[Buildroot] [PATCH] package/jq: security bump to version 1.8.1

[Buildroot] [PATCH] package/jq: security bump to version 1.8.1

[Angelo Compagnucci]

Changelog:
https://github.com/jqlang/jq/releases/tag/jq-1.8.1

Fixes the following security issues:

- CVE-2025-49014
  Fix heap use after free in f_strftime, f_strflocaltime.

- GHSA-f946-j5j2-4w5m
  Fix stack overflow in node_min_byte_len of oniguruma.

Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
---
 package/jq/jq.hash | 2 +-
 package/jq/jq.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/jq/jq.hash b/package/jq/jq.hash
index 344f73d463..b9d73cbf9e 100644
--- a/package/jq/jq.hash
+++ b/package/jq/jq.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  91811577f91d9a6195ff50c2bffec9b72c8429dc05ec3ea022fd95c06d2b319c  jq-1.8.0.tar.gz
+sha256  2be64e7129cecb11d5906290eba10af694fb9e3e7f9fc208a311dc33ca837eb0  jq-1.8.1.tar.gz
 sha256  ea9e53f5974239869c51ace8bb6849c9751dee7c9d592180957987a1a133caff  COPYING
diff --git a/package/jq/jq.mk b/package/jq/jq.mk
index f3f4704f37..3077a76b17 100644
--- a/package/jq/jq.mk
+++ b/package/jq/jq.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-JQ_VERSION = 1.8.0
+JQ_VERSION = 1.8.1
 JQ_SITE = https://github.com/jqlang/jq/releases/download/jq-$(JQ_VERSION)
 JQ_LICENSE = MIT (code), ICU (decNumber), CC-BY-3.0 (documentation)
 JQ_LICENSE_FILES = COPYING
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/jq: security bump to version 1.8.1

[Thomas Petazzoni via buildroot]

Hello Angelo,

On Mon, 18 Aug 2025 15:36:32 +0200
Angelo Compagnucci <angelo.compagnucci@gmail.com> wrote:

> Changelog:
> https://github.com/jqlang/jq/releases/tag/jq-1.8.1
> 
> Fixes the following security issues:
> 
> - CVE-2025-49014
>   Fix heap use after free in f_strftime, f_strflocaltime.
> 
> - GHSA-f946-j5j2-4w5m
>   Fix stack overflow in node_min_byte_len of oniguruma.
> 
> Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
> ---
>  package/jq/jq.hash | 2 +-
>  package/jq/jq.mk   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)

Thanks for the patch, however this commit breaks "make legal-info" for
the jq package:

ERROR: while checking hashes from package/jq/jq.hash
ERROR: COPYING has wrong sha256 hash:
ERROR: expected: ea9e53f5974239869c51ace8bb6849c9751dee7c9d592180957987a1a133caff
ERROR: got     : ad2b4a266b2268939c1446979759706077421cf906a203aa188c6f396e8cfd74
ERROR: Incomplete download, or man-in-the-middle (MITM) attack
make: *** [package/jq/jq.mk:29: jq-legal-info] Error 1

Could you have a look?

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot