openSUSE-SU-2026:20892-1

This update for yq fixes the following issues:

Changes in yq:

• Fix multiple CVEs:

  • CVE-2026-27136 (GO-2026-5030) CVE-2026-25681 (GO-2026-5029) CVE-2026-25680 (GO-2026-5028) CVE-2026-42502 (GO-2026-5027) CVE-2026-42506 (GO-2026-5025) (bsc#1267053) CVE-2026-39821 (GO-2026-5026) (bsc#1267199)

• update to v4.53.2

  • Add system(command; args) operator (disabled by default).
  • TOML encoder: prefer readable table sections over inline tables.
  • Fix TOML encoder to quote keys containing special characters.
  • Add string slicing support.
  • Fix findInArray misuse on MappingNodes in equality and contains.
  • Fix panic on negative slice indices that underflow after adjustment.
  • Fix stack overflow from circular alias in traverse.
  • Fix panic and OOM in repeatString for large repeat counts.

• update to v4.52.5

  • Fix: reset TOML decoder state between files.
  • Fix: preserve original filename when using --front-matter.

• Integrate vulnchecker support into %check stage (optional: set %%_with_vulncheck 1).

• Fix CVE-2026-33814 (bsc#1266248):

  • update golang.org/x/net to v0.53.0.

• update to 4.52.4:

  • Dropping windows/arm - no longer supported in cross-compile
  • Fixing comments in TOML arrays
  • Bumped dependencies

• update to 4.52.2:

  • Fixed bad instructions file breaking go-install (#2587) Thanks @theyoprst
  • Fixed TOML table scope after comments (#2588) Thanks @tomers
  • Multiply uses a readonly context
  • Fixed merge globbing wildcards in keys
  • Fixing TOML subarray parsing issue

• update to 4.52.1:

  • TOML encoder support - you can now roundtrip! #1364
  • Parent now supports negative indices, and added a 'root' command for referencing the top level document
  • Fixed scalar encoding for HCL
  • Add --yaml-compact-seq-indent / -c flag for compact sequence indentation (#2583) Thanks @jfenal
  • Add symlink check to file rename util (#2576) Thanks @Elias- elastisys
  • Powershell fixed default command used for __completeNoDesc alias (#2568) Thanks @teejaded
  • Unwrap scalars in shell output mode. (#2548) Thanks @flintwinters
  • Added K8S KYAML output format support (#2560) Thanks @robbat2

• update to 4.50.1:

  • Added HCL Support - First cut - hopefully it works well!
  • Fixing handling of CRLF #2352

• update to 4.49.2:

  • Fixing escape character bugs :sweat: #2517
  • Fixing snap release pipeline #2518 Thanks @aalexjo

• update to 4.49.1:

  • Added --security flags to disable env and file ops #2515
  • Fixing TOML ArrayTable parsing issues #1758
  • Fixing parsing of escaped characters #2506

• update to 4.48.2:

  • Strip whitespace when decoding base64 #2507
  • Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)
  • Add linux/loong64 to release target (thanks @znley)
  • Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx)

• update to 4.48.1:

  • Added 'parents' operator, to return a list of all the hierarchical parents of a node
  • Added 'first(exp)' operator, to return the first entry matching an expression in an array
  • Fixed xml namespace prefixes #1730 (thanks @baodrate)
  • Fixed out of range panic in yaml decoder #2460 (thanks @n471d)
  • Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540) CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by updating golang.org/x/net to v0.46.0.

• update to 4.47.2:

  • Conversion from TOML to JSON no longer omits empty tables #2459 (thanks @louislouislouislouis)

• update to 4.47.1:

  • Fixed merge anchor behaviour (<<); #2404, #2110, #2386, #2178 Huge thanks to @stevenwdv!

• Fix zsh completion location

• update to 4.46.1:

  • Added INI support
  • Fixed 'add' operator when piped in with no data #2378, #2383, #2384
  • Fixed delete after slice problem (bad node path) #2387 Thanks @antoinedeschenes
  • Fixed yq small build Thanks @imzue
  • Switched to YAML org supported go-yaml!

• update to 4.45.4:

  • Fixing wrong map() behaviour on empty map #2359

• update to 4.45.3:

  • Fixing regression (#2353, #2359, #2325) introduced with in 4.45.2 with #2325 fix

• update to 4.45.2:

  • Added windows arm builds (Thanks @albertocavalcante, @ShukantPal)
  • Added s390x platform support (Thanks @ashokpariya0)
  • Additionally push docker images to ghcr.io (Thanks @reegnz)
  • Fixing add when there is no node match #2325
  • sort_by works on maps
  • Fixed CVE-2025-22872 (GO-2025-3595) (bsc#1241719) by updating golang.org/x/net to 0.39.0.

• update to 4.45.1:

  • Create parent directories when --split-exp is used, Thanks @rudo-thomas

• Updated to 4.44.6:

  • Fixed deleting items in array bug #2027, #2172; Thanks @jandubois
  • Docker image for armv7 / raspberry pi3, Thanks @brianegge
  • Fixed no-colors regression #2218
  • Fixed various panic scenarios #2211
  • Bumped dependencies

• Changes from 4.44.5 (4.44.4 was skipped)

  • Format comments with a gray foreground (Thanks @gabe565)
  • Fixed handling of nulls with sort_by expressions #2164
  • Force no color output when NO_COLOR env presents (Thanks @narqo)
  • Fixed array subtraction update bug #2159
  • Fixed index out of range error
  • Can traverse straight from parent operator (parent.blah)
  • Bumped dependencies

• Bumped x/net to 0.33.0 to fix CVE-2024-45338