidCipherException` gains a new public constructor + `InvalidCipherException(Throwable cause)` that preserves the underlying + cause. The existing `InvalidCipherException(InvalidCipherTextException)` + constructor is now `@Deprecated` because it leaks BouncyCastle types into + the SDK's public API; it will be removed in the next major release. Switch + any direct construction to the `Throwable` overload. + ## 4.2.0 ### Minor Changes diff --git a/lib/build.gradle b/lib/build.gradle index 1347b47..4b34960 100644 --- a/lib/build.gradle +++ b/lib/build.gradle @@ -6,7 +6,7 @@ plugins { } group 'com.evervault' -version '4.2.0' +version '4.3.0' repositories { mavenCentral() diff --git a/package.json b/package.json index 1e83bae..1efbc85 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "evervault-java", "private": true, - "version": "4.2.0", + "version": "4.3.0", "scripts": { "version": "changeset version && PACKAGE_VERSION=$(node -p \"require('./package.json').version\") && sed -i \"s/version '.*'/version '$PACKAGE_VERSION'/g\" lib/build.gradle" }, From bd0fc314168a00c5c63be411daa8fd0b7edfe1ae Mon Sep 17 00:00:00 2001 From: Liam Date: Thu, 16 Jul 2026 15:51:19 -0400 Subject: [PATCH 5/6] Revert "chore: add changeset to bump version" This reverts commit 6e1af10560ab2e6268346c40ef7a3748acae47a8. --- CHANGELOG.md | 26 -------------------------- lib/build.gradle | 2 +- package.json | 2 +- 3 files changed, 2 insertions(+), 28 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 14a7e9e..1e22efb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,31 +1,5 @@ # evervault-java -## 4.3.0 - -### Minor Changes - -- Upgrade BouncyCastle from `bcprov-jdk15on:1.70` to `bcprov-jdk18on:1.84` to - pick up outstanding security fixes and move off the unmaintained `jdk15on` - line. - - **Action required for some consumers.** The Maven coordinate changed - (`bcprov-jdk15on` → `bcprov-jdk18on`), but both jars ship classes under - identical `org.bouncycastle.*` packages. If your project also pulls in - `bcprov-jdk15on` directly or transitively via another dependency, you will - end up with both jars on the classpath — build tools don't dedupe across - different artifact ids. Classloader ordering then decides which BC "wins" - at runtime, which can cause subtle crypto failures. Evict any remaining - `bcprov-jdk15on` from your dependency tree (Gradle `exclude`, Maven - ``), or add an explicit dependency on `bcprov-jdk18on` at the - version you want. - - `InvalidCipherException` gains a new public constructor - `InvalidCipherException(Throwable cause)` that preserves the underlying - cause. The existing `InvalidCipherException(InvalidCipherTextException)` - constructor is now `@Deprecated` because it leaks BouncyCastle types into - the SDK's public API; it will be removed in the next major release. Switch - any direct construction to the `Throwable` overload. - ## 4.2.0 ### Minor Changes diff --git a/lib/build.gradle b/lib/build.gradle index 4b34960..1347b47 100644 --- a/lib/build.gradle +++ b/lib/build.gradle @@ -6,7 +6,7 @@ plugins { } group 'com.evervault' -version '4.3.0' +version '4.2.0' repositories { mavenCentral() diff --git a/package.json b/package.json index 1efbc85..1e83bae 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "evervault-java", "private": true, - "version": "4.3.0", + "version": "4.2.0", "scripts": { "version": "changeset version && PACKAGE_VERSION=$(node -p \"require('./package.json').version\") && sed -i \"s/version '.*'/version '$PACKAGE_VERSION'/g\" lib/build.gradle" }, From ded16a9bea4d10fd17ec4d8fd515b56cd19ae954 Mon Sep 17 00:00:00 2001 From: Liam Date: Thu, 16 Jul 2026 15:51:57 -0400 Subject: [PATCH 6/6] chore: add changeset --- .changeset/true-moose-pick.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .changeset/true-moose-pick.md diff --git a/.changeset/true-moose-pick.md b/.changeset/true-moose-pick.md new file mode 100644 index 0000000..526ee4f --- /dev/null +++ b/.changeset/true-moose-pick.md @@ -0,0 +1,25 @@ +--- +"evervault-java": minor +--- + +Upgrade BouncyCastle from `bcprov-jdk15on:1.70` to `bcprov-jdk18on:1.84` to +pick up outstanding security fixes and move off the unmaintained `jdk15on` +line. + +**Action required for some consumers.** The Maven coordinate changed +(`bcprov-jdk15on` → `bcprov-jdk18on`), but both jars ship classes under +identical `org.bouncycastle.*` packages. If your project also pulls in +`bcprov-jdk15on` directly or transitively via another dependency, you will +end up with both jars on the classpath — build tools don't dedupe across +different artifact ids. Classloader ordering then decides which BC "wins" +at runtime, which can cause subtle crypto failures. Evict any remaining +`bcprov-jdk15on` from your dependency tree (Gradle `exclude`, Maven +``), or add an explicit dependency on `bcprov-jdk18on` at the +version you want. + +`InvalidCipherException` gains a new public constructor +`InvalidCipherException(Throwable cause)` that preserves the underlying +cause. The existing `InvalidCipherException(InvalidCipherTextException)` +constructor is now `@Deprecated` because it leaks BouncyCastle types into +the SDK's public API; it will be removed in the next major release. Switch +any direct construction to the `Throwable` overload.