fix(security): floor Bouncy Castle, freemarker and commons-lang3 in the build toolchain

[pandeymangg]

What & why

Was: 4 Dependabot alerts open, two of them critical, and one already past its SLA. No open Dependabot PR touches these packages.

Now: all four packages are raised to patched versions, which clears alerts 52–55.

Alert	Package	Where it comes from
#52 critical, #53 high	bcprov 1.84 → 1.85	Kotlin 2.4's kotlinBouncyCastleConfiguration (its PGP / signing check tasks)
#55 critical	freemarker 2.3.32 → 2.3.35	Dokka 2.2.0's generator runtime (2.2.0 is the latest stable)
#54 medium	commons-lang3 3.16.0 → 3.21.0	Pulled in by our own commons-compress 1.27.1 floor from #79

Bouncy Castle was already floored at 1.85 on AGP's plugin classpath (#79). This copy lives in an :android configuration, which only the securityFloors map reaches. Dependabot credits both classpaths to settings.gradle.kts, so they look the same in the alert.

Where to look

• android/build.gradle.kts: two new securityFloors entries
• build.gradle.kts: the commons-lang3 constraint
• gradle/libs.versions.toml: two new versions, and the comment on which classpath each floor covers

Nothing ships

releaseRuntimeClasspath carries none of these, and the generated POM lists only the SDK's own dependencies.

Coverage

Rerun: ./gradlew :android:dependencies and ./gradlew buildEnvironment, then ./gradlew :android:assembleRelease :android:testReleaseUnitTest :android:dokkaJavadocJar :android:generatePomFileForMavenPublication

Check	Level	Outcome
Each floor reaches its classpath	manual	bcpkix/bcpg 1.84→1.85, freemarker 2.3.32→2.3.35 in both Dokka resolvers, commons-lang3 3.16.0→3.21.0
Build, unit tests, publish chain	manual	All pass. dokkaJavadocJar checks Dokka on freemarker 2.3.35
AAR untouched	manual	releaseRuntimeClasspath matches none of the four

Open gaps

• Alerts close on merge, not on this PR: dependency-submission.yml only runs on push: main.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c1851e95-f16c-4dcf-abe6-fe99faa36aef

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud