Bouncy Castle to 1.65 (solve CVEs)?

Since more one year ago, I try to have more security in Jitsi products, can you solve it?

First ticket about it:


My first PR for Jitsi, edited several time release after release (Bouncy Castle 1.65 instead of 1.54): https://jitsi/jitsi/pull/564

My PR for libjitsi (Bouncy Castle 1.65 instead of 1.54): https://jitsi/libjitsi/pull/522

My PR for jitsi-media-transform (Bouncy Castle 1.65 instead of 1.61): https://jitsi/jitsi-media-transform/pull/253

Thanks in advance.

Who can help the Jitsi project to do not use this library without CVEs?

Who can test and inform if it is good or not?

A lot of other tickets about Bouncy Castle and Jitsi:

Thanks in advance.

Likewise for jetty which can be updated to 9.4.28.v20200408 or later.

By the way, jvb and jicofo seem to be working with bc 1.65 and jetty components at 9.4.28.v20200408, but I don’t know if they’re being used.