[PPP-5790] - update jsendnsca library

[abryant-hv]

No description provided.

[Copilot]

Pull request overview

Updates the PMR libraries assembly Maven dependencies to use the jsendnsca artifact under the com.github.jsendnsca groupId and to reference a version via a Maven property.

Changes:

• Switch jsendnsca dependency coordinates from com.googlecode.jsendnsca to com.github.jsendnsca.
• Replace the hardcoded jsendnsca version with ${jsendnsca.version}.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[buildguy]

📦 Vulnerable Dependencies

✍️ Summary

SEVERITY	DIRECT DEPENDENCIES	IMPACTED DEPENDENCY	FIXED VERSIONS	CVES
Critical	com.github.jsendnsca:jsendnsca:3.0.0	org.bouncycastle:bcprov-jdk18on 1.81	[1.84]	CVE-2025-14813
High	com.github.jsendnsca:jsendnsca:3.0.0	org.bouncycastle:bcprov-jdk18on 1.81	[1.84]	CVE-2026-5598
Medium	com.github.jsendnsca:jsendnsca:3.0.0	org.bouncycastle:bcprov-jdk18on 1.81	[1.84]	CVE-2026-0636

🔬 Research Details

[ CVE-2025-14813 ] org.bouncycastle:bcprov-jdk18on 1.81

Description:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).

This vulnerability is associated with program files G3413CTRBlockCipher.

This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

[ CVE-2026-5598 ] org.bouncycastle:bcprov-jdk18on 1.81

Description:
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules).

This vulnerability is associated with program files FrodoEngine.Java.

This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

[ CVE-2026-0636 ] org.bouncycastle:bcprov-jdk18on 1.81

Description:
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).

This vulnerability is associated with program files LDAPStoreHelper.

This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.

Note:

---

Frogbot also supports Contextual Analysis, Secret Detection, IaC and SAST Vulnerabilities Scanning. This features are included as part of the JFrog Advanced Security package, which isn't enabled on your system.

---

🐸 JFrog Frogbot

[buildguy]

❌ Build failed in 14m

Build command:

mvn clean verify -B -e -Daudit -Djs.no.sandbox -pl \
assemblies/pmr-libraries

---

❗ No tests found!

ℹ️ This is an automatic message

[abryant-hv]

The only failure is the frogbot report, which appears to be incorrect. We are not packaging the vulnerable version (1.81) of the reported dependency, we are packaging the fixed version. (1.84)