chore: Bump org.bouncycastle:bcprov-jdk18on 1.84 -> 1.85 for CVE-2026-59638.

[craftmaster2190]

https://www.cve.org/CVERecord?id=CVE-2026-59638

Contributor Checklist

• Added relevant integration or unit tests to verify the changes
• Update the Readme or any other documentation (including relevant Javadoc)
• Ensured that tests pass locally: mvn clean package
• Ensured that the code meets the current checkstyle coding style definition: mvn clean verify -Pcheckstyle -Dmaven.test.skip=true -B

[edwardsre]

We are using the git-commit-id-maven-plugin:9.2.0 via Spring Boot 4.1.0. That plugin version is using bouncy castle version 1.81.

[TheSnoozer]

Thanks for the PR, not sure how and if the plugin is even affected by this as the plugin usually operates on the offline git resources (and thus does not even would trigger some validate of some hostname information).
Anyways shouldn't hurt.
Do you need a release to make some CVE check pipeline green again?

[edwardsre]

Thanks for the PR, not sure how and if the plugin is even affected by this as the plugin usually operates on the offline git resources (and thus does not even would trigger some validate of some hostname information). Anyways shouldn't hurt. Do you need a release to make some CVE check pipeline green again?

Yes, a release would be very helpful. It is somewhat cumbersome to pin the plugin dependency versions since the bom cannot be used and you have to specify every lib separately. Our security policy blocks the download of affected dependencies no matter where/how they are used. Thanks for the update.

A patch release on 9.2.x would be the most helpful since that is the version Spring Boot manages.