jq: baixar versions anteriors

This is a patch release with security fixes and bug fixes since 1.8.1, along with new builds for Windows arm64 and Docker arm/v7.
Security fixes
- CVE-2026-32316: Fix heap buffer overflow in jvp_string_append and jvp_string_copy_replace_bad. @itchyny e47e56d
- CVE-2026-33947: Limit path depth to prevent stack overflow in jv_setpath, jv_getpath, jv_delpaths. @itchyny fb59f14
- CVE-2026-33948: Fix NUL truncation in the JSON parser. @itchyny 6374ae0
- CVE-2026-39956: Fix _strindices missing runtime type checks. @tlsbollei fdf8ef0
- CVE-2026-39979: Fix out-of-bounds read in jv_parse_sized(). @wader 2f09060
- CVE-2026-40164: Randomize hash seed to mitigate hash collision DoS attacks. @AsafMeizner @itchyny 0c7d133
- CVE-2026-40612: Limit containment check depth to prevent stack overflow in contains. @itchyny d1a1256
- CVE-2026-41256: Fix NUL truncation in program files loaded with -f. @itchyny 5a015de
- CVE-2026-41257: Fix signed-int overflow in stack_reallocate. @itchyny 01b3cde
- CVE-2026-43894: Reject numeric literals longer than DEC_MAX_DIGITS (999999999). @itchyny 9761ceb
- CVE-2026-43895: Reject embedded NUL bytes in module import paths. @itchyny 9d223f1
- CVE-2026-43896: Limit recursive object merge depth to prevent stack overflow. @itchyny 532ccea
- CVE-2026-44777: Detect circular module imports to prevent stack overflow. @itchyny f58787c
- CVE-2026-47770: Guard deep structural equality and comparison recursion. @fuyu0425 7122866
- CVE-2026-49839: Fix heap-buffer-overflow in raw file loading. @itchyny e987df0
- CVE-2026-54679: Tighten string length bounds and propagate invalid jv in implode. @itchyny 46d1da3
- GHSA-gf4g-95wj-4q4r: Fix use-after-free in args2obj() array argument path. @sseal #3498
- GHSA-hj52-j2c9-r8r4: Fix signed-int overflow in tokenadd to prevent buffer overflow. @itchyny 63751f8
- Limit the number of function parameters and definitions to prevent SEGV. @OwenSanzas #3460
- Pre-allocate tokenbuf for string parser to avoid undefined behavior. @fab1ano #3485
- Avoid stack overflow when freeing deeply nested values. @itchyny 33d7bce
- Fix memory leaks and double frees. @itchyny #3487

Releasing
- Add builds for Windows arm64. @dennisameling #3376
- Support arm/v7 architecture in Docker images. @itchyny #3463
- Update GPG signing key. @itchyny 0ff997f
- Add artifact-metadata permission for actions/attest. @itchyny #3530
- Upload attestation bundle as a release artifact, allowing unauthenticated
verification via gh attestation verify --bundle jq-attestation.json.
@itchyny #3563

CLI changes
- Improve error message truncation with closing delimiters. @itchyny #3478
- Remove extra space from die function output. @krtk6160 #3391
- Fix raw input flag not to corrupt multi-byte characters. @itchyny #3421
- Fix crash when importing a module with errors twice. @itchyny #3497
- Increase the maximum printing depth from 256 to 10000. @ishnagy #3414

Changes to existing functions
- Fix rtrimstr("") always outputting "". @A4-Tacks #3415
- Fix infinite loop and undefined behavior in del(.[nan]). @itchyny #3490
- Refactor @uri and @urid to fix multi-byte UTF-8 corruption. @itchyny #3495
- Fix tonumber and toboolean to reject strings with embedded null bytes. @itchyny #3496
- Fix undefined behavior in modulo operator. @fab1ano #3486
- Fix reversed pointer subtraction in f_env bounds check. @itchyny #3465
- Fix missing validity check in f_strflocaltime after f_localtime. @itchyny #3491
- Fix year 2038 problem on 32-bit platforms. @itchyny #3407
- Use // instead of //= in from_entries definition. @itchyny #3516

Build and test changes
- Drop strptime test using non-portable %F. @alyssais #3365
- Limit oniguruma depth to 1024 in jq_fuzz_execute. @sudhackar #3377
- Fix localization test for time formatting functions. @itchyny #3409
- Fix expected value assertion. @itchyny #3431 #3408
- Fix typo in tests/jq.test. @bigmoonbit #3441
- Refactor tm2jv to handle fractional seconds. @itchyny #3489
- Fix jq_fuzz_parse_stream: use iterative

This is a patch release to fix security, performance, and build issues found in 1.8.0.
Full commit log can be found at jq-1.8.0...jq-1.8.1.
Security fixes
- CVE-2025-49014: Fix heap use after free in f_strftime, f_strflocaltime.
@wader 499c91b
- GHSA-f946-j5j2-4w5m: Fix stack overflow in node_min_byte_len of oniguruma.
@wader 5e159b3
CLI changes
- Fix assertion failure when syntax error happens at the end of the query. @itchyny #3350
Changes to existing functions
- Fix portability of strptime/1 especially for Windows. @itchyny #3342
Language changes
- Revert the change of reduce/foreach state variable in 1.8.0 (#3205).
This change was reverted due to serious performance regression. @itchyny #3349
Documentation changes
- Add LICENSE notice of NetBSD's strptime() to COPYING. @itchyny #3344
Build improvements
- Fix build on old Mac with old sed. @qianbinbin #3336

We are pleased to announce the release of version 1.8.0.
This release includes a number of improvements since the last version.
Note that some changes may introduce breaking changes to existing scripts,
so be sure to read the following information carefully.
Full commit log can be found at jq-1.7.1...jq-1.8.0.
Releasing
- Change the version number pattern to 1.X.Y (1.8.0 instead of 1.8). @itchyny #2999
- Generate provenance attestations for release artifacts and docker image. @lectrical #3225
gh attestation verify --repo jqlang/jq jq-linux-amd64
gh attestation verify --repo jqlang/jq oci://ghcr.io/jqlang/jq:1.8.0
Security fixes
- CVE-2024-23337: Fix signed integer overflow in jvp_array_write and jvp_object_rehash. @itchyny de21386
- The fix for this issue now limits the maximum size of arrays and objects to 536870912 (2^29) elements.
- CVE-2024-53427: Reject NaN with payload while parsing JSON. @itchyny a09a4df
- The fix for this issue now drops support for NaN with payload in JSON (like NaN123).
Other JSON extensions like NaN and Infinity are still supported.
- CVE-2025-48060: Fix heap buffer overflow in jv_string_vfmt. @itchyny c6e0416
- Fix use of uninitialized value in check_literal. @itchyny #3324
- Fix segmentation fault on strftime/1, strflocaltime/1. @itchyny #3271
- Fix unhandled overflow in @base64d. @emanuele6 #3080
CLI changes
- Fix --indent 0 implicitly enabling --compact-output. @amarshall @gbrlmarn @itchyny #3232
$ jq --indent 0 . <<< '{ "foo": ["hello", "world"] }'
{
"foo": [
"hello",
"world"
]
}
# Previously, this implied --compact-output, but now outputs with new lines.
- Improve error messages to show problematic position in the filter. @itchyny #3292
$ jq -n '1 + $foo + 2'
jq: error: $foo is not defined at <top-level>, line 1, column 5:
1 + $foo + 2
^^^^
jq: 1 compile error
- Include column number in parser and compiler error messages. @liviubobocu #3257
- Fix error message for string literal beginning with single quote. @mattmeyers #2964
$ jq .foo <<< "{'foo':'bar'}"
jq: parse error: Invalid string literal; expected ", but got ' at line 1, column 7
# Previously, the error message was Invalid numeric literal at line 1, column 7.
- Improve JQ_COLORS environment variable to support larger escapes like truecolor. @SArpnt #3282
JQ_COLORS="38;2;255;173;173:38;2;255;214;165:38;2;253;255;182:38;2;202;255;191:38;2;155;246;255:38;2;160;196;255:38;2;189;178;255:38;2;255;198;255" jq -nc '[null,false,true,42,{"a":"bc"}]'
- Add --library-path long option for -L. @thaliaarchi #3194
- Fix --slurp --stream when input has no trailing newline character. @itchyny #3279
- Fix --indent option to error for malformed values. @thaliaarchi #3195
- Fix option parsing of --binary on non-Windows platforms. @calestyo #3131
- Fix issue with ~/.jq on Windows where $HOME is not set. @kirkoman #3114
- Fix broken non-Latin output in the command help on Windows. @itchyny #3299
- Increase the maximum parsing depth for JSON to 10000. @itchyny #3328
- Parse short options in order given. @thaliaarchi #3194
- Consistently reset color formatting. @thaliaarchi #3034
New functions
- Add trim/0, ltrim/0 and rtrim/0 to trim leading and trailing white spaces. @wader #3056
$ jq -n '" hello " | trim, ltrim, rtrim'
"hello"
"hello "
" hello"
- Add trimstr/1 to trim string from both ends. @gbrlmarn #3319
$ jq -n '"foobarfoo" | trimstr("foo")'
"bar"
- Add add/1. Generator variant of add/0. @myaaaaaaaaa #3144
$ jq -c '.sum = add(.xs[])' <<< '{"xs":[1,2,3]}'
{"xs":[1,2,3],"sum":6}
- Add skip/2 as the counterpart to limit/2. @itchyny #3181
$ jq -nc '[1,2,3,4,5] | [skip(2; .[])]'
[3,4,5]
- Add toboolean/0 to convert strings to booleans. @brahmlower @itchyny #2098
$ jq -n '"true", "false" | toboolean'
true
false
- Add @urid format. Reverse of @uri. @fmgornick #3161
$ jq -Rr '@urid' <<< '%6a%71'
jq
Changes to existing functions
- Use code point index for indices/1, index/1 and rindex/1. @wader #3065
- This is a breaking change. Use utf8bytelength/0 to get byte ind

Security
- CVE-2023-50246: Fix heap buffer overflow in jvp\_literal\_number\_literal
- CVE-2023-50268: fix stack-buffer-overflow if comparing nan with payload
CLI changes
- Make the default background color more suitable for bright backgrounds. @mjarosie @taoky @nicowilliams @itchyny #2904
- Allow passing the inline jq script after --. @emanuele6 #2919
- Restrict systems operations on OpenBSD and remove unused mkstemp. @klemensn #2934
- Fix possible uninitialised value dereference if jq_init() fails. @emanuele6 @nicowilliams #2935
Language changes
- Simplify paths/0 and paths/1. @asheiduk @emanuele6 #2946
- Reject U+001F in string literals. @torsten-schenk @itchyny @wader #2911
- Remove unused nref accumulator in block_bind_library. @emanuele6 #2914
- Remove a bunch of unused variables, and useless assignments. @emanuele6 #2914
- main.c: Remove unused EXIT\_STATUS\_EXACT option. @emanuele6 #2915
- Actually use the number correctly casted from double to int as index. @emanuele6 #2916
- src/builtin.c: remove unnecessary jv\_copy-s in type\_error/type\_error2. @emanuele6 #2937
- Remove undefined behavior caught by LLVM 10 UBSAN. @Gaelan @emanuele6 #2926
- Convert decnum to binary64 (double) instead of decimal64.
This makes jq behave like the JSON specification suggests and more similar to other languages. @wader @leonid-s-usov #2949
- Fix memory leaks on invalid input for ltrimstr/1 and rtrimstr/1. @emanuele6 #2977
- Fix memory leak on failed get for setpath/2. @emanuele6 #2970
- Fix nan from json parsing also for nans with payload that start with 'n'. @emanuele6 #2985
- Allow carriage return characters in comments. @emanuele6 #2942 #2984
Documentation changes
- Generate links in the man page. @emanuele6 #2931
- Standardize arch types to AMD64 & ARM64 from index page download dropdown. @owenthereal #2884
libjq
- Add extern C for C++. @rockwotj #2953
Build and test changes
- Fix incorrect syntax for checksum file. @kamontat @wader #2899
- Remove -dirty version suffix for windows release build. @itchyny #2888
- Make use of od in tests more compatible. @nabijaczleweli @emanuele6 @nicowilliams #2922
- Add dependabot. @yeikel #2889
- Extend fuzzing setup to fuzz parser and and JSON serializer. @DavidKorczynski @emanuele6 #2952
- Keep releasing executables with legacy names. @itchyny #2951
New Contributors
- @yeikel made their first contribution in #2889
- @dependabot made their first contribution in #2894
- @kamontat made their first contribution in #2899
- @taoky made their first contribution in #2904
- @tboz203 made their first contribution in #2920
- @nabijaczleweli made their first contribution in #2922
- @klemensn made their first contribution in #2934
- @asheiduk made their first contribution in #2946
- @rockwotj made their first contribution in #2953
- @jesperronn made their first contribution in #2898

- jq now lives at <https://github.com/jqlang>
- New maintainers, admins, and owners have been recruited.
- A list of current maintainers
- NEWS file is replaced by NEWS.md with Markdown format. @wader #2599
- CI, scan builds, release, website builds etc now use GitHub actions. @owenthereal @wader @itchyny #2596 #2603 #2620 #2723
- Lots of documentation improvements and fixes.
- Website updated with new section search box, better section ids for linking, dark mode, etc. @itchyny #2628
- Release builds for:
- Linux amd64, arm64, armel, armhf, i386, mips, mips64, mips64el, mips64r6, mips64r6el, mipsel, mipsr6, mipsr6el, powerpc, ppc64el, riscv64 and s390x
- macOS amd64 and arm64
- Windows i386 and amd64
- Docker linux/386, linux/amd64, linux/arm64, linux/mips64le, linux/ppc64le, linux/riscv64 and linux/s390x
- More details see @owenthereal #2665
- Docker images are now available from ghcr.io/jqlang/jq instead of Docker Hub. @itchyny #2652 #2686
- OSS-fuzz. @DavidKorczynski #2760 #2762
CLI changes
- Make object key color configurable using JQ_COLORS environment variable. @itchyny @haguenau @ericpruitt #2703
- Change the default color of null to Bright Black. @itchyny #2824
- Respect NO_COLOR environment variable to disable color output.
See <https://no-color.org> for details. @itchyny #2728
- Improved --help output.
Now mentions all options and nicer order. @itchyny @wader #2747 #2766 #2799
- Fix multiple issues of exit code using --exit-code/-e option. @ryo1kato #1697
- Add --binary/-b on Windows for binary output.
To get \n instead of \r\n line endings. @nicowilliams 0dab2b1
- Add --raw-output0 for NUL (zero byte) separated output. @asottile @pabs3 @itchyny #1990 #2235 #2684
- Fix assert crash and validate JSON for --jsonarg. @wader #2658
- Remove deprecated --argfile option. @itchyny #2768
- Enable stack protection. @nicowilliams #2801
Language changes
- Use decimal number literals to preserve precision.
Comparison operations respects precision but arithmetic operations might truncate. @leonid-s-usov #1752
- Adds new builtin pick(stream) to emit a projection of the input object or array. @pkoppstein #2656 #2779
- Adds new builtin debug(msgs) that works like debug but applies a filter on the input before writing to stderr. @pkoppstein #2710
- Adds new builtin scan($re; $flags).
Was documented but not implemented. @itchyny #1961
- Adds new builtin abs to get absolute value.
This potentially allows the literal value of numbers to be preserved as length and fabs convert to float. @pkoppstein #2767
- Allow if without else-branch.
When skipped the else-branch will be . (identity). @chancez @wader #1825 #2481
- Allow use of $binding as key in object literals. @nicowilliams 8ea4a55
- Allow dot between chained indexes when using .["index"] @nicowilliams #1168
- Allow dot for chained value iterator .[], .[]? @wader #2650
- Fix try/catch catches more than it should. @nicowilliams #2750
- Speed up and refactor some builtins, also remove scalars_or_empty/0. @muhmuhten #1845
- Now halt and halt_error exit immediately instead of continuing to the next input. @emanuele6 #2667
- Fix issue converting string to number after previous convert error. @thalman #2400
- Fix issue representing large numbers on some platforms causing invalid JSON output. @itchyny #2661
- Fix deletion using assigning empty against arrays. @itchyny #2133
- Allow keywords to be used as binding name in more places. @emanuele6 #2681
- Allow using nan as NaN in JSON. @emanuele6 #2712
- Expose a module's function names in modulemeta. @mrwilson #2837
- Fix contains/1 to handle strings with NUL. @nicowilliams 61cd6db
- Fix stderr/0 to output raw text without any decoration. @itchyny #2751
- Fix nth/2 to emit empty on index out of range. @itchyny #2674
- Fix implode to not assert and instead replace invalid unicode codepoints. @wader #2646
- Fix indices/1 and rindex/1 in case of overlapping matches in strings. @emanuele6 #2718
- Fix sub/3 to resolve issues involving global search-