From 5cf7871c37ac186e9582202a929c78b70d7473ec Mon Sep 17 00:00:00 2001
From: reeshika-h <reeshika.hosmani@contentstack.com>
Date: Wed, 26 Aug 2026 14:32:27 +0530
Subject: [PATCH] fix: bump jsoup pin to 1.23.2 to resolve Snyk resource
 allocation vulnerability

jsoup is pulled in transitively via com.contentstack.sdk:utils and is
flagged by Snyk (CVE-2026-75140) for unbounded memory growth in
XmlTreeBuilder's namespace scope tracking. Fixed upstream in 1.23.2 via
a rewritten NamespaceBindings scope tracker. Bump the dependencyManagement
pin following the existing pattern used for other contentstack-utils
transitive deps.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 CHANGELOG.md | 5 +++++
 pom.xml      | 6 +++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8e3241c..0ce5d156 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # CHANGELOG
 
+## v2.8.2
+
+### Aug 26, 2026
+- Fix: Upgraded `org.jsoup:jsoup` (pulled in transitively via `com.contentstack.sdk:utils`) to 1.23.2 to address a Snyk-reported Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-75140)
+
 ## v2.8.1
 
 ### Aug 17, 2026
diff --git a/pom.xml b/pom.xml
index f6f8b269..31d375e1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.contentstack.sdk</groupId>
     <artifactId>java</artifactId>
-    <version>2.8.1</version>
+    <version>2.8.2</version>
     <packaging>jar</packaging>
     <name>contentstack-java</name>
     <description>Java SDK for Contentstack Content Delivery API</description>
@@ -220,11 +220,11 @@
                 <artifactId>commons-lang3</artifactId>
                 <version>3.18.0</version>
             </dependency>
-            <!-- Fix Cross-site Scripting (XSS) in jsoup pulled by contentstack-utils transitive deps -->
+            <!-- Fix XSS and CVE-2026-75140 (unbounded XML namespace allocation) in jsoup pulled by contentstack-utils transitive deps -->
             <dependency>
                 <groupId>org.jsoup</groupId>
                 <artifactId>jsoup</artifactId>
-                <version>1.23.1</version>
+                <version>1.23.2</version>
             </dependency>
             <!-- Fix Spring vulnerabilities from contentstack-utils transitive deps -->
             <dependency>