GEODE-10606 Remediation of CVE-2026-8763 (#8032)

Author: JinwooHwang

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -51,7 +51,7 @@ class DependencyConstraints {
     deps.put("micrometer.version", "1.15.12")
     deps.put("shiro.version", "2.1.0")
     // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version
-    deps.put("bouncycastle.version", "1.84")
+    deps.put("bouncycastle.version", "1.85")
     deps.put("slf4j-api.version", "2.0.17")
     deps.put("jakarta.transaction-api.version", "2.0.1")
     deps.put("jboss-modules.version", "1.11.0.Final")

geode-assembly/src/integrationTest/resources/assembly_content.txt

@@ -923,7 +923,7 @@ lib/antlr-runtime-3.5.2.jar
 lib/asm-9.9.1.jar
 lib/asm-commons-9.9.1.jar
 lib/asm-tree-9.9.1.jar
-lib/bcprov-jdk18on-1.84.jar
+lib/bcprov-jdk18on-1.85.jar
 lib/classgraph-4.8.147.jar
 lib/classmate-1.5.1.jar
 lib/commons-beanutils-1.11.0.jar

geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt

@@ -94,7 +94,7 @@ jna-5.11.0.jar
 shiro-hashes-argon2-2.1.0.jar
 shiro-hashes-bcrypt-2.1.0.jar
 shiro-crypto-hash-2.1.0.jar
-bcprov-jdk18on-1.84.jar
+bcprov-jdk18on-1.85.jar
 jetty-ee-12.0.33.jar
 jetty-session-12.0.33.jar
 jetty-plus-12.0.33.jar

geode-server-all/src/integrationTest/resources/dependency_classpath.txt

@@ -97,7 +97,7 @@ joda-time-2.12.7.jar
 shiro-hashes-argon2-2.1.0.jar
 shiro-hashes-bcrypt-2.1.0.jar
 shiro-crypto-hash-2.1.0.jar
-bcprov-jdk18on-1.84.jar
+bcprov-jdk18on-1.85.jar
 jetty-ee-12.0.33.jar
 jetty-session-12.0.33.jar
 jetty-plus-12.0.33.jar