From b011ed91568279412170b985b46e488dcf3330bc Mon Sep 17 00:00:00 2001
From: jasmith-hs <jasmith@hubspot.com>
Date: Thu, 29 Oct 2026 10:32:12 -0400
Subject: [PATCH] fix(deps): bump jsoup to 1.23.2 for CVE-2026-75140

jsoup is shaded into the jinjava jar, so consumers cannot override the
vulnerable 1.15.3 version themselves.

jsoup's pretty-printer changed between 1.15.3 and 1.23.2, so update the
closehtml expectation for a block element nested inside another block.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 826abcd70e15fd9650a4b5f8954fee382c61148e)
---
 pom.xml                                                         | 2 +-
 .../com/hubspot/jinjava/lib/filter/CloseHtmlFilterTest.java     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index bbaab3325..0779ede5d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -39,7 +39,7 @@
       <dependency>
         <groupId>org.jsoup</groupId>
         <artifactId>jsoup</artifactId>
-        <version>1.15.3</version>
+        <version>1.23.2</version>
       </dependency>
       <dependency>
         <groupId>de.odysseus.juel</groupId>
diff --git a/src/test/java/com/hubspot/jinjava/lib/filter/CloseHtmlFilterTest.java b/src/test/java/com/hubspot/jinjava/lib/filter/CloseHtmlFilterTest.java
index c733d9835..851febf31 100644
--- a/src/test/java/com/hubspot/jinjava/lib/filter/CloseHtmlFilterTest.java
+++ b/src/test/java/com/hubspot/jinjava/lib/filter/CloseHtmlFilterTest.java
@@ -31,6 +31,6 @@ public void itIgnoresClosedTags() {
   public void itClosesMultipleTags() {
     String openTags = "<h1><p>Hello, world!";
     assertThat(f.filter(openTags, interpreter))
-      .isEqualTo("<h1><p>Hello, world!</p></h1>");
+      .isEqualTo("<h1>\n <p>Hello, world!</p>\n</h1>");
   }
 }