Merge pull request #313 from contentstack/fix/jsoup-cve-2026-75140

fix: bump jsoup pin to 1.23.2 to resolve Snyk resource allocation vulnerability

Author: reeshika-h

CHANGELOG.md

@@ -1,5 +1,10 @@
 # CHANGELOG
 
+## v2.8.2
+
+### Aug 26, 2026
+- Fix: Upgraded `org.jsoup:jsoup` (pulled in transitively via `com.contentstack.sdk:utils`) to 1.23.2 to address a Snyk-reported Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-75140)
+
 ## v2.8.1
 
 ### Aug 17, 2026

pom.xml

@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.contentstack.sdk</groupId>
     <artifactId>java</artifactId>
-    <version>2.8.1</version>
+    <version>2.8.2</version>
     <packaging>jar</packaging>
     <name>contentstack-java</name>
     <description>Java SDK for Contentstack Content Delivery API</description>
@@ -220,11 +220,11 @@
                 <artifactId>commons-lang3</artifactId>
                 <version>3.18.0</version>
             </dependency>
-            <!-- Fix Cross-site Scripting (XSS) in jsoup pulled by contentstack-utils transitive deps -->
+            <!-- Fix XSS and CVE-2026-75140 (unbounded XML namespace allocation) in jsoup pulled by contentstack-utils transitive deps -->
             <dependency>
                 <groupId>org.jsoup</groupId>
                 <artifactId>jsoup</artifactId>
-                <version>1.23.1</version>
+                <version>1.23.2</version>
             </dependency>
             <!-- Fix Spring vulnerabilities from contentstack-utils transitive deps -->
             <dependency>