jq (1.7.1-6+deb13u3) trixie-security; urgency=high * Non-maintainer upload by the Security Team. * Cherry-pick upstream commit for the following: CVE-2026-41256, CVE-2026-41257, CVE-2026-43896, CVE-2026-43895, CVE-2026-44777, CVE-2026-43894, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679, CVE-2026-40612, GHSA-ggc9-rpv2-xgpm, GHSA-gvwx-xj9r-3frq, GHSA-gf4g-95wj-4q4r * Add missing patch for CVE-2026-32316, a prerequisite for CVE-2026-54679 fix. * Fix CVE-2024-53427 for real. The patch carried since 1.7.1-5 placed the NaN payload check inside the DEC_Conversion_syntax branch, which already returns JV_INVALID unconditionally, so it never had any effect and "NaN123" still parsed. Move the check to the decNumberIsNaN branch as upstream does, and update the two tests that encoded the old behaviour. * Do not abort when repeating a string past the length bound. The CVE-2026-32316 fix made jvp_string_append() able to return an invalid jv; binop_multiply() appended in a loop without checking, so an input like {"s":"abc","n":1000000000} with a filter of .s * .n aborted on an assertion. Reject the operation up front and stop the loop on failure. * Propagate invalid jv instead of aborting on it. The same change of contract affects jvp_string_append(), jv_string_concat() and jv_sort(); callers written against the old always-valid contract abort on an assertion. Guard centrally in jv.c so the @base64, @csv, @tsv, @sh, @uri and escape_string loops are all covered, and guard jv_delpaths(), jv_dump_string_trunc() and the jv_dump_string() results printed by main.c. delpaths and the error-message paths are regressions against previous version; the string-format ones replace the CVE-2026-32316 integer overflow with a proper error. -- Aron Xu Tue, 04 Aug 2026 20:56:56 +0800 jq (1.7.1-6+deb13u2) trixie; urgency=medium * Cherry-pick upstream commit for the following: * CVE-2026-32316 * CVE-2026-33947 * CVE-2026-33948 * CVE-2026-39956 * CVE-2026-39979 * CVE-2026-40164 -- ChangZhuo Chen (陳昌倬) Fri, 17 Apr 2026 17:08:56 +0800 jq (1.7.1-6+deb13u1) trixie; urgency=medium * Cherry-pick upstream commit for CVE-2025-48060. -- ChangZhuo Chen (陳昌倬) Tue, 08 Jul 2025 00:16:39 +0800 jq (1.7.1-6) unstable; urgency=medium * Cherry-pick upstream commit for CVE-2024-23337 (Closes: #1106289) -- ChangZhuo Chen (陳昌倬) Sun, 25 May 2025 03:15:28 +0800 jq (1.7.1-5) unstable; urgency=medium * Cherry-pick upstream commit for CVE-2024-53427 (Closes: #1102679) * d/copyright: Update copyright year. -- ChangZhuo Chen (陳昌倬) Sat, 12 Apr 2025 16:09:04 +0800 jq (1.7.1-4) unstable; urgency=medium [ Andreas Hasenack ] * Update patch to call python3 instead of python (Closes: #1102376) -- ChangZhuo Chen (陳昌倬) Wed, 09 Apr 2025 22:34:25 +0800 jq (1.7.1-3) unstable; urgency=medium [ Helmut Grohne ] * Non-maintainer upload. * Stop using libtool-bin. (Closes: #1064662) -- ChangZhuo Chen (陳昌倬) Fri, 01 Mar 2024 00:24:00 +0800 jq (1.7.1-2) unstable; urgency=high * Remove valgrind [i386] to fix FTBFS. (Closes: #1058870) -- ChangZhuo Chen (陳昌倬) Sun, 17 Dec 2023 23:08:11 +0800 jq (1.7.1-1) unstable; urgency=high * New upstream release. (Closes: #1058763) * Fix CVE-2023-50246, CVE-2023-50268. * Remove unnecessary patch. -- ChangZhuo Chen (陳昌倬) Sat, 16 Dec 2023 04:35:42 +0800 jq (1.7-1) unstable; urgency=medium * New upstream release. (Closes: #824814, #903081, #985350, #1025344) * Remove unnecessary patches. * Update libjq symbols. * Add libjq.pc. * d/control: Tweak indent. -- ChangZhuo Chen (陳昌倬) Wed, 13 Sep 2023 03:22:17 +0800 jq (1.6-3) unstable; urgency=medium [ Alex Murray ] * Fix fromdate when local time is during daylight savings (Closes: #979308 LP: #1910162) - d/p/fix-ftbfs-when-localtime-is-dst.patch: Backport upstream patch which ensures fromdate uses the correct time during daylight savings [ ChangZhuo Chen (陳昌倬) ] * Bump Standards-Version to 4.6.2. * Clean modified files (Closes: #1047460) * Update Homepage. * Update d/copyright. * Add d/upstream/metadata. * Add d/gbp.conf. -- ChangZhuo Chen (陳昌倬) Mon, 21 Aug 2023 00:32:38 +0800 jq (1.6-2.1) unstable; urgency=medium [ Paul Gevers ] * Non-maintainer upload [ Sebastien Bacher ] * Fix the build failing on dh_missing (Closes: #972040) * debian/jq.docs: - use the correct paths to install the documentation * debian/rules: - clean the .la -- Paul Gevers Thu, 10 Dec 2020 09:24:21 +0100 jq (1.6-2) unstable; urgency=medium [ Helmut Grohne ] * Fix FTCBFS: Annotate ruby-ronn build dependency with :native. (Closes: #949841) [ ChangZhuo Chen (陳昌倬) ] * Bump Standards-Version to 4.5.0. * Bump compat to 13. -- ChangZhuo Chen (陳昌倬) Sat, 10 Oct 2020 21:50:26 +0800 jq (1.6-1) unstable; urgency=medium [ Ondřej Nový ] * d/copyright: Use https protocol in Format field. * d/watch: Use https protocol. [ Helmut Grohne ] * stop using libtool-bin. (Closes: #912843) [ ChangZhuo Chen (陳昌倬) ] * New upstream release. * Bump Standards-Version to 4.4.1. * Remove unused Build-Depends dh-autoreconf. * Remove get-orig-source. * Bump compat to 12 * Remove Simon Elsbrock as Uploaders (Closes: #871236). * Replace libtool-bin with libtool (Closes: #912843) * Thanks to Helmut Grohneg. * Do not use venderized oniguruma. * Fix uninitialized variables. * Thanks to Reiner Herrmann. * Set Rules-Requires-Root: no. * Update copyright. -- ChangZhuo Chen (陳昌倬) Thu, 10 Oct 2019 00:17:01 +0800 jq (1.5+dfsg-2) unstable; urgency=medium * Change Maintainer to ChangZhuo Chen. (Closes: #852280) * Bump Standards-Version to 3.9.8. * Bump compat to 10. * Update Vcs-* fields. -- ChangZhuo Chen (陳昌倬) Mon, 30 Jan 2017 12:41:39 +0800 jq (1.5+dfsg-1.3) unstable; urgency=medium * Non-maintainer upload. * Ensure jq and libjq depend on libjq1's exact version. * Add libjq1.symbols file. -- Harlan Lieberman-Berg Fri, 30 Dec 2016 03:26:22 -0500 jq (1.5+dfsg-1.2) unstable; urgency=medium * Non-maintainer upload. * Fix double-build failure. (Closes: #802218) * Add new packages for jq library (Closes: #833213) * Correct description to be more accurate (Closes: #824810) -- Harlan Lieberman-Berg Tue, 27 Dec 2016 19:04:39 -0500 jq (1.5+dfsg-1.1) unstable; urgency=medium * Non-maintainer upload. * Apply patch to fix CVE-2016-4074 (Closes: #822456) * Apply patch to fix CVE-2015-8863 (Closes: #802231) -- Harlan Lieberman-Berg Sun, 13 Nov 2016 19:48:02 -0500 jq (1.5+dfsg-1) unstable; urgency=medium * New upstream release. * Acknowledge 1.4-2.1 NMU * Add "Multi-Arch: foreign" flag (Closes: #799676) * Remove "disable-valgrind-tests" patch (fixed by Upstream in 32ea50d: http://git.io/vCC5r) * Remove "disable-shared-lib" patch: libjq is still disabled, but libonig2 (new requirement for regular expressions) is linked dynamically. This is done with the new patch "static-libjq-dynamic-libonig2". * Add gbp.conf to strip minified Javascript dependencies from tarball -- Simon Elsbrock Sun, 11 Oct 2015 02:09:09 +0200 jq (1.4-2.1) unstable; urgency=medium * Non-maintainer upload. * Restore the 1.3-1.1 NMU changelog. * Fix FTBFS on big endian architectures. Add big-endian-fix.patch. Patch by Dejan Latinovic . Closes: #754754. -- Anibal Monsalve Salazar Mon, 21 Jul 2014 07:42:05 +0100 jq (1.4-1) unstable; urgency=medium * Imported Upstream version 1.4 (Closes: #750969, #715244, #742809, #741932) * Prevent execution of test suite on armel and armhf (Closes: #752046) * Update to Debian source version 9 * Override dh_auto_configure and dh_auto_clean -- Simon Elsbrock Sun, 22 Jun 2014 20:49:15 +0200 jq (1.3-1) unstable; urgency=low * New upstream release. (Closes: #725118) * Add a new patch that enables the creation of the manpage. * Add a new patch that disables valgrind on certain architectures reported as failing (because of missing valgrind support) by buildd * Remove a patch fixing destination directories (resolved by the automake toolchain used in this release). * Use github.com directly to check for new releases instead of the githubredir.debian.net services (as stated in uscan(1)). * Thanks to Faidon Liambotis and Michael Stapelberg for their extensive reviews. -- Simon Elsbrock Wed, 02 Oct 2013 21:25:22 +0200 jq (1.2-8) unstable; urgency=low * Initial release (Closes: #696232) -- Simon Elsbrock Fri, 21 Dec 2012 23:28:59 +0100