Security update for yq
This update for yq fixes the following issues: Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good (bsc#1267199). - update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix: decode properties array bracket paths. Fix: preserve floats with trailing zero when encoding YAML to JSON. Fix: JSON to TOML root scope and null handling. Fix: reset TOML decoder finished flag on Init for multi-doc evaluation. Fix: reset TOML decoder between files when evaluating all at once. Fix: preserve TOML inline table array scope. Fix: preserve empty TOML arrays in tables Fix: TOML encoder uses inline tables for YAML FlowStyle mappings. Fix nested inline YAML merge explode. Fix repeatString overflow test on 32-bit platforms. - Fix CVE-2026-56852 (GO-2026-5970) (bsc#1271994): A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for yq fixes the following issues: Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good (bsc#1267199). - update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix: decode properties array bracket paths. Fix: preserve floats with trailing zero when encoding YAML to JSON. Fix: JSON to TOML root scope and null handling. Fix: reset TOML decoder finished flag on Init for multi-doc evaluation. Fix: reset TOML decoder between files when evaluating all at once. Fix: preserve TOML inline table array scope. Fix: preserve empty TOML arrays in tables Fix: TOML encoder uses inline tables for YAML FlowStyle mappings. Fix nested inline YAML merge explode. Fix repeatString overflow test on 32-bit platforms. - Fix CVE-2026-56852 (GO-2026-5970) (bsc#1271994): A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
05 / REFERENCES