From e7bf1fae741034c193b50ff4751c72f6d6e59221 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Wed, 4 Nov 2026 13:03:24 +0000 Subject: [PATCH] build: force BouncyCastle 1.86 on the Gradle plugin classpath The generated Maven Central upload plugin pulls in BouncyCastle 1.77. Override it in settings-extra.gradle, which Speakeasy never regenerates. Co-Authored-By: Claude Opus 5.5 --- settings-extra.gradle | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 settings-extra.gradle diff --git a/settings-extra.gradle b/settings-extra.gradle new file mode 100644 index 00000000..6089f108 --- /dev/null +++ b/settings-extra.gradle @@ -0,0 +1,9 @@ +// The Maven Central upload plugin Speakeasy generates (sonatype-central-upload +// 1.0.3, unmaintained) pulls in BouncyCastle 1.77, which has open advisories. It +// runs in the publish job, next to the signing key, so move it to the version the +// SDK itself ships. settings.gradle applies this file; Speakeasy never writes it. +gradle.rootProject { + buildscript.configurations.classpath.resolutionStrategy.eachDependency { d -> + if (d.requested.group == 'org.bouncycastle') { d.useVersion '1.86' } + } +}