From 2a6c1126ff966cb13a0260f4303988438c63f7ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patrik=20Lindstr=C3=B6m?= <99639133+thevaadinman@users.noreply.github.com> Date: Thu, 10 Sep 2026 15:49:36 +0300 Subject: [PATCH 1/3] chore: Update CHANGELOG for Vaadin 8.32.1 --- CHANGELOG-VAADIN8.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGELOG-VAADIN8.md b/CHANGELOG-VAADIN8.md index 6c52572ee05..7e945d6b5ea 100644 --- a/CHANGELOG-VAADIN8.md +++ b/CHANGELOG-VAADIN8.md @@ -1,5 +1,15 @@ # Vaadin 8 extended maintenance version changelog +## Vaadin 8.32.1 + +* Updated JSoup from version 1.15.3 to 1.23.2 to address [CVE-2026-71497](https://nvd.nist.gov/vuln/detail/cve-2026-71497). + + This should be an invisible change to users; however, the behavior of JSoup has changed between versions in a way that **might** require changes to some files. Namely, self-closing tags are not allowed when parsing in an HTML context. + + Vaadin 7 and 8 contained several tests that imported partial Vaadin Designer files, which contained several self-closing custom tags. These were accepted by JSoup 1.15.3, but no longer by JSoup version 1.15.4. However, examination of Vaadin Designer itself suggests that released versions do not create output that uses self-closing tags, and consequently the change should not affect users. + + If you experience issues regarding HTML content with self-closing tags, let us know by filing an issue with [Vaadin Support](support.vaadin.com). + ## Vaadin 8.32.0 * Added URL scheme validation in `ExternalResource` and `Page`. Based on concepts introduced in Flow PRs [#24539](https://github.com/vaadin/flow/pull/24539) and [#24943](https://github.com/vaadin/flow/pull/24943). From ec964de4f463a111fca0ac2edfa01d94bd7426eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patrik=20Lindstr=C3=B6m?= <99639133+thevaadinman@users.noreply.github.com> Date: Fri, 11 Sep 2026 13:02:23 +0300 Subject: [PATCH 2/3] Fix support link to use HTTPS Updated support link to use HTTPS for security. --- CHANGELOG-VAADIN8.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG-VAADIN8.md b/CHANGELOG-VAADIN8.md index 7e945d6b5ea..37f452b83f6 100644 --- a/CHANGELOG-VAADIN8.md +++ b/CHANGELOG-VAADIN8.md @@ -8,7 +8,7 @@ Vaadin 7 and 8 contained several tests that imported partial Vaadin Designer files, which contained several self-closing custom tags. These were accepted by JSoup 1.15.3, but no longer by JSoup version 1.15.4. However, examination of Vaadin Designer itself suggests that released versions do not create output that uses self-closing tags, and consequently the change should not affect users. - If you experience issues regarding HTML content with self-closing tags, let us know by filing an issue with [Vaadin Support](support.vaadin.com). + If you experience issues regarding HTML content with self-closing tags, let us know by filing an issue with [Vaadin Support](https://support.vaadin.com/). ## Vaadin 8.32.0 From d02bce469aebe4d4e1fc8193a1571e1e95a1a9d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patrik=20Lindstr=C3=B6m?= <99639133+thevaadinman@users.noreply.github.com> Date: Fri, 11 Sep 2026 13:40:48 +0300 Subject: [PATCH 3/3] Update CHANGELOG for JSoup version change Updated the changelog to reflect the JSoup version change and its implications for users regarding self-closing tags. --- CHANGELOG-VAADIN8.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/CHANGELOG-VAADIN8.md b/CHANGELOG-VAADIN8.md index 37f452b83f6..e8daf58291a 100644 --- a/CHANGELOG-VAADIN8.md +++ b/CHANGELOG-VAADIN8.md @@ -6,9 +6,7 @@ This should be an invisible change to users; however, the behavior of JSoup has changed between versions in a way that **might** require changes to some files. Namely, self-closing tags are not allowed when parsing in an HTML context. - Vaadin 7 and 8 contained several tests that imported partial Vaadin Designer files, which contained several self-closing custom tags. These were accepted by JSoup 1.15.3, but no longer by JSoup version 1.15.4. However, examination of Vaadin Designer itself suggests that released versions do not create output that uses self-closing tags, and consequently the change should not affect users. - - If you experience issues regarding HTML content with self-closing tags, let us know by filing an issue with [Vaadin Support](https://support.vaadin.com/). + If you experience issues regarding HTML content or Designer templates with self-closing tags, let us know by filing an issue with [Vaadin Support](https://support.vaadin.com/). ## Vaadin 8.32.0