There are multiple CVEs addressed in the 1.15.5 release. Rebasing dev.boringcrypto would allow other downstream projects to pick up these fixes.