TS3 derives a packet's key and nonce from its id, so resending a packet
encrypts it under the same pair again. BouncyCastle has since learned to
refuse that on a cipher that has already used the pair ("cannot reuse
nonce for EAX encryption"), which broke resends on the current version
the Android build uses. A fresh cipher per packet keeps them working.
Moves to bcprov-jdk18on 1.86, the maintained line, so every platform runs
the same BouncyCastle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both were pulled in for a single call each: commons-lang for
ConstructorUtils.invokeConstructor when building a packet handler, and
dnsjava for the _ts3._udp SRV lookup. Together they added over a
megabyte to a shaded jar (and dnsjava drops jnamed/update classes into
the jar root). Plain reflection and JNDI's dns: provider cover both.
Also drop the BouncyCastleProvider registration: every digest here is
requested by a name the SUN provider already answers, so the only thing
it accomplished was keeping the whole JCE provider, the post-quantum
suite and the X.509 stack reachable for a shaded-jar tree-shaker.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
erikbrockoandClaude Opus 5.5
Mario Beck
Manevolent
dependabot[bot]
Manevolent
Manevolent