@port-labs/jq-node-bindings 1.0.4 → 1.1.0-dev

package/deps/jq/NEWS.md

@@ -1,3 +1,278 @@
+# 1.8.1
+
+This is a patch release to fix security, performance, and build issues found in 1.8.0.
+Full commit log can be found at <https://github.com/jqlang/jq/compare/jq-1.8.0...jq-1.8.1>.
+
+## Security fixes
+
+- CVE-2025-49014: Fix heap use after free in `f_strftime`, `f_strflocaltime`.
+  @wader 499c91bca9d4d027833bc62787d1bb075c03680e
+- GHSA-f946-j5j2-4w5m: Fix stack overflow in `node_min_byte_len` of oniguruma.
+  @wader 5e159b34b179417e3e0404108190a2ac7d65611c
+
+## CLI changes
+
+- Fix assertion failure when syntax error happens at the end of the query. @itchyny #3350
+
+## Changes to existing functions
+
+- Fix portability of `strptime/1` especially for Windows. @itchyny #3342
+
+## Language changes
+
+- Revert the change of `reduce`/`foreach` state variable in 1.8.0 (#3205).
+  This change was reverted due to serious performance regression. @itchyny #3349
+
+## Documentation changes
+
+- Add LICENSE notice of NetBSD's `strptime()` to COPYING. @itchyny #3344
+
+## Build improvements
+
+- Fix build on old Mac with old sed. @qianbinbin #3336
+
+# 1.8.0
+
+We are pleased to announce the release of version 1.8.0.
+This release includes a number of improvements since the last version.
+Note that some changes may introduce breaking changes to existing scripts,
+so be sure to read the following information carefully.
+Full commit log can be found at <https://github.com/jqlang/jq/compare/jq-1.7.1...jq-1.8.0>.
+
+## Releasing
+
+- Change the version number pattern to `1.X.Y` (`1.8.0` instead of `1.8`). @itchyny #2999
+- Generate provenance attestations for release artifacts and docker image. @lectrical #3225
+
+  ```sh
+  gh attestation verify --repo jqlang/jq jq-linux-amd64
+  gh attestation verify --repo jqlang/jq oci://ghcr.io/jqlang/jq:1.8.0
+  ```
+
+## Security fixes
+
+- CVE-2024-23337: Fix signed integer overflow in `jvp_array_write` and `jvp_object_rehash`.
+  @itchyny de21386681c0df0104a99d9d09db23a9b2a78b1e
+  - The fix for this issue now limits the maximum size of arrays and objects to 536870912 (`2^29`) elements.
+- CVE-2024-53427: Reject NaN with payload while parsing JSON.
+  @itchyny a09a4dfd55e6c24d04b35062ccfe4509748b1dd3
+  - The fix for this issue now drops support for NaN with payload in JSON (like `NaN123`).
+    Other JSON extensions like `NaN` and `Infinity` are still supported.
+- CVE-2025-48060: Fix heap buffer overflow in `jv_string_vfmt`.
+  @itchyny c6e041699d8cd31b97375a2596217aff2cfca85b
+- Fix use of uninitialized value in `check_literal`. @itchyny #3324
+- Fix segmentation fault on `strftime/1`, `strflocaltime/1`. @itchyny #3271
+- Fix unhandled overflow in `@base64d`. @emanuele6 #3080
+
+## CLI changes
+
+- Fix `--indent 0` implicitly enabling `--compact-output`. @amarshall @gbrlmarn @itchyny #3232
+
+  ```sh
+  $ jq --indent 0 . <<< '{ "foo": ["hello", "world"] }'
+  {
+  "foo": [
+  "hello",
+  "world"
+  ]
+  }
+  # Previously, this implied --compact-output, but now outputs with new lines.
+  ```
+
+- Improve error messages to show problematic position in the filter. @itchyny #3292
+
+  ```sh
+  $ jq -n '1 + $foo + 2'
+  jq: error: $foo is not defined at <top-level>, line 1, column 5:
+      1 + $foo + 2
+          ^^^^
+  jq: 1 compile error
+  ```
+
+- Include column number in parser and compiler error messages. @liviubobocu #3257
+- Fix error message for string literal beginning with single quote. @mattmeyers #2964
+
+  ```sh
+  $ jq .foo <<< "{'foo':'bar'}"
+  jq: parse error: Invalid string literal; expected ", but got ' at line 1, column 7
+  # Previously, the error message was Invalid numeric literal at line 1, column 7.
+  ```
+
+- Improve `JQ_COLORS` environment variable to support larger escapes like truecolor. @SArpnt #3282
+
+  ```sh
+  JQ_COLORS="38;2;255;173;173:38;2;255;214;165:38;2;253;255;182:38;2;202;255;191:38;2;155;246;255:38;2;160;196;255:38;2;189;178;255:38;2;255;198;255" jq -nc '[null,false,true,42,{"a":"bc"}]'
+  ```
+
+- Add `--library-path` long option for `-L`. @thaliaarchi #3194
+- Fix `--slurp --stream` when input has no trailing newline character. @itchyny #3279
+- Fix `--indent` option to error for malformed values. @thaliaarchi #3195
+- Fix option parsing of `--binary` on non-Windows platforms. @calestyo #3131
+- Fix issue with `~/.jq` on Windows where `$HOME` is not set. @kirkoman #3114
+- Fix broken non-Latin output in the command help on Windows. @itchyny #3299
+- Increase the maximum parsing depth for JSON to 10000. @itchyny #3328
+- Parse short options in order given. @thaliaarchi #3194
+- Consistently reset color formatting. @thaliaarchi #3034
+
+## New functions
+
+- Add `trim/0`, `ltrim/0` and `rtrim/0` to trim leading and trailing white spaces. @wader #3056
+
+  ```sh
+  $ jq -n '" hello " | trim, ltrim, rtrim'
+  "hello"
+  "hello "
+  " hello"
+  ```
+
+- Add `trimstr/1` to trim string from both ends. @gbrlmarn #3319
+
+  ```sh
+  $ jq -n '"foobarfoo" | trimstr("foo")'
+  "bar"
+  ```
+
+- Add `add/1`. Generator variant of `add/0`. @myaaaaaaaaa #3144
+
+  ```sh
+  $ jq -c '.sum = add(.xs[])' <<< '{"xs":[1,2,3]}'
+  {"xs":[1,2,3],"sum":6}
+  ```
+
+- Add `skip/2` as the counterpart to `limit/2`. @itchyny #3181
+
+  ```sh
+  $ jq -nc '[1,2,3,4,5] | [skip(2; .[])]'
+  [3,4,5]
+  ```
+
+- Add `toboolean/0` to convert strings to booleans. @brahmlower @itchyny #2098
+
+  ```sh
+  $ jq -n '"true", "false" | toboolean'
+  true
+  false
+  ```
+
+- Add `@urid` format. Reverse of `@uri`. @fmgornick #3161
+
+  ```sh
+  $ jq -Rr '@urid' <<< '%6a%71'
+  jq
+  ```
+
+## Changes to existing functions
+
+- Use code point index for `indices/1`, `index/1` and `rindex/1`. @wader #3065
+  - This is a breaking change. Use `utf8bytelength/0` to get byte index.
+- Improve `tonumber/0` performance and rejects numbers with leading or trailing
+  white spaces. @itchyny @thaliaarchi #3055 #3195
+  - This is a breaking change. Use `trim/0` to remove leading and trailing white spaces.
+- Populate timezone data when formatting time. This fixes timezone name in
+  `strftime/1`, `strflocaltime/1` for DST. @marcin-serwin @sihde #3203 #3264 #3323
+- Preserve numerical precision on unary negation, `abs/0`, `length/0`. @itchyny #3242 #3275
+- Make `last(empty)` yield no output values like `first(empty)`. @itchyny #3179
+- Make `ltrimstr/1` and `rtrimstr/1` error for non-string inputs. @emanuele6 #2969
+- Make `limit/2` error for negative count. @itchyny #3181
+- Fix `mktime/0` overflow and allow fewer elements in date-time representation array. @emanuele6 #3070 #3162
+- Fix non-matched optional capture group. @wader #3238
+- Provide `strptime/1` on all systems. @george-hopkins @fdellwing  #3008 #3094
+- Fix `_WIN32` port of `strptime`. @emanuele6 #3071
+- Improve `bsearch/1` performance by implementing in C. @eloycoto #2945
+- Improve `unique/0` and `unique_by/1` performance. @itchyny @emanuele6 #3254 #3304
+- Fix error messages including long string literal not to break Unicode characters. @itchyny #3249
+- Remove `pow10/0` as it has been deprecated in glibc 2.27. Use `exp10/0` instead. @itchyny #3059
+- Remove private (and undocumented) `_nwise` filter. @itchyny #3260
+
+## Language changes
+
+- Fix precedence of binding syntax against unary and binary operators.
+  Also, allow some expressions as object values. @itchyny #3053 #3326
+  - This is a breaking change that may change the output of filters with binding syntax as follows.
+
+  ```sh
+  $ jq -nc '[-1 as $x | 1,$x]'
+  [1,-1]    # previously, [-1,-1]
+  $ jq -nc '1 | . + 2 as $x | -$x'
+  -3        # previously, -1
+  $ jq -nc '{x: 1 + 2, y: false or true, z: null // 3}'
+  {"x":3,"y":true,"z":3}    # previously, syntax error
+  ```
+
+- Support Tcl-style multiline comments. @emanuele6 #2989
+
+  ```sh
+  #!/bin/sh --
+  # Can be use to do shebang scripts.
+  # Next line will be seen as a comment be of the trailing backslash. \
+  exec jq ...
+  # this jq expression will result in [1]
+  [
+    1,
+    # \
+    2
+  ]
+  ```
+
+- Fix `foreach` not to break init backtracking with `DUPN`. @kanwren #3266
+
+  ```sh
+  $ jq -n '[1, 2] | foreach .[] as $x (0, 1; . + $x)'
+  1
+  3
+  2
+  4
+  ```
+
+- Fix `reduce`/`foreach` state variable should not be reset each iteration. @itchyny #3205
+
+  ```sh
+  $ jq -n 'reduce range(5) as $x (0; .+$x | select($x!=2))'
+  8
+  $ jq -nc '[foreach range(5) as $x (0; .+$x | select($x!=2); [$x,.])]'
+  [[0,0],[1,1],[3,4],[4,8]]
+  ```
+
+- Support CRLF line breaks in filters. @itchyny #3274
+- Improve performance of repeating strings. @itchyny #3272
+
+## Documentation changes
+
+- Switch the homepage to custom domain [jqlang.org](https://jqlang.org). @itchyny @owenthereal #3243
+- Make latest release instead of development version the default manual. @wader #3130
+- Add opengraph meta tags. @wader #3247
+- Replace jqplay.org with play.jqlang.org @owenthereal #3265
+- Add missing line from decNumber's licence to `COPYING`. @emanuele6 #3106
+- Various document improvements. @tsibley #3322, @itchyny #3240, @jhcarl0814 #3239,
+  @01mf02 #3184, @thaliaarchi #3199, @NathanBaulch #3173, @cjlarose #3164,
+  @sheepster1 #3105, #3103, @kishoreinvits #3042, @jbrains #3035, @thalman #3033,
+  @SOF3 #3017, @wader #3015, @wllm-rbnt #3002
+
+## Build improvements
+
+- Fix build with GCC 15 (C23). @emanuele6 #3209
+- Fix build with `-Woverlength-strings` @emanuele6 #3019
+- Fix compiler warning `type-limits` in `found_string`. @itchyny #3263
+- Fix compiler error in `jv_dtoa.c` and `builtin.c`. @UlrichEckhardt #3036
+- Fix warning: a function definition without a prototype is deprecated. @itchyny #3259
+- Define `_BSD_SOURCE` in `builtin.c` for OpenBSD support. @itchyny #3278
+- Define empty `JV_{,V}PRINTF_LIKE` macros if `__GNUC__` is not defined. @emanuele6 #3160
+- Avoid `ctype.h` abuse: cast `char` to `unsigned char` first. @riastradh #3152
+- Remove multiple calls to free when successively calling `jq_reset`. @Sameesunkaria #3134
+- Enable IBM z/OS support. @sachintu47 #3277
+- Fix insecure `RUNPATH`. @orbea #3212
+- Avoid zero-length `calloc`. @itchyny #3280
+- Move oniguruma and decNumber to vendor directory. @itchyny #3234
+
+## Test improvements
+
+- Run tests in C locale. @emanuele6 #3039
+- Improve reliability of `NO_COLOR` tests. @dag-erling #3188
+- Improve `shtest` not to fail if `JQ_COLORS` and `NO_COLOR` are already set. @SArpnt #3283
+- Refactor constant folding tests. @itchyny #3233
+- Make tests pass when `--disable-decnum`. @nicowilliams 6d02d53f515bf1314d644eee93ba30b0d11c7d2b
+- Disable Valgrind by default during testing. @itchyny #3269
+
 # 1.7.1
 
 ## Security
@@ -43,7 +318,7 @@
 - Remove `-dirty` version suffix for windows release build. @itchyny #2888
 - Make use of `od` in tests more compatible. @nabijaczleweli @emanuele6 @nicowilliams #2922
 - Add dependabot. @yeikel #2889
-- Extend fuzzing setup to fuzz parser and and JSON serializer. @DavidKorczynski @emanuele6 #2952
+- Extend fuzzing setup to fuzz parser and JSON serializer. @DavidKorczynski @emanuele6 #2952
 - Keep releasing executables with legacy names. @itchyny #2951
 
 # 1.7
@@ -262,7 +537,7 @@ Full commit log can be found at <https://github.com/jqlang/jq/compare/jq-1.6...j
 - Fix `contains/1` to handle strings with NUL. @nicowilliams 61cd6db
 - Fix `stderr/0` to output raw text without any decoration. @itchyny #2751
 - Fix `nth/2` to emit empty on index out of range. @itchyny #2674
-- Fix `implode` to not assert and instead replace invalid unicode codepoints. @wader #2646
+- Fix `implode` to not assert and instead replace invalid Unicode codepoints. @wader #2646
 - Fix `indices/1` and `rindex/1` in case of overlapping matches in strings. @emanuele6 #2718
 - Fix `sub/3` to resolve issues involving global search-and-replace (gsub) operations. @pkoppstein #2641
 - Fix `significand/0`, `gamma/0` and `drem/2` to be available on macOS. @itchyny #2756 #2775

package/deps/jq/README.md

@@ -4,8 +4,8 @@
 
 ## Documentation
 
-- **Official Documentation**: [jqlang.github.io/jq](https://jqlang.github.io/jq)
-- **Try jq Online**: [jqplay.org](https://jqplay.org)
+- **Official Documentation**: [jqlang.org](https://jqlang.org)
+- **Try jq Online**: [play.jqlang.org](https://play.jqlang.org)
 
 ## Installation
 
@@ -17,6 +17,20 @@ Download the latest releases from the [GitHub release page](https://github.com/j
 
 Pull the [jq image](https://github.com/jqlang/jq/pkgs/container/jq) to start quickly with Docker.
 
+#### Run with Docker
+
+##### Example: Extracting the version from a `package.json` file
+
+```bash
+docker run --rm -i ghcr.io/jqlang/jq:latest < package.json '.version'
+```
+
+##### Example: Extracting the version from a `package.json` file with a mounted volume
+
+```bash
+docker run --rm -i -v "$PWD:$PWD" -w "$PWD" ghcr.io/jqlang/jq:latest '.version' package.json
+```
+
 ### Building from source
 
 #### Dependencies
@@ -29,9 +43,10 @@ Pull the [jq image](https://github.com/jqlang/jq/pkgs/container/jq) to start qui
 #### Instructions
 
 ```console
-git submodule update --init # if building from git to get oniguruma
-autoreconf -i               # if building from git
+git submodule update --init    # if building from git to get oniguruma
+autoreconf -i                  # if building from git
 ./configure --with-oniguruma=builtin
+make clean                     # if upgrading from a version previously built from source
 make -j8
 make check
 sudo make install
@@ -57,4 +72,7 @@ For details on cross-compilation, check out the [GitHub Actions file](.github/wo
 
 ## License
 
-`jq` is released under the [MIT License](COPYING).
+`jq` is released under the [MIT License](COPYING). `jq`'s documentation is
+licensed under the [Creative Commons CC BY 3.0](COPYING).
+`jq` uses parts of the open source C library "decNumber", which is distributed
+under [ICU License](COPYING)

package/deps/jq/compile-ios.sh

@@ -3,7 +3,7 @@
 
 # Defaults
 set -e
-oniguruma='6.9.3'
+oniguruma='6.9.10'
 
 unset CFLAGS
 unset CXXFLAGS

package/deps/jq/config/m4/check-math-func.m4

@@ -2,8 +2,8 @@ dnl AC_CHECK_MATH_FUNC(func)
 AC_DEFUN([AC_CHECK_MATH_FUNC], [
   AC_LANG(C)
   AC_CHECK_LIB([m],[$1],[
-    eval "ac_tr_func=HAVE_[]upcase($1)"
-    AC_DEFINE_UNQUOTED($ac_tr_func)
+    m4_define([ac_tr_func], [HAVE_]m4_toupper($1))
+    AC_DEFINE(ac_tr_func, 1, [Define if you have the $1 math function.])
   ],[
   ])
 ])

package/deps/jq/config/m4/find-func-no-libs2.m4

@@ -42,7 +42,7 @@ case "$ac_res" in
 	yes)
 	eval "ac_cv_func_$1=yes"
 	eval "LIB_$1="
-	AC_DEFINE_UNQUOTED($ac_tr_func)
+	AC_DEFINE_UNQUOTED($ac_tr_func, 1, [Define if the $1 function is available.])
 	AC_MSG_RESULT([yes])
 	;;
 	no)
@@ -53,8 +53,8 @@ case "$ac_res" in
 	*)
 	eval "ac_cv_func_$1=yes"
 	eval "ac_cv_lib_`echo "$ac_res" | sed 's/-l//'`=yes"
-	AC_DEFINE_UNQUOTED($ac_tr_func)
-	AC_DEFINE_UNQUOTED($ac_tr_lib)
+	AC_DEFINE_UNQUOTED($ac_tr_func, 1, [Define if you have the $1 function.])
+	AC_DEFINE_UNQUOTED($ac_tr_lib, 1, [Define if you have the $2 library.])
 	AC_MSG_RESULT([yes, in $ac_res])
 	;;
 esac

package/deps/jq/configure.ac

@@ -1,6 +1,6 @@
 m4_define([jq_version], m4_esyscmd_s([scripts/version])))
 
-AC_INIT([jq],[jq_version],[https://github.com/jqlang/jq/issues],[jq],[https://jqlang.github.io/jq])
+AC_INIT([jq],[jq_version],[https://github.com/jqlang/jq/issues],[jq],[https://jqlang.org])
 
 dnl Created autoconf implementation thompson@dtosolutions, 26NOV12
 AC_PREREQ([2.65])
@@ -39,11 +39,6 @@ if test "$USE_MAINTAINER_MODE" = yes; then
   AC_CHECK_PROGS(LEX, flex lex)
 fi
 
-dnl Check for valgrind
-AC_CHECK_PROGS(valgrind_cmd, valgrind)
-if test "x$valgrind_cmd" = "x" ; then
-    AC_MSG_WARN([valgrind is required to test jq.])
-fi
 AC_CHECK_FUNCS(memmem)
 
 AC_CHECK_HEADER("sys/cygwin.h", [have_cygwin=1;])
@@ -54,10 +49,9 @@ dnl Running tests with Valgrind is slow. It is faster to iterate on
 dnl code without Valgrind until tests pass, then enable Valgrind and
 dnl fix leaks.
 AC_ARG_ENABLE([valgrind],
-   AS_HELP_STRING([--disable-valgrind],[do not run tests under Valgrind]))
+   AS_HELP_STRING([--enable-valgrind],[enable Valgrind during testing]))
 
-dnl Running tests with Valgrind is slow; address sanitizer (ASAN) is
-dnl faster.
+dnl Address sanitizer (ASan)
 AC_ARG_ENABLE([asan],
    AS_HELP_STRING([--enable-asan],[enable address sanitizer]))
 
@@ -111,10 +105,10 @@ AC_ARG_ENABLE([decnum],
    AS_HELP_STRING([--disable-decnum],[disable decnum support]))
 
 AS_IF([test "x$enable_decnum" != "xno"],[
-   AC_DEFINE([USE_DECNUM],1)
+   AC_DEFINE([USE_DECNUM], 1, [Define to enable decnum support.])
 ])
 
-AM_CONDITIONAL([ENABLE_VALGRIND], [test "x$enable_valgrind" != xno])
+AM_CONDITIONAL([ENABLE_VALGRIND], [test "x$enable_valgrind" = xyes])
 AM_CONDITIONAL([ENABLE_ASAN], [test "x$enable_asan" = xyes])
 AM_CONDITIONAL([ENABLE_UBSAN], [test "x$enable_ubsan" = xyes])
 AM_CONDITIONAL([ENABLE_GCOV], [test "x$enable_gcov" = xyes])
@@ -125,7 +119,7 @@ AM_CONDITIONAL([ENABLE_ALL_STATIC], [test "x$enable_all_static" = xyes])
 dnl Find pthread, if we have it. We do this first because we may set -pthread on CFLAGS
 dnl which can cause various macros to be defined (__REENTRANT on Darwin, for example)
 AX_PTHREAD([
-   AC_DEFINE([HAVE_PTHREAD], [1])
+   AC_DEFINE([HAVE_PTHREAD], [1], [Define to enable POSIX threads support.])
    LIBS="$PTHREAD_LIBS $LIBS"
    CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
    CC="$PTHREAD_CC"
@@ -201,7 +195,6 @@ AC_CHECK_MATH_FUNC(lgamma_r)
 AC_CHECK_MATH_FUNC(nearbyint)
 AC_CHECK_MATH_FUNC(nextafter)
 AC_CHECK_MATH_FUNC(nexttoward)
-AC_CHECK_MATH_FUNC(pow10) # Not available with glibc version >= 2.27
 AC_CHECK_MATH_FUNC(pow)
 AC_CHECK_MATH_FUNC(remainder)
 AC_CHECK_MATH_FUNC(rint)
@@ -275,10 +268,10 @@ AS_IF([test "x$with_oniguruma" != xno], [
           AC_MSG_NOTICE([Oniguruma was not found. Will use the packaged oniguruma.])
        ])
    ])
-   AS_IF([test "x$build_oniguruma" = xyes && test -f "${srcdir}/modules/oniguruma/configure.ac" ], [
-       onig_CFLAGS="-I${srcdir}/modules/oniguruma/src"
-       onig_LDFLAGS="-L${srcdir}/modules/oniguruma/src -Wl,-rpath,${libdir}"
-       AC_CONFIG_SUBDIRS([modules/oniguruma])
+   AS_IF([test "x$build_oniguruma" = xyes && test -f "${srcdir}/vendor/oniguruma/configure.ac" ], [
+       onig_CFLAGS="-I${srcdir}/vendor/oniguruma/src"
+       onig_LDFLAGS="-L${srcdir}/vendor/oniguruma/src -Wl,-rpath,${libdir}"
+       AC_CONFIG_SUBDIRS([vendor/oniguruma])
        AC_DEFINE([HAVE_LIBONIG],1,[Define to 1 if the system includes libonig])
    ])
    CFLAGS="$save_CFLAGS"
@@ -289,7 +282,6 @@ AC_SUBST(onig_LDFLAGS)
 
 AM_CONDITIONAL([BUILD_ONIGURUMA], [test "x$build_oniguruma" = xyes])
 AM_CONDITIONAL([WITH_ONIGURUMA], [test "x$with_oniguruma" != xno])
-AC_SUBST([BUNDLER], ["$bundle_cmd"])
 
 AC_CONFIG_MACRO_DIRS([config/m4 m4])
 AC_CONFIG_FILES([Makefile libjq.pc])