From 2b3fd6a3acb646f005aba3a1a0dba70162479e73 Mon Sep 17 00:00:00 2001
From: Zhe Sun <31067185+ZheSun88@users.noreply.github.com>
Date: Fri, 14 Aug 2026 12:18:54 +0300
Subject: [PATCH 1/2] test sbom PR

---
 scripts/generator/templates/template-vaadin-bom.xml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/generator/templates/template-vaadin-bom.xml b/scripts/generator/templates/template-vaadin-bom.xml
index 604a3e9f8..dd139c33d 100644
--- a/scripts/generator/templates/template-vaadin-bom.xml
+++ b/scripts/generator/templates/template-vaadin-bom.xml
@@ -18,10 +18,11 @@
         <jna.version>5.18.1</jna.version>
         <!-- Security overrides: force fixed transitive versions -->
         <logback.security.version>1.5.35</logback.security.version>
-        <tomcat.security.version>11.0.24</tomcat.security.version>
+        <tomcat.security.version>11.0.25</tomcat.security.version>
         <jackson2.security.version>2.22.1</jackson2.security.version>
         <jackson3.security.version>3.1.5</jackson3.security.version>
         <kotlin.security.version>2.4.0</kotlin.security.version>
+        <jsoup.version>1.23.1</jsoup.version>
     </properties>
 
     <distributionManagement>
@@ -63,6 +64,12 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- jsoup, CVE-2026-71497 -->
+            <dependency>
+                <groupId>org.jsoup</groupId>
+                <artifactId>jsoup</artifactId>
+                <version>${jsoup.version}</version>
+            </dependency>
             <!-- logback, CVE-2026-10532 -->
             <dependency>
                 <groupId>ch.qos.logback</groupId>

From 377ce63daf2ae5cd4ff2282d69c077844599d215 Mon Sep 17 00:00:00 2001
From: Zhe Sun <31067185+ZheSun88@users.noreply.github.com>
Date: Fri, 14 Aug 2026 12:25:53 +0300
Subject: [PATCH 2/2] Update template-vaadin-bom.xml

---
 scripts/generator/templates/template-vaadin-bom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/generator/templates/template-vaadin-bom.xml b/scripts/generator/templates/template-vaadin-bom.xml
index dd139c33d..846497138 100644
--- a/scripts/generator/templates/template-vaadin-bom.xml
+++ b/scripts/generator/templates/template-vaadin-bom.xml
@@ -18,7 +18,7 @@
         <jna.version>5.18.1</jna.version>
         <!-- Security overrides: force fixed transitive versions -->
         <logback.security.version>1.5.35</logback.security.version>
-        <tomcat.security.version>11.0.25</tomcat.security.version>
+        <tomcat.security.version>11.0.24</tomcat.security.version>
         <jackson2.security.version>2.22.1</jackson2.security.version>
         <jackson3.security.version>3.1.5</jackson3.security.version>
         <kotlin.security.version>2.4.0</kotlin.security.version>