jq (1.6-2.1ubuntu3.2) jammy-security; urgency=medium
* SECURITY UPDATE: Heap Buffer Overflow
- debian/patches/CVE-2026-32316.patch: Fix heap buffer overflow in
`jvp_string_append` and `jvp_string_copy_replace_bad`
- CVE-2026-32316
* SECURITY UPDATE: Stack Buffer Overflow
- debian/patches/CVE-2026-33947.patch: Limit path depth to prevent
stack overflow
- CVE-2026-33947
* SECURITY UPDATE: Improper Null Termination
- debian/patches/CVE-2026-33948.patch: Fix NUL truncation in the
JSON parser
- CVE-2026-33948
* SECURITY UPDATE: Out of Bounds Read
- debian/patches/CVE-2026-39956.patch: Add runtime type checks to
f_string_indexes
- debian/patches/CVE-2026-39979.patch: Fix out-of-bounds read in
jv_parse_sized()
- CVE-2026-39956
- CVE-2026-39979
* SECURITY UPDATE: Denial of Service
- debian/patches/CVE-2026-40164.patch: Randomize hash seed to
mitigate hash collision DoS attacks
- CVE-2026-40164
-- Bruce Cable <bruce.cable@canonical.com> Mon, 20 Apr 2026 17:29:39 +1000
jq (1.6-2.1ubuntu3.1) jammy-security; urgency=medium
* SECURITY UPDATE: integer overflow via signed integer limit
- debian/patches/CVE-2024-23337.patch: fix signed integer overflow in
jvp_array_write and jvp_object_rehash in src/jv.c, src/jv_aux.c,
tests/jq.test.
- CVE-2024-23337
* SECURITY UPDATE: heap buffer overflow
- debian/patches/CVE-2025-48060.patch: fix heap buffer overflow when
formatting an empty string in src/jv.c, tests/jq.test.
- CVE-2025-48060
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 16 Jul 2025 11:37:01 -0400
jq (1.6-2.1ubuntu3) jammy; urgency=high
* No change rebuild for ppc64el baseline bump.
-- Julian Andres Klode <juliank@ubuntu.com> Thu, 24 Mar 2022 13:05:53 +0100
jq (1.6-2.1ubuntu2) impish; urgency=medium
* No-change rebuild to build packages with zstd compression.
-- Matthias Klose <doko@ubuntu.com> Thu, 07 Oct 2021 12:13:32 +0200
jq (1.6-2.1ubuntu1) hirsute; urgency=medium
[ Alex Murray ]
* Fix fromdate when local time is during daylight savings (LP: #1910162)
- d/p/fix-ftbfs-when-localtime-is-dst.patch: Backport upstream patch
which ensures fromdate uses the correct time during daylight savings
-- Christian Ehrhardt <christian.ehrhardt@canonical.com> Tue, 05 Jan 2021 08:03:50 +0100
jq (1.6-2.1) unstable; urgency=medium
[ Paul Gevers ]
* Non-maintainer upload
[ Sebastien Bacher ]
* Fix the build failing on dh_missing (Closes: #972040)
* debian/jq.docs:
- use the correct paths to install the documentation
* debian/rules:
- clean the .la
-- Paul Gevers <elbrus@debian.org> Thu, 10 Dec 2020 09:24:21 +0100
jq (1.6-2) unstable; urgency=medium
[ Helmut Grohne ]
* Fix FTCBFS: Annotate ruby-ronn build dependency with :native.
(Closes: #949841)
[ ChangZhuo Chen (陳昌倬) ]
* Bump Standards-Version to 4.5.0.
* Bump compat to 13.
-- ChangZhuo Chen (陳昌倬) <czchen@debian.org> Sat, 10 Oct 2020 21:50:26 +0800
jq (1.6-1) unstable; urgency=medium
[ Ondřej Nový ]
* d/copyright: Use https protocol in Format field.
* d/watch: Use https protocol.
[ Helmut Grohne ]
* stop using libtool-bin. (Closes: #912843)
[ ChangZhuo Chen (陳昌倬) ]
* New upstream release.
* Bump Standards-Version to 4.4.1.
* Remove unused Build-Depends dh-autoreconf.
* Remove get-orig-source.
* Bump compat to 12
* Remove Simon Elsbrock as Uploaders (Closes: #871236).
* Replace libtool-bin with libtool (Closes: #912843)
* Thanks to Helmut Grohneg.
* Do not use venderized oniguruma.
* Fix uninitialized variables.
* Thanks to Reiner Herrmann.
* Set Rules-Requires-Root: no.
* Update copyright.
-- ChangZhuo Chen (陳昌倬) <czchen@debian.org> Thu, 10 Oct 2019 00:17:01 +0800
jq (1.5+dfsg-2) unstable; urgency=medium
* Change Maintainer to ChangZhuo Chen. (Closes: #852280)
* Bump Standards-Version to 3.9.8.
* Bump compat to 10.
* Update Vcs-* fields.
-- ChangZhuo Chen (陳昌倬) <czchen@debian.org> Mon, 30 Jan 2017 12:41:39 +0800
jq (1.5+dfsg-1.3) unstable; urgency=medium
* Non-maintainer upload.
* Ensure jq and libjq depend on libjq1's exact version.
* Add libjq1.symbols file.
-- Harlan Lieberman-Berg <hlieberman@debian.org> Fri, 30 Dec 2016 03:26:22 -0500
# For older changelog entries, run 'apt-get changelog libjq1'
Generated by dwww version 1.14 on Mon Aug 3 02:00:58 CEST 2026.