1980 Commits
Author SHA1 Message Date
itchyny c3d3e7d656 Fix buttons in tutorial to toggle labels when clicked on (#3493) 2026-03-02 17:46:58 +09:00
dependabot[bot] 2beac1aed0 build(deps): bump markdown from 3.10 to 3.10.2 in /docs (#3492) 2026-03-01 16:06:09 +09:00
dependabot[bot] 2d5239e8c1 build(deps): bump jsonschema from 4.25.1 to 4.26.0 in /docs (#3474) 2026-03-01 16:04:55 +09:00
itchyny 601a37f452 Refactor tm2jv to handle fractional seconds removing duplicated code (#3489) 2026-03-01 06:18:14 +09:00
itchyny 750dbe723b Fix memory leaks and double frees (#3487) 2026-03-01 06:15:58 +09:00
Fabian Fleischer 2ad99a6c70 Pre-allocate tokenbuf for string parser (#3485)
Fixes #3483
2026-02-28 15:45:16 +01:00
Fabian Fleischer 061fd14d74 Fix off-by-one in modulo operator (#3486) 2026-02-27 04:35:36 +09:00
itchyny 22361cfb87 Improve error message truncation with closing delimiters (#3478)
Truncated strings now show closing delimiters: `..."` for strings,
`...]` for arrays, and `...}` for objects, making error messages
clearer.
2026-02-25 08:14:23 +09:00
Ze Sheng a2741ee0a8 Limit number of function parameters and definitions to prevent SEGV (#3460) 2026-02-25 07:49:40 +09:00
itchyny b33a7634ba Fix reversed pointer subtraction in f_env bounds check (#3465) 2026-01-20 21:56:09 +09:00
itchyny d44baeb67a Support arm/v7 architecture in Docker images (#3463) 2026-01-15 14:10:07 +09:00
dependabot[bot] ea9e41f758 build(deps): bump the official-actions group with 2 updates (#3450) 2025-12-17 11:24:39 +09:00
dependabot[bot] f46dc3dd61 build(deps): bump markdown from 3.9 to 3.10 in /docs (#3442) 2025-12-17 11:24:12 +09:00
José Joaquín Atria 88b9c4920e Fix stder typo (#3446)
The manual was missing an "r" in "stderr".
2025-12-12 10:54:39 +01:00
bigmoonbit 0eb3da11ed chore: fix typo in tests/jq.test (#3441)
fix typo in  tests/jq.test

Signed-off-by: bigmoonbit <bigmoonbit@outlook.com>
2025-11-27 10:44:45 +01:00
dependabot[bot] 39572e129f build(deps): bump actions/checkout from 5 to 6 in the official-actions group (#3439) 2025-11-24 15:15:18 +09:00
Jan-Piet Mens 4829059147 Add missing word in manual for rawfile (#3434) 2025-11-18 09:49:59 +09:00
itchyny 33b3a68f9c Fix expected value assertion (fix #3430, ref #3393) (#3431) 2025-11-04 21:21:21 +09:00
Mattias Wadman cff4e00982 website: Add wiki link to navigation bar (#3424)
Related to #3423
2025-10-31 10:17:25 +01:00
itchyny 5529788292 Fix slurping raw input not to corrupt multi-byte characters (fix #3389) (#3421) 2025-10-31 15:16:29 +09:00
dependabot[bot] 8d9a3c3ab3 build(deps): bump the official-actions group with 2 updates (#3429) 2025-10-27 16:48:33 +09:00
Ish Nagy b29504b4e1 Increase the maximum printing depth from 256 to 10000 (fixes #3413) (#3414) 2025-10-14 14:12:57 +09:00
Sudhakar Verma 589a6947fa jq_fuzz_execute: limit oniguruma depth to 1024 (#3377)
Fixes #3375 - I'll also fix the oss-fuzz build for this in a PR

Signed-off-by: Sudhakar Verma <sudhakar.verma@canonical.com>
2025-10-05 12:50:42 +09:00
dependabot[bot] c9c96b3cdd build(deps): bump lxml from 6.0.1 to 6.0.2 in /docs (#3416) 2025-10-01 06:39:11 +00:00
dependabot[bot] f240512140 build(deps): bump markdown from 3.8.2 to 3.9 in /docs (#3418) 2025-10-01 06:37:39 +00:00
dependabot[bot] 2b084a6d2d build(deps): bump pyyaml from 6.0.2 to 6.0.3 in /docs (#3417) 2025-10-01 06:37:20 +00:00
A4-Tacks 169457328d Fix rtrimstr("") always output "" (#3415)
Example
---
**Before this fix**:

```sh
$ jq -n '"foo"|rtrimstr("")'
""
```

**After this fix**:

```sh
$ jq -n '"foo"|rtrimstr("")'
"foo"
```
2025-09-29 17:15:43 +02:00
itchyny c8017bf079 Fix localization test for time formatting functions (fix #3368) (#3409) 2025-09-15 07:48:02 +09:00
itchyny a4d9d54010 Fix expected value assertion for NaN value (fix #3393) (#3408) 2025-09-15 07:47:51 +09:00
itchyny 695830c453 Fix year 2038 problem on 32-bit platforms (fix #3369) (#3407) 2025-09-15 07:46:29 +09:00
Kartik Shah cd3a4c3d31 Remove extra space from die func output (#3391) 2025-09-15 07:43:10 +09:00
dependabot[bot] 63c5f4e196 build(deps): bump the official-actions group with 2 updates (#3405) 2025-09-09 11:57:01 +00:00
dependabot[bot] 755ac61755 build(deps): bump jsonschema from 4.25.0 to 4.25.1 in /docs (#3404) 2025-09-05 12:02:28 +00:00
dependabot[bot] 68f9e0a7e1 build(deps): bump lxml from 6.0.0 to 6.0.1 in /docs (#3403) 2025-09-05 12:01:56 +00:00
dependabot[bot] 21471c5e3b build(deps): bump the official-actions group across 1 directory with 3 updates (#3401) 2025-08-27 03:05:20 +00:00
dependabot[bot] a8115e5bc9 build(deps): bump jsonschema from 4.24.0 to 4.25.0 in /docs (#3382)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-04 21:12:16 +09:00
itchyny 0ff997f7c4 Update GPG signing key (fix #3381) 2025-07-31 23:00:24 +09:00
Dennis Ameling 4357b6154e CI: add builds for Windows arm64 (#3376) 2025-07-27 08:23:57 +09:00
Alyssa Ross 3c5ceac8e7 jq.test: drop non-portable %F test (#3365)
%F is a non-portable GNU extension, not supported by all strptime
implementations (for example musl's).
2025-07-05 01:25:28 +09:00
itchyny b9e19de76e Update jq documentation for jq 1.8.1 release 2025-07-01 20:54:28 +09:00
github-actions[bot]andgithub-actions[bot] 3db7b519bf Update signatures of 1.8.1 (#3364)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-07-01 20:50:42 +09:00
itchyny 4467af7068 Update NEWS.md and AUTHORS for 1.8.1 (#3353) jq-1.8.1 2025-07-01 19:36:14 +09:00
dependabot[bot] 98a1176cff build(deps): bump pyyaml from 6.0.1 to 6.0.2 in /docs (#3363)
Bumps [pyyaml](https://github.com/yaml/pyyaml) from 6.0.1 to 6.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/yaml/pyyaml/releases">pyyaml's
releases</a>.</em></p>
<blockquote>
<h2>6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Support for Cython 3.x and Python 3.13.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2">https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2</a></p>
<h2>6.0.2rc1</h2>
<ul>
<li>Support for extension build with Cython 3.x</li>
<li>Support for Python 3.13</li>
<li>Added PyPI wheels for musllinux on aarch64</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/yaml/pyyaml/blob/main/CHANGES">pyyaml's
changelog</a>.</em></p>
<blockquote>
<p>6.0.2 (2024-08-06)</p>
<ul>
<li><a
href="https://redirect.github.com/yaml/pyyaml/pull/808">yaml/pyyaml#808</a>
-- Support for Cython 3.x and Python 3.13</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/yaml/pyyaml/commit/41309b0bcb4559edb1d691d47199035ef539d785"><code>41309b0</code></a>
Release 6.0.2 (<a
href="https://redirect.github.com/yaml/pyyaml/issues/819">#819</a>)</li>
<li><a
href="https://github.com/yaml/pyyaml/commit/dd9f0e1236775dcce682c91823e009556ce2a271"><code>dd9f0e1</code></a>
6.0.2rc1 (<a
href="https://redirect.github.com/yaml/pyyaml/issues/809">#809</a>)</li>
<li><a
href="https://github.com/yaml/pyyaml/commit/f5527a26d518b3e9c66f9211e0af00c83f09a97e"><code>f5527a2</code></a>
disable CI trigger on PR edits</li>
<li><a
href="https://github.com/yaml/pyyaml/commit/b4d80a742142004490d2da7691d534923820b81c"><code>b4d80a7</code></a>
Python 3.12 + musllinux_1_1_x86_64 wheel support</li>
<li>See full diff in <a
href="https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyyaml&package-manager=pip&previous-version=6.0.1&new-version=6.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-01 19:29:37 +09:00
dependabot[bot] 205b3a2d75 build(deps): bump lxml from 5.4.0 to 6.0.0 in /docs (#3362)
[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml&package-manager=pip&previous-version=5.4.0&new-version=6.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-01 17:31:54 +09:00
dependabot[bot] d21e506d52 build(deps): bump markdown from 3.8 to 3.8.2 in /docs (#3361)
[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=markdown&package-manager=pip&previous-version=3.8&new-version=3.8.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-01 17:19:03 +09:00
TheOdd 11f43e9d93 Fixed minor typo in docs (#3359) 2025-06-30 07:31:28 +09:00
엄태용 2e6987967e Use jv_mem_alloc to allocate dtoa_context in tsd_dtoa_context_get (#3356) 2025-06-30 07:27:24 +09:00
itchyny 0b1ef46973 Add oniguruma library path to link jq program 2025-06-24 23:49:32 +09:00
Mattias Wadman 5e159b34b1 Fix GHSA-f946-j5j2-4w5m stack-overflow by limit regex parse depth
Was detect by AFL build but it's unsure if possible to trigger in non-fuzz build.

Oniguruma has a default limit of 4096 but this is not be low enough to
protect from stack-overflows in some builds like with AFL where it seems
to use more stack space. A limit of 1024 should be enough usage-wise
and also give more margin.
2025-06-24 15:39:40 +02:00
Mattias Wadman 499c91bca9 Fixes CVE-2025-49014 which was introduced in 1.8.0 2025-06-19 00:11:01 +02:00