Release 1.85 does not have release notes

[veita]

Maven Central hat release 1.85 and the BC website mentions it as the latest release. However, there seem to be no 1.85 release notes on the website. This GitHub project does not have a 1.85 tag either.

• https://repo1.maven.org/maven2/org/bouncycastle/bcpg-jdk18on/1.85/
• https://www.bouncycastle.org/download/bouncy-castle-java/#release-notes
• https://github.com/bcgit/bc-java/tags

[dghgit]

Coming soon.

[dghgit]

The official release notes are now available in the docs directory.

[beth-soptim]

Will the CVE be published with a severity score?

[dghgit]

Yes. At the moment we're just broadcasting there are CVEs to encourage people to update. Most of the CVEs do not have a high severity score, just go the update though, the problem is "high severity score" really means "high severity score yet" - there is nothing to panic in today about 1.84, but a lot of things you might panic about tomorrow will be resolved by 1.85. The AI tools have completely changed the landscape, we were offered a set of reports for one we do not have access to and have taken advantage of that, we would encourage you to follow the lead, and to do so now.