From 6aeadf3b77bf9785d7c146ba4d9e024a7d791089 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 29 May 2026 11:45:08 +0200 Subject: [PATCH] package/jq: add CPE vendor The CPE "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*" is valid for this package. See the GHSA [1] and the associated CVE [2]. [1] https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-44777 Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard (cherry picked from commit 3dad008858f656c30d7b7040aaed46786f370493) Signed-off-by: Thomas Perale --- package/jq/jq.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/jq/jq.mk b/package/jq/jq.mk index b0776021fc..19a130b694 100644 --- a/package/jq/jq.mk +++ b/package/jq/jq.mk @@ -9,7 +9,7 @@ JQ_SITE = https://github.com/jqlang/jq/releases/download/jq-$(JQ_VERSION) JQ_LICENSE = MIT (code), ICU (decNumber), CC-BY-3.0 (documentation), \ BSD-2-Clause (strptime) JQ_LICENSE_FILES = COPYING -JQ_CPE_ID_VALID = YES +JQ_CPE_ID_VENDOR = jqlang JQ_INSTALL_STAGING = YES # uses c99 specific features