[improve][build] Upgrade BouncyCastle to 1.85 and BouncyCastle FIPS to 2.1.x

distribution/server/src/assemble/LICENSE.bin.txt

@@ -625,9 +625,9 @@ Public Domain (CC0) -- ../licenses/LICENSE-CC0.txt
 
 Bouncy Castle License
  * Bouncy Castle -- ../licenses/LICENSE-bouncycastle.txt
-    - org.bouncycastle-bcpkix-jdk18on-1.84.jar
-    - org.bouncycastle-bcprov-jdk18on-1.84.jar
-    - org.bouncycastle-bcutil-jdk18on-1.84.jar
+    - org.bouncycastle-bcpkix-jdk18on-1.85.jar
+    - org.bouncycastle-bcprov-jdk18on-1.85.2.jar
+    - org.bouncycastle-bcutil-jdk18on-1.85.jar
 
 ------------------------
 

distribution/shell/src/assemble/LICENSE.bin.txt

@@ -473,9 +473,9 @@ Public Domain (CC0) -- ../licenses/LICENSE-CC0.txt
 
 Bouncy Castle License
  * Bouncy Castle -- ../licenses/LICENSE-bouncycastle.txt
-    - bcpkix-jdk18on-1.84.jar
-    - bcprov-jdk18on-1.84.jar
-    - bcutil-jdk18on-1.84.jar
+    - bcpkix-jdk18on-1.85.jar
+    - bcprov-jdk18on-1.85.2.jar
+    - bcutil-jdk18on-1.85.jar
 
 ------------------------
 

gradle/libs.versions.toml

@@ -55,10 +55,26 @@ commons-logging = "1.3.6"
 commons-beanutils = "1.11.0"
 commons-configuration2 = "2.15.1"
 # BouncyCastle
-bouncycastle = "1.84"
-bouncycastle-bcpkix-fips = "2.0.11"
-bouncycastle-bcutil-fips = "2.0.6"
-bouncycastle-bc-fips = "2.0.1"
+bouncycastle = "1.85"
+# bcprov is versioned separately: BouncyCastle shipped a provider-only patch release (1.85.2)
+# that was not published for bcpkix-jdk18on or bctls-jdk18on, which remain at 1.85
+bouncycastle-bcprov = "1.85.2"
+# BouncyCastle FIPS. Test-only in this build (tests/pulsar-client-test-bcfips): the server distribution
+# excludes bc-fips and ships the non-FIPS provider, so a FIPS deployment assembles its own classpath.
+#
+# The FIPS 140-3 cryptographic boundary is the bc-fips jar *file name*, so exactly one version per line
+# is the validated module — the security policies name bc-fips-2.1.1.jar and bc-fips-2.0.0.jar:
+#   #4943  BC-FJA 2.1.1  active, "Interim Validation", sunset 2027-01-16  https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4943
+#   #4743  BC-FJA 2.0.0  active,                       sunset 2029-07-28  https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4743
+# BouncyCastle ships security fixes only in later releases of a line — labelled "Provider (patched)" on
+# its download page — and submits them for certification afterwards, so no certified jar is CVE-free:
+# 2.1.1 has 13 known CVEs and 2.0.0 has 11, two CVSS 9.3 in each (CVE-2026-8763, CVE-2026-58062).
+# The versions below are the vendor's minimum fixed versions for the 2.1.x line and have none. They are
+# no worse than the previous 2.0.1/2.0.11/2.0.6 pins on certification — those were not certified either.
+# bcpkix-fips and bcutil-fips are outside the certified boundary.
+bouncycastle-bcpkix-fips = "2.1.12"
+bouncycastle-bcutil-fips = "2.1.7"
+bouncycastle-bc-fips = "2.1.3"
 # Serialization
 avro = "1.12.0"
 gson = "2.13.2"
@@ -458,7 +474,7 @@ athenz-cert-refresher = { module = "com.yahoo.athenz:athenz-cert-refresher", ver
 athenz-auth-core = { module = "com.yahoo.athenz:athenz-auth-core", version.ref = "athenz" }
 athenz-zpe-java-client = { module = "com.yahoo.athenz:athenz-zpe-java-client", version.ref = "athenz" }
 # Misc
-bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version.ref = "bouncycastle" }
+bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version.ref = "bouncycastle-bcprov" }
 bctls-jdk18on = { module = "org.bouncycastle:bctls-jdk18on", version.ref = "bouncycastle" }
 commons-logging = { module = "commons-logging:commons-logging", version.ref = "commons-logging" }
 commons-beanutils = { module = "commons-beanutils:commons-beanutils", version.ref = "commons-beanutils" }