mirror of
https://github.com/jqlang/jq.git
synced 2026-10-11 21:49:50 +00:00
Update NEWS.md and AUTHORS for 1.8.2 (#3529)
This commit is contained in:
itchyny
@@ -15,6 +15,7 @@ pkoppstein <[email protected]>
|
||||
|
||||
Contributions by:
|
||||
13ren <[email protected]>
|
||||
A4-Tacks <[email protected]>
|
||||
AJ Jordan <[email protected]>
|
||||
Aaron Peschel <[email protected]>
|
||||
Adam Lindberg <[email protected]>
|
||||
@@ -26,6 +27,7 @@ Alex Ozdemir <[email protected]>
|
||||
Alex Wilson <[email protected]>
|
||||
Alexandre Jasmin <[email protected]>
|
||||
Allan Clark <[email protected]>
|
||||
Alyssa Ross <[email protected]>
|
||||
Andreas Heiduk <[email protected]>
|
||||
Andrew O'Brien <[email protected]>
|
||||
Andrew Rodland <[email protected]>
|
||||
@@ -66,6 +68,7 @@ David Korczynski <[email protected]>
|
||||
David R. MacIver <[email protected]>
|
||||
DavidKorczynski <[email protected]>
|
||||
Dawid Ferenczy Rogožan <[email protected]>
|
||||
Dennis Ameling <[email protected]>
|
||||
Derrick Pallas <[email protected]>
|
||||
Doug Luce <[email protected]>
|
||||
Eiichi Sato <[email protected]>
|
||||
@@ -76,6 +79,7 @@ Erik Brinkman <[email protected]>
|
||||
Eugen <[email protected]>
|
||||
Evan Zacks <[email protected]>
|
||||
Fabian Dellwing <[email protected]>
|
||||
Fabian Fleischer <[email protected]>
|
||||
Felix Wolfsteller <[email protected]>
|
||||
Filippo Giunchedi <[email protected]>
|
||||
Filippo Valsorda <[email protected]>
|
||||
@@ -96,6 +100,7 @@ Helmut K. C. Tessarek <[email protected]>
|
||||
Henré Botha <[email protected]>
|
||||
Ian Miell <[email protected]>
|
||||
Ikko Ashimine <[email protected]>
|
||||
Ish Nagy <[email protected]>
|
||||
J Phani Mahesh <[email protected]>
|
||||
J. B. Rainsberger <[email protected]>
|
||||
Jack Pearkes <[email protected]>
|
||||
@@ -104,6 +109,7 @@ Jakub Wilk <[email protected]>
|
||||
James Andariese <[email protected]>
|
||||
James Pearson Hughes <[email protected]>
|
||||
Jan Schulz <[email protected]>
|
||||
Jan-Piet Mens <[email protected]>
|
||||
Janne Cederberg <[email protected]>
|
||||
Jason Hood <[email protected]>
|
||||
Jay Satiro <[email protected]>
|
||||
@@ -115,8 +121,10 @@ Joel Purra <[email protected]>
|
||||
Jonathan Chan Kwan Yin <[email protected]>
|
||||
Jonathan Word <[email protected]>
|
||||
Josh Soref <[email protected]>
|
||||
José Joaquín Atria <[email protected]>
|
||||
Juan Guerrero <[email protected]>
|
||||
Kamontat Chantrachirathumrong <[email protected]>
|
||||
Kartik Shah <[email protected]>
|
||||
Kenny Shen <[email protected]>
|
||||
Kim De Mey <[email protected]>
|
||||
Kim Toms <[email protected]>
|
||||
@@ -142,6 +150,7 @@ Matti Åstrand <[email protected]>
|
||||
Mattias Hansson <[email protected]>
|
||||
Maxime Biais <[email protected]>
|
||||
Maximilian Roos <[email protected]>
|
||||
McSinyx <[email protected]>
|
||||
Michael Daines <[email protected]>
|
||||
Michael Färber <[email protected]>
|
||||
Mike Daines <[email protected]>
|
||||
@@ -153,6 +162,7 @@ Nicolas Pouillard <[email protected]>
|
||||
Nicole Wren <[email protected]>
|
||||
Paul Chvostek <[email protected]>
|
||||
Paul Wise <[email protected]>
|
||||
Peter Kjellerstedt <[email protected]>
|
||||
Peter van Dijk <[email protected]>
|
||||
Philipp Hagemeister <[email protected]>
|
||||
Ricardo Constantino <[email protected]>
|
||||
@@ -161,6 +171,7 @@ Richard H Lee <[email protected]>
|
||||
Riley Avron <[email protected]>
|
||||
Rob Wills <[email protected]>
|
||||
Robert Aboukhalil <[email protected]>
|
||||
Rohan Santhosh Kumar <[email protected]>
|
||||
Roland C. Dowdeswell <[email protected]>
|
||||
Roman Inflianskas <[email protected]>
|
||||
Romero Malaquias <[email protected]>
|
||||
@@ -169,6 +180,7 @@ Rémy Léone <[email protected]>
|
||||
SArpnt <[email protected]>
|
||||
Samar Sunkaria <[email protected]>
|
||||
Santiago Lapresta <[email protected]>
|
||||
Scott Seal <[email protected]>
|
||||
Sean Wei <[email protected]>
|
||||
Sebastian Freundt <[email protected]>
|
||||
Shaun Guth <[email protected]>
|
||||
@@ -181,6 +193,7 @@ Stephen Shaw <[email protected]>
|
||||
Steven Ihde <[email protected]>
|
||||
Steven Maude <[email protected]>
|
||||
Steven Penny <[email protected]>
|
||||
Sudhakar Verma <[email protected]>
|
||||
Thalia Archibald <[email protected]>
|
||||
TheOdd <[email protected]>
|
||||
Thomas Bozeman th026106 <[email protected]>
|
||||
@@ -193,13 +206,17 @@ Tomas Halman <[email protected]>
|
||||
Travis Gockel <[email protected]>
|
||||
Tyler Rockwood <[email protected]>
|
||||
Ulrich Eckhardt <[email protected]>
|
||||
Vladimír Marek <[email protected]>
|
||||
W-Mark Kubacki <[email protected]>
|
||||
William Chargin <[email protected]>
|
||||
Yasuhiro Matsumoto <[email protected]>
|
||||
Yeikel <[email protected]>
|
||||
Yoichi Nakayama <[email protected]>
|
||||
Yu-Fu Fu <[email protected]>
|
||||
Ze Sheng <[email protected]>
|
||||
Zhaohui Mei <[email protected]>
|
||||
Zhiming Wang <[email protected]>
|
||||
bigmoonbit <[email protected]>
|
||||
calpeconsulting <[email protected]>
|
||||
cdnbacon <[email protected]>
|
||||
dak180 <[email protected]>
|
||||
@@ -226,6 +243,8 @@ sachint <[email protected]>
|
||||
sheepster <[email protected]>
|
||||
[email protected] <[email protected]>
|
||||
taoky <[email protected]>
|
||||
theyoucheng <[email protected]>
|
||||
tlsbollei <[email protected]>
|
||||
trantor <[email protected]>
|
||||
wellweek <[email protected]>
|
||||
wllm-rbnt <[email protected]>
|
||||
|
||||
@@ -1,3 +1,105 @@
|
||||
# 1.8.2
|
||||
|
||||
This is a patch release with security fixes and bug fixes since 1.8.1, along with new builds for Windows arm64 and Docker arm/v7.
|
||||
Full commit log can be found at <https://github.com/jqlang/jq/compare/jq-1.8.1...jq-1.8.2>.
|
||||
|
||||
## Security fixes
|
||||
|
||||
- CVE-2026-32316: Fix heap buffer overflow in `jvp_string_append` and `jvp_string_copy_replace_bad`.
|
||||
@itchyny e47e56d226519635768e6aab2f38f0ab037c09e5
|
||||
- CVE-2026-33947: Limit path depth to prevent stack overflow in `jv_setpath`, `jv_getpath`, `jv_delpaths`.
|
||||
@itchyny fb59f1491058d58bdc3e8dd28f1773d1ac690a1f
|
||||
- CVE-2026-33948: Fix NUL truncation in the JSON parser.
|
||||
@itchyny 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b
|
||||
- CVE-2026-39956: Fix `_strindices` missing runtime type checks.
|
||||
@tlsbollei fdf8ef0f0810e3d365cdd5160de43db46f57ed03
|
||||
- CVE-2026-39979: Fix out-of-bounds read in `jv_parse_sized()`.
|
||||
@wader 2f09060afab23fe9390cce7cb860b10416e1bf5f
|
||||
- CVE-2026-40164: Randomize hash seed to mitigate hash collision DoS attacks.
|
||||
@AsafMeizner @itchyny 0c7d133c3c7e37c00b6d46b658a02244fdd3c784
|
||||
- CVE-2026-40612: Limit containment check depth to prevent stack overflow in `contains`.
|
||||
@itchyny d1a12569d91641135976a8536776a4a329c02cc2
|
||||
- CVE-2026-41256: Fix NUL truncation in program files loaded with `-f`.
|
||||
@itchyny 5a015deae35d19e3ebbc65db6c157a80e76df738
|
||||
- CVE-2026-41257: Fix signed-int overflow in `stack_reallocate`.
|
||||
@itchyny 01b3cded76daacbfddb7f8763700b0803bcb5c6f
|
||||
- CVE-2026-43894: Reject numeric literals longer than `DEC_MAX_DIGITS` (999999999).
|
||||
@itchyny 9761ceb7d6cc48c16b25f0ab1baaef0e701927e4
|
||||
- CVE-2026-43895: Reject embedded NUL bytes in module import paths.
|
||||
@itchyny 9d223f153c3632a207fa071caaa6292da33ae361
|
||||
- CVE-2026-43896: Limit recursive object merge depth to prevent stack overflow.
|
||||
@itchyny 532ccea6080ed6758f39fe9f6208a44b665023d2
|
||||
- CVE-2026-44777: Detect circular module imports to prevent stack overflow.
|
||||
@itchyny f58787c41835d9b17795730cb04925fdba25c71c
|
||||
- CVE-2026-47770: Guard deep structural equality and comparison recursion.
|
||||
@fuyu0425 7122866869960b55cea3646bc91334ef55787831
|
||||
- CVE-2026-49839: Fix heap-buffer-overflow in raw file loading.
|
||||
@itchyny e987df0d463d85fd70825e042a082427e8275b86
|
||||
- CVE-2026-54679: Tighten string length bounds and propagate invalid jv in implode.
|
||||
@itchyny 46d1da30944ce93dd671ac72b6513fc0eb747837
|
||||
- GHSA-gf4g-95wj-4q4r: Fix use-after-free in `args2obj()` array argument path. @sseal #3498
|
||||
- GHSA-hj52-j2c9-r8r4: Fix signed-int overflow in `tokenadd` to prevent buffer overflow.
|
||||
@itchyny 63751f8a9f94dc6d3370084ad0d60826c58b955d
|
||||
- Limit the number of function parameters and definitions to prevent SEGV. @OwenSanzas #3460
|
||||
- Pre-allocate `tokenbuf` for string parser to avoid undefined behavior. @fab1ano #3485
|
||||
- Avoid stack overflow when freeing deeply nested values.
|
||||
@itchyny 33d7bce3218ec718139342e5b48b475c4dea715f
|
||||
- Fix memory leaks and double frees. @itchyny #3487
|
||||
|
||||
## Releasing
|
||||
|
||||
- Add builds for Windows arm64. @dennisameling #3376
|
||||
- Support arm/v7 architecture in Docker images. @itchyny #3463
|
||||
- Update GPG signing key. @itchyny 0ff997f7c4c07660ffc6ad2506d5f56b8136208b
|
||||
- Add `artifact-metadata` permission for actions/attest. @itchyny #3530
|
||||
- Upload attestation bundle as a release artifact, allowing unauthenticated
|
||||
verification via `gh attestation verify --bundle jq-attestation.json`.
|
||||
@itchyny #3563
|
||||
|
||||
## CLI changes
|
||||
|
||||
- Improve error message truncation with closing delimiters. @itchyny #3478
|
||||
- Remove extra space from `die` function output. @krtk6160 #3391
|
||||
- Fix raw input flag not to corrupt multi-byte characters. @itchyny #3421
|
||||
- Fix crash when importing a module with errors twice. @itchyny #3497
|
||||
- Increase the maximum printing depth from 256 to 10000. @ishnagy #3414
|
||||
|
||||
## Changes to existing functions
|
||||
|
||||
- Fix `rtrimstr("")` always outputting `""`. @A4-Tacks #3415
|
||||
- Fix infinite loop and undefined behavior in `del(.[nan])`. @itchyny #3490
|
||||
- Refactor `@uri` and `@urid` to fix multi-byte UTF-8 corruption. @itchyny #3495
|
||||
- Fix `tonumber` and `toboolean` to reject strings with embedded null bytes. @itchyny #3496
|
||||
- Fix undefined behavior in modulo operator. @fab1ano #3486
|
||||
- Fix reversed pointer subtraction in `f_env` bounds check. @itchyny #3465
|
||||
- Fix missing validity check in `f_strflocaltime` after `f_localtime`. @itchyny #3491
|
||||
- Fix year 2038 problem on 32-bit platforms. @itchyny #3407
|
||||
- Use `//` instead of `//=` in `from_entries` definition. @itchyny #3516
|
||||
|
||||
## Build and test changes
|
||||
|
||||
- Drop `strptime` test using non-portable `%F`. @alyssais #3365
|
||||
- Limit oniguruma depth to 1024 in `jq_fuzz_execute`. @sudhackar #3377
|
||||
- Fix localization test for time formatting functions. @itchyny #3409
|
||||
- Fix expected value assertion. @itchyny #3431 #3408
|
||||
- Fix typo in tests/jq.test. @bigmoonbit #3441
|
||||
- Refactor `tm2jv` to handle fractional seconds. @itchyny #3489
|
||||
- Fix `jq_fuzz_parse_stream`: use iterative parser API for streaming mode. @OwenSanzas #3499
|
||||
- Fix crashes and resource leaks in `jq_testsuite`. @itchyny #3509
|
||||
- Support building with `--disable-maintainer-mode` and source != build dir. @Saur2000 #3518
|
||||
- Add Solaris support. @vlmarek #3515
|
||||
- Respect `SOURCE_DATE_EPOCH` while generating man page. @McSinyx #3514
|
||||
- Fix undefined pointer arithmetic in UTF-8 helpers. @theyoucheng df924eae91af10cc236a907cdadd97813827aa1f
|
||||
- Fix one-byte over-read in `BASE64_DECODE_TABLE`. @itchyny #3547
|
||||
|
||||
## Documentation changes
|
||||
|
||||
- Add wiki link to navigation bar. @wader #3424
|
||||
- Add missing word in manual for rawfile. @jpmens #3434
|
||||
- Fix typo "stder" to "stderr". @jjatria #3446
|
||||
- Fix buttons in tutorial to toggle labels when clicked on. @itchyny #3493
|
||||
- Fix "happened" spelling in tutorial changelog entries. @Rohan5commit #3525
|
||||
|
||||
# 1.8.1
|
||||
|
||||
This is a patch release to fix security, performance, and build issues found in 1.8.0.
|
||||
|
||||
Reference in New Issue
Block a user