Investigated build #8628 as Assignee. Compilation succeeded in that build; the final report publication failed because Vulnerabilities contains a HIGH finding: CVE-2026-75140 (jsoup denial of service via deeply nested XML), in lib/org.jsoup.jsoup-1.17.2.jar. The scanner reports 1.23.2 as the fixed version.

Dependency inspection traces jsoup 1.17.2 through commons-loader -> commons-utils (4.2.5). I tested a root dependency-management override to jsoup 1.23.2 with mvn -B -pl server-product -am -Dmaven.test.skip=true -Dmaven.source.skip=true package. Core, plugins, and enterprise modules compiled, but product generation failed with: Inconsistent dependency version in agent and product (groupId: org.jsoup, artifactId: jsoup, version in agent: 1.17.2, version in product: 1.23.2).

The published agent metadata currently lists 3.3.5 as the latest release, which is already used by this checkout. Remediation requires an agent release recording jsoup 1.23.2 (and the corresponding shared dependency update), followed by aligning the server dependencies and rerunning product packaging and the vulnerability scan. This is blocked on that upstream release; I removed the server-only override because it breaks packaging. No code changes or PR are submitted, and the vulnerability threshold remains unchanged.