Question

I am picking a question as issue type because none of the others really matched the issue at hand:
I noticed the currently used bouncycastle dependencies bcprov-jdk15on and bcpkix-jdk15on no longer receive patches, the last one is from 2021 (see https://central.sonatype.com/artifact/org.bouncycastle/bcprov-jdk15on/1.70/versions , https://central.sonatype.com/artifact/org.bouncycastle/bcpkix-jdk15on/1.70/versions). The latest version of bcprov-jdk15on also has one known vulnerability.

The versions for JDK 15 still receiving patches are bcprov-jdk15to18 and bcpkix-jdk15to18, see https://central.sonatype.com/artifact/org.bouncycastle/bcprov-jdk15to18/1.76/versions, https://central.sonatype.com/artifact/org.bouncycastle/bcpkix-jdk15to18/1.76/versions

Alternatively, there are also -18on versions, see e.g. https://central.sonatype.com/artifact/org.bouncycastle/bcprov-jdk18on/1.76/versions

Wouldn't it make sense to switch to the 15to18 or 18on versions of the dependencies?