jq (1.7.1-6+deb13u3) trixie-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * Cherry-pick upstream commit for the following:
    CVE-2026-41256, CVE-2026-41257, CVE-2026-43896, CVE-2026-43895, CVE-2026-44777,
    CVE-2026-43894, CVE-2026-47770, CVE-2026-49839, CVE-2026-54679, CVE-2026-40612,
    GHSA-ggc9-rpv2-xgpm, GHSA-gvwx-xj9r-3frq, GHSA-gf4g-95wj-4q4r
  * Add missing patch for CVE-2026-32316, a prerequisite for CVE-2026-54679 fix.
  * Fix CVE-2024-53427 for real. The patch carried since 1.7.1-5 placed the
    NaN payload check inside the DEC_Conversion_syntax branch, which already
    returns JV_INVALID unconditionally, so it never had any effect and
    "NaN123" still parsed. Move the check to the decNumberIsNaN branch as
    upstream does, and update the two tests that encoded the old behaviour.
  * Do not abort when repeating a string past the length bound. The
    CVE-2026-32316 fix made jvp_string_append() able to return an invalid jv;
    binop_multiply() appended in a loop without checking, so an input like
    {"s":"abc","n":1000000000} with a filter of .s * .n aborted on an
    assertion. Reject the operation up front and stop the loop on failure.
  * Propagate invalid jv instead of aborting on it. The same change of
    contract affects jvp_string_append(), jv_string_concat() and jv_sort();
    callers written against the old always-valid contract abort on an
    assertion. Guard centrally in jv.c so the @base64, @csv, @tsv, @sh, @uri
    and escape_string loops are all covered, and guard jv_delpaths(),
    jv_dump_string_trunc() and the jv_dump_string() results printed by
    main.c. delpaths and the error-message paths are regressions against
    previous version; the string-format ones replace the CVE-2026-32316
    integer overflow with a proper error.

 -- Aron Xu <aron@debian.org>  Tue, 04 Aug 2026 20:56:56 +0800

jq (1.7.1-6+deb13u2) trixie; urgency=medium

  * Cherry-pick upstream commit for the following:
    * CVE-2026-32316
    * CVE-2026-33947
    * CVE-2026-33948
    * CVE-2026-39956
    * CVE-2026-39979
    * CVE-2026-40164

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Fri, 17 Apr 2026 17:08:56 +0800

jq (1.7.1-6+deb13u1) trixie; urgency=medium

  * Cherry-pick upstream commit for CVE-2025-48060.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Tue, 08 Jul 2025 00:16:39 +0800

jq (1.7.1-6) unstable; urgency=medium

  * Cherry-pick upstream commit for CVE-2024-23337 (Closes: #1106289)

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Sun, 25 May 2025 03:15:28 +0800

jq (1.7.1-5) unstable; urgency=medium

  * Cherry-pick upstream commit for CVE-2024-53427 (Closes: #1102679)
  * d/copyright: Update copyright year.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Sat, 12 Apr 2025 16:09:04 +0800

jq (1.7.1-4) unstable; urgency=medium

  [ Andreas Hasenack ]
  * Update patch to call python3 instead of python (Closes: #1102376)

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Wed, 09 Apr 2025 22:34:25 +0800

jq (1.7.1-3) unstable; urgency=medium

  [ Helmut Grohne ]
  * Non-maintainer upload.
  * Stop using libtool-bin. (Closes: #1064662)

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Fri, 01 Mar 2024 00:24:00 +0800

jq (1.7.1-2) unstable; urgency=high

  * Remove valgrind [i386] to fix FTBFS. (Closes: #1058870)

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Sun, 17 Dec 2023 23:08:11 +0800

jq (1.7.1-1) unstable; urgency=high

  * New upstream release. (Closes: #1058763)
    * Fix CVE-2023-50246, CVE-2023-50268.
  * Remove unnecessary patch.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Sat, 16 Dec 2023 04:35:42 +0800

jq (1.7-1) unstable; urgency=medium

  * New upstream release. (Closes: #824814, #903081, #985350, #1025344)
  * Remove unnecessary patches.
  * Update libjq symbols.
  * Add libjq.pc.
  * d/control: Tweak indent.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Wed, 13 Sep 2023 03:22:17 +0800

jq (1.6-3) unstable; urgency=medium

  [ Alex Murray ]
  * Fix fromdate when local time is during daylight savings
    (Closes: #979308 LP: #1910162)
    - d/p/fix-ftbfs-when-localtime-is-dst.patch: Backport upstream patch
      which ensures fromdate uses the correct time during daylight savings

  [ ChangZhuo Chen (陳昌倬) ]
  * Bump Standards-Version to 4.6.2.
  * Clean modified files (Closes: #1047460)
  * Update Homepage.
  * Update d/copyright.
  * Add d/upstream/metadata.
  * Add d/gbp.conf.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Mon, 21 Aug 2023 00:32:38 +0800

jq (1.6-2.1) unstable; urgency=medium

  [ Paul Gevers ]
  * Non-maintainer upload

  [ Sebastien Bacher ]
  * Fix the build failing on dh_missing (Closes: #972040)
  * debian/jq.docs:
    - use the correct paths to install the documentation
  * debian/rules:
    - clean the .la

 -- Paul Gevers <elbrus@debian.org>  Thu, 10 Dec 2020 09:24:21 +0100

jq (1.6-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * Fix FTCBFS: Annotate ruby-ronn build dependency with :native.
    (Closes: #949841)

  [ ChangZhuo Chen (陳昌倬) ]
  * Bump Standards-Version to 4.5.0.
  * Bump compat to 13.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Sat, 10 Oct 2020 21:50:26 +0800

jq (1.6-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/copyright: Use https protocol in Format field.
  * d/watch: Use https protocol.

  [ Helmut Grohne ]
  * stop using libtool-bin. (Closes: #912843)

  [ ChangZhuo Chen (陳昌倬) ]
  * New upstream release.
  * Bump Standards-Version to 4.4.1.
    * Remove unused Build-Depends dh-autoreconf.
    * Remove get-orig-source.
  * Bump compat to 12
  * Remove Simon Elsbrock as Uploaders (Closes: #871236).
  * Replace libtool-bin with libtool (Closes: #912843)
    * Thanks to Helmut Grohneg.
  * Do not use venderized oniguruma.
  * Fix uninitialized variables.
    * Thanks to Reiner Herrmann.
  * Set Rules-Requires-Root: no.
  * Update copyright.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Thu, 10 Oct 2019 00:17:01 +0800

jq (1.5+dfsg-2) unstable; urgency=medium

  * Change Maintainer to ChangZhuo Chen. (Closes: #852280)
  * Bump Standards-Version to 3.9.8.
  * Bump compat to 10.
  * Update Vcs-* fields.

 -- ChangZhuo Chen (陳昌倬) <czchen@debian.org>  Mon, 30 Jan 2017 12:41:39 +0800

jq (1.5+dfsg-1.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Ensure jq and libjq depend on libjq1's exact version.
  * Add libjq1.symbols file.

 -- Harlan Lieberman-Berg <hlieberman@debian.org>  Fri, 30 Dec 2016 03:26:22 -0500

jq (1.5+dfsg-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix double-build failure. (Closes: #802218)
  * Add new packages for jq library (Closes: #833213)
  * Correct description to be more accurate (Closes: #824810)

 -- Harlan Lieberman-Berg <hlieberman@debian.org>  Tue, 27 Dec 2016 19:04:39 -0500

jq (1.5+dfsg-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Apply patch to fix CVE-2016-4074 (Closes: #822456)
  * Apply patch to fix CVE-2015-8863 (Closes: #802231)

 -- Harlan Lieberman-Berg <hlieberman@debian.org>  Sun, 13 Nov 2016 19:48:02 -0500

jq (1.5+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Acknowledge 1.4-2.1 NMU
  * Add "Multi-Arch: foreign" flag (Closes: #799676)
  * Remove "disable-valgrind-tests" patch (fixed by Upstream in 32ea50d:
    http://git.io/vCC5r)
  * Remove "disable-shared-lib" patch: libjq is still disabled, but libonig2
    (new requirement for regular expressions) is linked dynamically. This is
    done with the new patch "static-libjq-dynamic-libonig2".
  * Add gbp.conf to strip minified Javascript dependencies from tarball

 -- Simon Elsbrock <simon@iodev.org>  Sun, 11 Oct 2015 02:09:09 +0200

jq (1.4-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Restore the 1.3-1.1 NMU changelog.
  * Fix FTBFS on big endian architectures.
    Add big-endian-fix.patch.
    Patch by Dejan Latinovic <Dejan.Latinovic@imgtec.com>.
    Closes: #754754.

 -- Anibal Monsalve Salazar <anibal@debian.org>  Mon, 21 Jul 2014 07:42:05 +0100

jq (1.4-1) unstable; urgency=medium

  * Imported Upstream version 1.4 (Closes: #750969, #715244, #742809, #741932)
  * Prevent execution of test suite on armel and armhf (Closes: #752046)
  * Update to Debian source version 9
  * Override dh_auto_configure and dh_auto_clean

 -- Simon Elsbrock <simon@iodev.org>  Sun, 22 Jun 2014 20:49:15 +0200

jq (1.3-1) unstable; urgency=low

  * New upstream release. (Closes: #725118)
  * Add a new patch that enables the creation of the manpage.
  * Add a new patch that disables valgrind on certain architectures
    reported as failing (because of missing valgrind support) by buildd
  * Remove a patch fixing destination directories (resolved by the
    automake toolchain used in this release).
  * Use github.com directly to check for new releases instead of the
    githubredir.debian.net services (as stated in uscan(1)).
  * Thanks to Faidon Liambotis and Michael Stapelberg for their extensive
    reviews.

 -- Simon Elsbrock <simon@iodev.org>  Wed, 02 Oct 2013 21:25:22 +0200

jq (1.2-8) unstable; urgency=low

  * Initial release (Closes: #696232)

 -- Simon Elsbrock <simon@iodev.org>  Fri, 21 Dec 2012 23:28:59 +0100
