- pin bouncy-castle-java due to bugs in the latest release