jq (1.6-2.1ubuntu3.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow
    - debian/patches/CVE-2026-32316.patch: Fix heap buffer overflow in
      `jvp_string_append` and `jvp_string_copy_replace_bad`
    - CVE-2026-32316
  * SECURITY UPDATE: Stack Buffer Overflow
    - debian/patches/CVE-2026-33947.patch: Limit path depth to prevent
      stack overflow
    - CVE-2026-33947
  * SECURITY UPDATE: Improper Null Termination
    - debian/patches/CVE-2026-33948.patch: Fix NUL truncation in the
      JSON parser
    - CVE-2026-33948
  * SECURITY UPDATE: Out of Bounds Read
    - debian/patches/CVE-2026-39956.patch: Add runtime type checks to
      f_string_indexes
    - debian/patches/CVE-2026-39979.patch: Fix out-of-bounds read in
      jv_parse_sized()
    - CVE-2026-39956
    - CVE-2026-39979
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-40164.patch: Randomize hash seed to
      mitigate hash collision DoS attacks
    - CVE-2026-40164

 -- Bruce Cable <bruce.cable@canonical.com>  Mon, 20 Apr 2026 17:29:39 +1000

jq (1.6-2.1ubuntu3.1) jammy-security; urgency=medium

  * SECURITY UPDATE: integer overflow via signed integer limit
    - debian/patches/CVE-2024-23337.patch: fix signed integer overflow in
      jvp_array_write and jvp_object_rehash in src/jv.c, src/jv_aux.c,
      tests/jq.test.
    - CVE-2024-23337
  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2025-48060.patch: fix heap buffer overflow when
      formatting an empty string in src/jv.c, tests/jq.test.
    - CVE-2025-48060

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 16 Jul 2025 11:37:01 -0400

jq (1.6-2.1ubuntu3) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 13:05:53 +0100

jq (1.6-2.1ubuntu2) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:13:32 +0200

jq (1.6-2.1ubuntu1) hirsute; urgency=medium

  [ Alex Murray ]
  * Fix fromdate when local time is during daylight savings (LP: #1910162)
    - d/p/fix-ftbfs-when-localtime-is-dst.patch: Backport upstream patch
      which ensures fromdate uses the correct time during daylight savings

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Tue, 05 Jan 2021 08:03:50 +0100

jq (1.6-2.1) unstable; urgency=medium

  [ Paul Gevers ]
  * Non-maintainer upload

  [ Sebastien Bacher ]
  * Fix the build failing on dh_missing (Closes: #972040)
  * debian/jq.docs:
    - use the correct paths to install the documentation
  * debian/rules:
    - clean the .la

 -- Paul Gevers <elbrus@debian.org>  Thu, 10 Dec 2020 09:24:21 +0100

jq (1.6-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * Fix FTCBFS: Annotate ruby-ronn build dependency with :native.
    (Closes: #949841)

  [ ChangZhuo Chen (陳昌倬) ]
  * Bump Standards-Version to 4.5.0.
  * Bump compat to 13.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Sat, 10 Oct 2020 21:50:26 +0800

jq (1.6-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/copyright: Use https protocol in Format field.
  * d/watch: Use https protocol.

  [ Helmut Grohne ]
  * stop using libtool-bin. (Closes: #912843)

  [ ChangZhuo Chen (陳昌倬) ]
  * New upstream release.
  * Bump Standards-Version to 4.4.1.
    * Remove unused Build-Depends dh-autoreconf.
    * Remove get-orig-source.
  * Bump compat to 12
  * Remove Simon Elsbrock as Uploaders (Closes: #871236).
  * Replace libtool-bin with libtool (Closes: #912843)
    * Thanks to Helmut Grohneg.
  * Do not use venderized oniguruma.
  * Fix uninitialized variables.
    * Thanks to Reiner Herrmann.
  * Set Rules-Requires-Root: no.
  * Update copyright.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Thu, 10 Oct 2019 00:17:01 +0800

jq (1.5+dfsg-2) unstable; urgency=medium

  * Change Maintainer to ChangZhuo Chen. (Closes: #852280)
  * Bump Standards-Version to 3.9.8.
  * Bump compat to 10.
  * Update Vcs-* fields.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Mon, 30 Jan 2017 12:41:39 +0800

jq (1.5+dfsg-1.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Ensure jq and libjq depend on libjq1's exact version.
  * Add libjq1.symbols file.

 -- Harlan Lieberman-Berg <hlieberman@debian.org>  Fri, 30 Dec 2016 03:26:22 -0500

# For older changelog entries, run 'apt-get changelog libjq1'
