EDIT

updating any component to the latest vaadin 7 release requires the pro license:

Vaadin 7.7.17 was the last public open-source version of the Vaadin 7 framework. Vaadin guarantees 5 years of maintenance from the release date of long-term release (LTS) versions. Official support for Vaadin 7 ended in February 2019. (see https://vaadin.com/support/vaadin-7-extended-maintenance)

The release 7.7.28 of vaadin-server actually updates jsoup from 1.8.3 to 1.14.3 (see https://mvnrepository.com/artifact/com.vaadin/vaadin-server/7.7.27)

instead of updating vaadin itself it should be sufficient to upgrade the vulnerable jsoup dependency

1. vaadin has been updated to latest open source version (=7.7.17)
2. updading jsoup to fix https://vaadin.com/security/2021-10-27 was not easily possible due to code incompatibility

--> Problem not yet solved