Update NEWS.md and AUTHORS for 1.8.2 (#3529)

2026-10-26 20:16:36 +00:00 · 2026-06-17 22:33:44 +09:00
1 parent a5a29cccc5
commit 88e83408f2
@@ -15,6 +15,7 @@ pkoppstein           <pkoppstein@gmail.com>

 Contributions by:
 13ren                <melbourne.research@gmail.com>
+A4-Tacks             <wdsjxhno1001@163.com>
 AJ Jordan            <alex@strugee.net>
 Aaron Peschel        <apeschel@zendesk.com>
 Adam Lindberg        <hello@alind.io>
@@ -26,6 +27,7 @@ Alex Ozdemir         <aozdemir@hmc.edu>
 Alex Wilson          <gpg@probablyfine.co.uk>
 Alexandre Jasmin     <ajasmin@transtex-llc.com>
 Allan Clark          <allanc@chickenandporn.com>
+Alyssa Ross          <hi@alyssa.is>
 Andreas Heiduk       <asheiduk@users.noreply.github.com>
 Andrew O'Brien       <obrien.andrew@gmail.com>
 Andrew Rodland       <andrew@cleverdomain.org>
@@ -66,6 +68,7 @@ David Korczynski     <david@adalogics.com>
 David R. MacIver     <david@drmaciver.com>
 DavidKorczynski      <david@adalogics.com>
 Dawid Ferenczy Rogožan <ferenczy@users.noreply.github.com>
+Dennis Ameling       <dennis@dennisameling.com>
 Derrick Pallas       <derrick@pallas.us>
 Doug Luce            <doug@github.con.com>
 Eiichi Sato          <sato.eiichi@gmail.com>
@@ -76,6 +79,7 @@ Erik Brinkman        <erik.brinkman@gmail.com>
 Eugen                <EugenGez@gmail.com>
 Evan Zacks           <zackse@gmail.com>
 Fabian Dellwing      <fabian.dellwing@mbconnectline.de>
+Fabian Fleischer     <50590395+fab1ano@users.noreply.github.com>
 Felix Wolfsteller    <felix.wolfsteller@gmail.com>
 Filippo Giunchedi    <fgiunchedi@gmail.com>
 Filippo Valsorda     <filippo.valsorda@gmail.com>
@@ -96,6 +100,7 @@ Helmut K. C. Tessarek <tessarek@evermeet.cx>
 Henré Botha          <henrebotha@gmail.com>
 Ian Miell            <ian.miell@gmail.com>
 Ikko Ashimine        <eltociear@gmail.com>
+Ish Nagy             <50555716+ishnagy@users.noreply.github.com>
 J Phani Mahesh       <github@phanimahesh.me>
 J. B. Rainsberger    <me@jbrains.ca>
 Jack Pearkes         <jackpearkes@gmail.com>
@@ -104,6 +109,7 @@ Jakub Wilk           <jwilk@jwilk.net>
 James Andariese      <james.andariese@locationlabs.com>
 James Pearson Hughes <xiong.chiamiov@gmail.com>
 Jan Schulz           <jasc@gmx.net>
+Jan-Piet Mens        <jp@mens.de>
 Janne Cederberg      <janne.cederberg@gmail.com>
 Jason Hood           <jadoxa@yahoo.com.au>
 Jay Satiro           <raysatiro@yahoo.com>
@@ -115,8 +121,10 @@ Joel Purra           <code+github@joelpurra.com>
 Jonathan Chan Kwan Yin <sofe2038@gmail.com>
 Jonathan Word        <argoday@argoday.com>
 Josh Soref           <2119212+jsoref@users.noreply.github.com>
+José Joaquín Atria   <jjatria@gmail.com>
 Juan Guerrero        <juan.guerrero.lozano@gmail.com>
 Kamontat Chantrachirathumrong <14089557+kamontat@users.noreply.github.com>
+Kartik Shah          <krtk.6160@gmail.com>
 Kenny Shen           <kenny.shen@zalora.com>
 Kim De Mey           <kim.demey@gmail.com>
 Kim Toms             <kim.toms@bplglobal.net>
@@ -142,6 +150,7 @@ Matti Åstrand        <mattiastr@gmail.com>
 Mattias Hansson      <hansson.mattias@gmail.com>
 Maxime Biais         <maxime.biais@gmail.com>
 Maximilian Roos      <5635139+max-sixty@users.noreply.github.com>
+McSinyx              <cnx@loang.net>
 Michael Daines       <michael@mdaines.com>
 Michael Färber       <01mf02@gmail.com>
 Mike Daines          <mdaines@users.noreply.github.com>
@@ -153,6 +162,7 @@ Nicolas Pouillard    <nicolas.pouillard@gmail.com>
 Nicole Wren          <nicole@wren.systems>
 Paul Chvostek        <paul+gitkraken@it.ca>
 Paul Wise            <pabs3@bonedaddy.net>
+Peter Kjellerstedt   <peter.kjellerstedt@gmail.com>
 Peter van Dijk       <peter@7bits.nl>
 Philipp Hagemeister  <phihag@phihag.de>
 Ricardo Constantino  <wiiaboo@gmail.com>
@@ -161,6 +171,7 @@ Richard H Lee        <richard@webdezign.co.uk>
 Riley Avron          <riley.avron@gmail.com>
 Rob Wills            <rob.wills@gmail.com>
 Robert Aboukhalil    <robert.aboukhalil@gmail.com>
+Rohan Santhosh Kumar <181558744+Rohan5commit@users.noreply.github.com>
 Roland C. Dowdeswell <roland.dowdeswell@twosigma.com>
 Roman Inflianskas    <rominf@users.noreply.github.com>
 Romero Malaquias     <romero.malaquias@gmail.com>
@@ -169,6 +180,7 @@ Rémy Léone           <remy.leone@gmail.com>
 SArpnt               <sarpnt@ficial.net>
 Samar Sunkaria       <sameesunkaria@me.com>
 Santiago Lapresta    <santiago.lapresta@gmail.com>
+Scott Seal           <seal.scottm@gmail.com>
 Sean Wei             <me@sean.taipei>
 Sebastian Freundt    <freundt@ga-group.nl>
 Shaun Guth           <sguth@practicefusion.com>
@@ -181,6 +193,7 @@ Stephen Shaw         <stesh@netsoc.tcd.ie>
 Steven Ihde          <sihde@hamachi.us>
 Steven Maude         <StevenMaude@users.noreply.github.com>
 Steven Penny         <svnpenn@gmail.com>
+Sudhakar Verma       <10460978+sudhackar@users.noreply.github.com>
 Thalia Archibald     <thalia@archibald.dev>
 TheOdd               <owenhines@protonmail.com>
 Thomas Bozeman th026106 <thomas.bozeman@digitalglobe.com>
@@ -193,13 +206,17 @@ Tomas Halman         <thalman@redhat.com>
 Travis Gockel        <travis@gockelhut.com>
 Tyler Rockwood       <rockwotj@users.noreply.github.com>
 Ulrich Eckhardt      <ulrich.eckhardt@base-42.de>
+Vladimír Marek       <vlmarek13@gmail.com>
 W-Mark Kubacki       <wmark@hurrikane.de>
 William Chargin      <wchargin@gmail.com>
 Yasuhiro Matsumoto   <mattn.jp@gmail.com>
 Yeikel               <email@yeikel.com>
 Yoichi Nakayama      <yoichi.nakayama@gmail.com>
+Yu-Fu Fu             <yufu@yfu.tw>
+Ze Sheng             <108382772+OwenSanzas@users.noreply.github.com>
 Zhaohui Mei          <mzh.whut@gmail.com>
 Zhiming Wang         <zmwangx@gmail.com>
+bigmoonbit           <bigmoonbit@outlook.com>
 calpeconsulting      <61429736+calpeconsulting@users.noreply.github.com>
 cdnbacon             <mike@busbud.com>
 dak180               <dak180@users.sf.net>
@@ -226,6 +243,8 @@ sachint              <32639496+sachintu47@users.noreply.github.com>
 sheepster            <omer531998@gmail.com>
 tal@whatexit.org     <tal@whatexit.org>
 taoky                <taoky99@outlook.com>
+theyoucheng          <daniel1988xyz@gmail.com>
+tlsbollei            <170938166+tlsbollei@users.noreply.github.com>
 trantor              <trantorvega@gmail.com>
 wellweek             <148746285+wellweek@users.noreply.github.com>
 wllm-rbnt            <william.robinet@conostix.com>
@@ -1,3 +1,105 @@
+# 1.8.2
+
+This is a patch release with security fixes and bug fixes since 1.8.1, along with new builds for Windows arm64 and Docker arm/v7.
+Full commit log can be found at <https://github.com/jqlang/jq/compare/jq-1.8.1...jq-1.8.2>.
+
+## Security fixes
+
+- CVE-2026-32316: Fix heap buffer overflow in `jvp_string_append` and `jvp_string_copy_replace_bad`.
+  @itchyny e47e56d226519635768e6aab2f38f0ab037c09e5
+- CVE-2026-33947: Limit path depth to prevent stack overflow in `jv_setpath`, `jv_getpath`, `jv_delpaths`.
+  @itchyny fb59f1491058d58bdc3e8dd28f1773d1ac690a1f
+- CVE-2026-33948: Fix NUL truncation in the JSON parser.
+  @itchyny 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b
+- CVE-2026-39956: Fix `_strindices` missing runtime type checks.
+  @tlsbollei fdf8ef0f0810e3d365cdd5160de43db46f57ed03
+- CVE-2026-39979: Fix out-of-bounds read in `jv_parse_sized()`.
+  @wader 2f09060afab23fe9390cce7cb860b10416e1bf5f
+- CVE-2026-40164: Randomize hash seed to mitigate hash collision DoS attacks.
+  @AsafMeizner @itchyny 0c7d133c3c7e37c00b6d46b658a02244fdd3c784
+- CVE-2026-40612: Limit containment check depth to prevent stack overflow in `contains`.
+  @itchyny d1a12569d91641135976a8536776a4a329c02cc2
+- CVE-2026-41256: Fix NUL truncation in program files loaded with `-f`.
+  @itchyny 5a015deae35d19e3ebbc65db6c157a80e76df738
+- CVE-2026-41257: Fix signed-int overflow in `stack_reallocate`.
+  @itchyny 01b3cded76daacbfddb7f8763700b0803bcb5c6f
+- CVE-2026-43894: Reject numeric literals longer than `DEC_MAX_DIGITS` (999999999).
+  @itchyny 9761ceb7d6cc48c16b25f0ab1baaef0e701927e4
+- CVE-2026-43895: Reject embedded NUL bytes in module import paths.
+  @itchyny 9d223f153c3632a207fa071caaa6292da33ae361
+- CVE-2026-43896: Limit recursive object merge depth to prevent stack overflow.
+  @itchyny 532ccea6080ed6758f39fe9f6208a44b665023d2
+- CVE-2026-44777: Detect circular module imports to prevent stack overflow.
+  @itchyny f58787c41835d9b17795730cb04925fdba25c71c
+- CVE-2026-47770: Guard deep structural equality and comparison recursion.
+  @fuyu0425 7122866869960b55cea3646bc91334ef55787831
+- CVE-2026-49839: Fix heap-buffer-overflow in raw file loading.
+  @itchyny e987df0d463d85fd70825e042a082427e8275b86
+- CVE-2026-54679: Tighten string length bounds and propagate invalid jv in implode.
+  @itchyny 46d1da30944ce93dd671ac72b6513fc0eb747837
+- GHSA-gf4g-95wj-4q4r: Fix use-after-free in `args2obj()` array argument path. @sseal #3498
+- GHSA-hj52-j2c9-r8r4: Fix signed-int overflow in `tokenadd` to prevent buffer overflow.
+  @itchyny 63751f8a9f94dc6d3370084ad0d60826c58b955d
+- Limit the number of function parameters and definitions to prevent SEGV. @OwenSanzas #3460
+- Pre-allocate `tokenbuf` for string parser to avoid undefined behavior. @fab1ano #3485
+- Avoid stack overflow when freeing deeply nested values.
+  @itchyny 33d7bce3218ec718139342e5b48b475c4dea715f
+- Fix memory leaks and double frees. @itchyny #3487
+
+## Releasing
+
+- Add builds for Windows arm64. @dennisameling #3376
+- Support arm/v7 architecture in Docker images. @itchyny #3463
+- Update GPG signing key. @itchyny 0ff997f7c4c07660ffc6ad2506d5f56b8136208b
+- Add `artifact-metadata` permission for actions/attest. @itchyny #3530
+- Upload attestation bundle as a release artifact, allowing unauthenticated
+  verification via `gh attestation verify --bundle jq-attestation.json`.
+  @itchyny #3563
+
+## CLI changes
+
+- Improve error message truncation with closing delimiters. @itchyny #3478
+- Remove extra space from `die` function output. @krtk6160 #3391
+- Fix raw input flag not to corrupt multi-byte characters. @itchyny #3421
+- Fix crash when importing a module with errors twice. @itchyny #3497
+- Increase the maximum printing depth from 256 to 10000. @ishnagy #3414
+
+## Changes to existing functions
+
+- Fix `rtrimstr("")` always outputting `""`. @A4-Tacks #3415
+- Fix infinite loop and undefined behavior in `del(.[nan])`. @itchyny #3490
+- Refactor `@uri` and `@urid` to fix multi-byte UTF-8 corruption. @itchyny #3495
+- Fix `tonumber` and `toboolean` to reject strings with embedded null bytes. @itchyny #3496
+- Fix undefined behavior in modulo operator. @fab1ano #3486
+- Fix reversed pointer subtraction in `f_env` bounds check. @itchyny #3465
+- Fix missing validity check in `f_strflocaltime` after `f_localtime`. @itchyny #3491
+- Fix year 2038 problem on 32-bit platforms. @itchyny #3407
+- Use `//` instead of `//=` in `from_entries` definition. @itchyny #3516
+
+## Build and test changes
+
+- Drop `strptime` test using non-portable `%F`. @alyssais #3365
+- Limit oniguruma depth to 1024 in `jq_fuzz_execute`. @sudhackar #3377
+- Fix localization test for time formatting functions. @itchyny #3409
+- Fix expected value assertion. @itchyny #3431 #3408
+- Fix typo in tests/jq.test. @bigmoonbit #3441
+- Refactor `tm2jv` to handle fractional seconds. @itchyny #3489
+- Fix `jq_fuzz_parse_stream`: use iterative parser API for streaming mode. @OwenSanzas #3499
+- Fix crashes and resource leaks in `jq_testsuite`. @itchyny #3509
+- Support building with `--disable-maintainer-mode` and source != build dir. @Saur2000 #3518
+- Add Solaris support. @vlmarek #3515
+- Respect `SOURCE_DATE_EPOCH` while generating man page. @McSinyx #3514
+- Fix undefined pointer arithmetic in UTF-8 helpers. @theyoucheng df924eae91af10cc236a907cdadd97813827aa1f
+- Fix one-byte over-read in `BASE64_DECODE_TABLE`. @itchyny #3547
+
+## Documentation changes
+
+- Add wiki link to navigation bar. @wader #3424
+- Add missing word in manual for rawfile. @jpmens #3434
+- Fix typo "stder" to "stderr". @jjatria #3446
+- Fix buttons in tutorial to toggle labels when clicked on. @itchyny #3493
+- Fix "happened" spelling in tutorial changelog entries. @Rohan5commit #3525
+
 # 1.8.1

 This is a patch release to fix security, performance, and build issues found in 1.8.0.