[jasmith-hs]

Description

This description was authored by Claude Code.

Part of #1342. Backport to master-2.7.x of #1354 (cherry-picked as-is).

Bumps the shaded jsoup dependency from 1.15.3 to 1.23.2, which fixes CVE-2026-75140 (affected range is <= 1.23.1). Because jsoup is shaded into the jinjava jar under jinjava.org.jsoup, consumers can't override the version themselves and have to wait for a jinjava release.

Jinjava only uses jsoup's HTML parser (Jsoup.parse / parseBodyFragment / clean in truncatehtml, striptags and closehtml). It never uses XmlTreeBuilder, so jinjava isn't directly exploitable. The point of this bump is to clear the vulnerable artifact flagged by downstream scanners.

Supersedes the community PRs #1353 (master) and #1337 (2.7.x). #1337 turned off pretty-printing in CloseHtmlFilter. I measured that option: it changes closehtml output for more inputs (11 of 20 sampled) than keeping the default (4 of 20). Turning it off in truncatehtml also breaks that filter's existing tests. So both filters keep jsoup's default pretty-printing here.

BRAVE

Backwards Compatibility

• No API changes. jsoup is shaded and relocated, so no transitive classpath impact for consumers.
• jsoup's pretty-printer changed between 1.15.3 and 1.23.2, so HTML-returning filters can differ in whitespace only:
  • truncatehtml and closehtml: newlines and indentation around block elements move. For example, <h1><p>x</p></h1> now prints the nested <p> on its own indented line, while <div><div>deep</div></div> collapses the innermost <div>deep</div> onto one line. Content between tags is unchanged, except that inline text next to a block element or <br> may gain or lose a newline.
  • striptags: text from adjacent block-level elements is now space-separated. For example, <select><option>1<option>2</select> gives 1 2 instead of 12.
• closehtml isn't registered in the default filter library, so only consumers who register it themselves are affected.
• CloseHtmlFilterTest.itClosesMultipleTags was updated for the new nested-block whitespace. All other existing tests pass unchanged.

Rollout and Rollback Plan

• Ships in the next jinjava 2.7.x patch release.
• Rollback: revert this commit and release again.

Automated Testing

• Existing TruncateHtmlFilterTest, StripTagsFilterTest and CloseHtmlFilterTest cover the jsoup-backed filters.
• mvn verify passes locally.

Verification

• Rendered 20 HTML inputs through closehtml, truncatehtml (with and without killwords) and striptags against both jsoup versions, and diffed the output. The only differences are the whitespace changes listed above.
• Confirmed the shaded jar's META-INF/maven/org.jsoup/jsoup/pom.properties reports version=1.23.2.

Expect Dependencies to Fail

• None expected. A downstream snapshot test that compares exact truncatehtml / closehtml / striptags output may need its whitespace expectations updated.

REVIEWERS: Please review both the code changes and the answers above, and validate that they match the expectations for BRAVE

🤖 Generated with Claude Code