[Medium] patch javapackages-bootstrap for CVE-2026-71497

[Ratiranjan5]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary
Patch javapackages-bootstrap for CVE-2026-71497.

• The javapackages-bootstrap package bundles jsoup 1.16.1, which falls within the affected range for CVE-2026-71497 (jsoup 1.14.3–1.23.1).

• The upstream patch was backported manually as the hunks fail to apply.

  • The upstream fix targets jsoup 1.23.1, where the tag name is a StringBuilder-style object ParseSettings.normalName(tagName.value()), tagName.set(name)). In 1.16.1 the tag name is a plain String (ParseSettings.normalName(tagName)).
  • I have done the same fix for 1.16.1's plain-String code. As in upstream, I added import static org.jsoup.internal.Normalizer.lowerCase and replaced trim-based normalization with non-trimming lowerCase(...) at the same three tokenizer sites, Tag.name(), Tag.appendTagName(String), and StartTag.nameAttr().

• Files excluded from the upstream patch:

  • TagSet.java : Doesn't exist in 1.16.1. Its intent (trim only programmatic input, not tokenizer input) is already satisfied by the Token.java change plus the untouched ParseSettings.normalizeTag() used by Tag.valueOf().
  • HtmlParserTest.java and CleanerTest.java: Test-only.
  • CHANGES.md: Upstream docs only.

• The backport is functionally identical to the upstream patch.

• Upstream Patch Reference:
  https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70.patch

Change Log

• new file: SPECS/javapackages-bootstrap/CVE-2026-71497.patch
• modified: SPECS/javapackages-bootstrap/javapackages-bootstrap.spec

Does this affect the toolchain?
NO

Links to CVEs
https://nvd.nist.gov/vuln/detail/CVE-2026-71497

Test Methodology

• Local build was successful.

• Patch applies cleanly

• Installation and Uninstallation on docker image was successful.

• pipeline build: Buddy Build has passed.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

Peer-review analysis -

CVE-2026-71497 -

1. The javapackages-bootstrap version 1.14.0 bundles jsoup version 1.16.1 is in affected range of >= 1.14.3, < 1.23.1. The affected file, functions and code are present.
2. The patch has been backported from upstream, and it has been adapted for jsoup version 1.16.1 String based tagName.
3. Below upstream changes are not included -
   • TagSet.java - It does not exist in 1.16.1. Its trim-only-programmatic-input intent is covered by the Token.java change.
   • HtmlParserTest.java / CleanerTest.java - Test only changes and are not built in this package.
   • CHANGES.md - Documentation related changes.
4. The patch has upstream reference.
5. The patch applies cleanly.
6. The Latest Buddy Build has passed.
7. The ptest is getting executed and has passed.

Verdict: LGTM

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.