Commit 5cf7871
fix: bump jsoup pin to 1.23.2 to resolve Snyk resource allocation vulnerability
jsoup is pulled in transitively via com.contentstack.sdk:utils and is
flagged by Snyk (CVE-2026-75140) for unbounded memory growth in
XmlTreeBuilder's namespace scope tracking. Fixed upstream in 1.23.2 via
a rewritten NamespaceBindings scope tracker. Bump the dependencyManagement
pin following the existing pattern used for other contentstack-utils
transitive deps.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>1 parent 88e4f6f commit 5cf7871
2 files changed
Lines changed: 8 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
3 | 8 | | |
4 | 9 | | |
5 | 10 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
| 8 | + | |
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| |||
220 | 220 | | |
221 | 221 | | |
222 | 222 | | |
223 | | - | |
| 223 | + | |
224 | 224 | | |
225 | 225 | | |
226 | 226 | | |
227 | | - | |
| 227 | + | |
228 | 228 | | |
229 | 229 | | |
230 | 230 | | |
| |||
0 commit comments