From be69e6fe2f7a5d511a0179ca34006980730c61dc Mon Sep 17 00:00:00 2001 From: Kadambini Nema Date: Thu, 5 Jun 2025 00:41:08 -0700 Subject: [PATCH] package/jq: security bump to version 1.8.0 Release notes: https://github.com/jqlang/jq/releases/tag/jq-1.8.0 Fixes the following security issues: - CVE-2024-23337: Fix signed integer overflow in jvp_array_write and jvp_object_rehash. - CVE-2024-53427: Reject NaN with payload while parsing JSON. - CVE-2025-48060: Fix heap buffer overflow in jv_string_vfmt. - Fix use of uninitialized value in check_literal. - Fix segmentation fault on strftime/1, strflocaltime/1. - Fix unhandled overflow in @base64d. COPYING hash changed due to the following commit. https://github.com/jqlang/jq/commit/9afc450930b19ca179e6ef4e744853a94a7b72cf Signed-off-by: Kadambini Nema Signed-off-by: Peter Korsgaard --- package/jq/jq.hash | 4 ++-- package/jq/jq.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/jq/jq.hash b/package/jq/jq.hash index d4d8656ea0..344f73d463 100644 --- a/package/jq/jq.hash +++ b/package/jq/jq.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 478c9ca129fd2e3443fe27314b455e211e0d8c60bc8ff7df703873deeee580c2 jq-1.7.1.tar.gz -sha256 10e974638a41fadfd72357f2f3a4325e20b856c563365128f72feaa406f8c92d COPYING +sha256 91811577f91d9a6195ff50c2bffec9b72c8429dc05ec3ea022fd95c06d2b319c jq-1.8.0.tar.gz +sha256 ea9e53f5974239869c51ace8bb6849c9751dee7c9d592180957987a1a133caff COPYING diff --git a/package/jq/jq.mk b/package/jq/jq.mk index ba27e22f7f..f3f4704f37 100644 --- a/package/jq/jq.mk +++ b/package/jq/jq.mk @@ -4,7 +4,7 @@ # ################################################################################ -JQ_VERSION = 1.7.1 +JQ_VERSION = 1.8.0 JQ_SITE = https://github.com/jqlang/jq/releases/download/jq-$(JQ_VERSION) JQ_LICENSE = MIT (code), ICU (decNumber), CC-BY-3.0 (documentation) JQ_LICENSE_FILES = COPYING