Upgrading BC to 1.5.2 ?

[Cantor, Scott]

On 3/13/15, 12:07 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>Noticed that Bouncy Castle 1.5.2 has been released, just wondering
>when we would upgrade and what kind of criteria do we use to decide to
>upgrade.

By the current policy, only in a minor/major, and beyond that it's just our discretion but most of the time we would update unless it was a particularly risky change and we didn't want to spend the time.

>My tendency would be to upgrade upon the next release of the IdP, but
>since that affects the v3 stack I'll totally defer to others.

Our policy is not to do so in a 3.1.1 release, which is why we're leaving the parent POM version locked at 8, that makes it "a special effort" to ever bump or add a dependency.

I would add...this is why I don't think java-support or spring-extensions are third party libraries in any real sense. We don't have them versioned in the parent POM. If they were, we would (and that doesn't work since they are themselves locked to the parent POM like opensaml and the IdP). QED.

-- Scott