*IMPORTANT - CVE RELATED FIX* This release addresses the following CVEs:
CVE-2018-1000180: issue around primality tests for RSA key pair generation if done using only the low-level API.
CVE-2018-1000613: lack of class checking in deserialization of XMSS/XMSS^MT private keys with BDS state information.
Daryl Herzmann April 18, 2018 at 6:11 PM
We are now at a point of pure Maven builds, so this is very much doable. I would do it, but don't know of the API changes that may need openfire code updates.
Requested that Bouncy Castle be updated to 1.55 [now 1.59] release.
https://bouncycastle.org/releasenotes.html