Upgrade bouncycastle to 1.84 to address BDSA-2026-7218.

[atriantafyllos-da]

Blackduck found BDSA-2026-7218 vulnerability in bouncycastle 1.83. Upgrading to 1.84 should resolve the issue.

Updating:

bouncycastle 1.83 -> 1.84

Note: Since the process involves synchronous changes to both the SDK and Canton repositories, it may conflict with the daily SDK update task. To avoid issues, please coordinate with the person responsible for the SDK update via the #team-sdk-update Slack channel."

Steps:

• Create a dependencies SDK PR to update the relevant dependencies.

  • Leave the PR in draft mode initially (to prevent accidental early merging).
  • In the PR description, list the updated dependencies and their new versions
  • Link to this issue.

• Ensure the dependencies SDK PR passes all CI checks.

• Create a snapshot PR to generate an ad-hoc snapshot based on the dependencies SDK PR.

  • Follow the instructions in RELEASE.md.
  • In the PR title, indicate that this is for testing the dependencies SDK PR and include its PR number (e.g., "Ad-hoc snapshot for testing SDK dependencies PR Release 0.12.18 #1234").

• Obtain approval for the snapshot PR from a release owner.

• Merge the snapshot PR and wait until the release process completes.

• Create a draft dependencies Canton PR with the following updates:

  • Update Canton to use the freshly created ad-hoc snapshot.
  • Copy the sdk/maven_install_2.13.json file from your dependencies SDK PR to the Canton repository root.
  • In the PR description, link to the dependencies SDK PR together with this isssue.

• Ensure the dependencies Canton PR passes all CI checks. You may need to iterate by updating additional dependencies in the dependencies SDK PR and repeating the previous steps.

• Get the dependencies Canton PR reviewed and approved by @rgugliel-da.

• Mark the dependencies SDK PR as ready for review, obtain approval from a release owner, and merge it.

• Create a proper snapshot from the release branch you're working on (typically main).

• Update the dependencies Canton PR to use the new proper snapshot.

• Merge the dependencies Canton PR.

• close this issue.