Open Skillzore opened 4 months ago
Unless there is a binary or source incompatibility preventing people from upgrading - I'm not going to do releases just to bump the pom version - consumers can just override the version and management of runtime dependency versions generally is up to them.
What you are implying is that 100eds to thousands of library maintainers should push "empty" releases each time if a dependency makes a compatible release - with all due respect - this would be a complete waste of time for everybody.
Just wondering if there are any plans to update the bouncycastle dependency to the latest version 1.78.1 to get rid of the CVEs present in the current version of the dependency?
For reference, see Security Advisories in the bouncycastle release notes here.