spring-cloud-commons usage of bcprov-jdk18on 1.81 with CVE's

[wleese]

I opened this issue with spring-cloud-commons, but was surprised they couldn't upgrade due to I assume backwards incompatibility.

Would it be possible to release a patch release with fixes for e.g. GHSA-c3fc-8qff-9hwx ?

[ryanjbaxter]

I opened spring-cloud/spring-cloud-commons#1688, but was surprised they couldn't upgrade due to I assume backwards incompatibility.

Yes the concern is any kind of breaking changes in a minor we release. If we release a minor with a dependency users are using with breaking changes than that impacts their ability to upgrade to our minor release.

[dghgit]

The commit for this is listed in the BC wiki page. Ah, I see, just read the Spring page. If I understand correctly what you're asking for is a patch release containing only CVE fixes for 1.81? If we do that they'll be able to update immediately (assuming the CVE fixes in themselves don't cause anything to break).