From 87bcf59e0d80e42fe721685c753ff669729708dd Mon Sep 17 00:00:00 2001
From: jasmith-hs <jasmith@hubspot.com>
Date: Thu, 29 Oct 2026 12:10:50 -0400
Subject: [PATCH] docs: prepare changelog for jinjava 2.7.7 release

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 CHANGES.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index 2cca906dc..d2a6ce228 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,4 +1,8 @@
 # Jinjava Releases #
+### 2026-10-29 Version 2.7.7 ([Maven Central](https://search.maven.org/artifact/com.hubspot.jinjava/jinjava/2.7.7/jar)) ###
+* Escape single quotes, `<`, `>` and `&` in the `escapejs` filter so output can't break out of a JavaScript string or `<script>` element
+* Confine `FileLocator` and `ClasspathResourceLocator` to their root, rejecting absolute paths and `..` traversal in `include`, `import`, `from` and `extends`
+* [Upgrade jsoup to 1.23.2 to fix CVE-2026-75140, which changes whitespace in `truncatehtml` and `closehtml` output](https://github.com/HubSpot/jinjava/pull/1354)
 ### 2025-01-30 Version 2.7.6 ([Maven Central](https://search.maven.org/artifact/com.hubspot.jinjava/jinjava/2.7.6/jar)) ###
 * Disallow accessing properties on restricted classes while rendering through ForTag
 * Upgrade jackson to version 2.20