linux/meta-openembedded.git/meta-oe/recipes-devtools/jq, branch master-next

jq: patch CVE-2026-49839

2026-06-16T05:43:45+00:00

CVE details: https://vulert.com/vuln-db/--4743 Signed-off-by: Anton Skorup Signed-off-by: Khem Raj

jq: patch CVE-2026-47770

2026-06-08T01:21:31+00:00

This patch adds the upstream fix for CVE-2026-47770. CVE details: https://ubuntu.com/security/CVE-2026-47770 Signed-off-by: Anton Skorup Signed-off-by: Khem Raj

jq: patch CVE-2026-39979

2026-04-20T14:35:33+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-39979 Backport the patch that is referenced by the NVD advisory.y Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

jq: patch CVE-2026-33948

2026-04-20T14:35:33+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33948 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

jq: patch CVE-2026-33947

2026-04-20T14:35:33+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33947 Backport the patch that is referenced by the NVD report. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

jq: patch CVE-2026-32316

2026-04-20T14:35:33+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32316 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

jq: Use Git to fetch the code

2026-04-10T14:59:52+00:00

There is a bug (see https://github.com/jqlang/jq/issues/434), which results in an empty version being used if autoreconf is run on the jq sources when using a release tar ball. The incorrect assumption is that autoreconf is only used when fetching the code using Git. The empty version results in an incorrect libjq.pc file being created where the version is not set, which results in, e.g., `pkgconf --libs 'libjq > 1.6'` failing even if version 1.8.1 of jq is actually installed. Switch to fetching the code using Git to workaround the bug. Signed-off-by: Peter Kjellerstedt Signed-off-by: Khem Raj

jq: upgrade 1.8.0 -> 1.8.1

2025-07-09T16:16:09+00:00

License-Update: Add LICENSE notice of NetBSD's strptime() to COPYING Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

jq: Add tzdata to ptest rdeps

2025-07-03T06:27:07+00:00

This is needed for some ptests to pass Signed-off-by: Khem Raj

jq: upgrade 1.7.1 -> 1.8.0

2025-06-04T05:01:47+00:00

Changelog: ========== https://github.com/jqlang/jq/releases/tag/jq-1.8.0 Security fixes * CVE-2024-23337: Fix signed integer overflow in jvp_array_write and jvp_object_rehash. @itchyny de21386 The fix for this issue now limits the maximum size of arrays and objects to 536870912 (2^29) elements. * CVE-2024-53427: Reject NaN with payload while parsing JSON. @itchyny a09a4df The fix for this issue now drops support for NaN with payload in JSON (like NaN123). Other JSON extensions like NaN and Infinity are still supported. * CVE-2025-48060: Fix heap buffer overflow in jv_string_vfmt. @itchyny c6e0416 * Fix use of uninitialized value in check_literal. @itchyny #3324 * Fix segmentation fault on strftime/1, strflocaltime/1. @itchyny #3271 * Fix unhandled overflow in @base64d. @emanuele6 #3080 Signed-off-by: Vijay Anusuri Signed-off-by: Khem Raj