{"schema_version":"1.7.5","id":"openSUSE-SU-2026:20892-1","published":"2026-06-02T17:45:41Z","modified":"2026-06-04T09:00:06.517568672Z","related":["CVE-2024-45338","CVE-2025-22872","CVE-2025-47911","CVE-2025-58190","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-33814","CVE-2026-39821","CVE-2026-42502","CVE-2026-42506"],"upstream":["CVE-2024-45338","CVE-2025-22872","CVE-2025-47911","CVE-2025-58190","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-33814","CVE-2026-39821","CVE-2026-42502","CVE-2026-42506"],"summary":"Security update for yq","details":"This update for yq fixes the following issues:\n\nChanges in yq:\n\n- Fix multiple CVEs:\n  * CVE-2026-27136 (GO-2026-5030)\n    CVE-2026-25681 (GO-2026-5029)\n    CVE-2026-25680 (GO-2026-5028)\n    CVE-2026-42502 (GO-2026-5027)\n    CVE-2026-42506 (GO-2026-5025) (bsc#1267053)\n    CVE-2026-39821 (GO-2026-5026) (bsc#1267199)\n\n- update to v4.53.2\n  * Add system(command; args) operator (disabled by default).\n  * TOML encoder: prefer readable table sections over inline tables.\n  * Fix TOML encoder to quote keys containing special characters.\n  * Add string slicing support.\n  * Fix findInArray misuse on MappingNodes in equality and contains.\n  * Fix panic on negative slice indices that underflow after adjustment.\n  * Fix stack overflow from circular alias in traverse.\n  * Fix panic and OOM in repeatString for large repeat counts.\n\n- update to v4.52.5\n  * Fix: reset TOML decoder state between files.\n  * Fix: preserve original filename when using --front-matter.\n\n- Integrate vulnchecker support into %check stage (optional: set `%%_with_vulncheck 1`).\n- Fix CVE-2026-33814 (bsc#1266248):\n  * update golang.org/x/net to v0.53.0.\n\n- update to 4.52.4:\n  * Dropping windows/arm - no longer supported in cross-compile\n  * Fixing comments in TOML arrays\n  * Bumped dependencies\n\n- update to 4.52.2:\n  * Fixed bad instructions file breaking go-install (#2587)\n    Thanks @theyoprst\n  * Fixed TOML table scope after comments (#2588) Thanks @tomers\n  * Multiply uses a readonly context\n  * Fixed merge globbing wildcards in keys\n  * Fixing TOML subarray parsing issue\n\n- update to 4.52.1:\n  * TOML encoder support - you can now roundtrip! #1364\n  * Parent now supports negative indices, and added a 'root'\n    command for referencing the top level document\n  * Fixed scalar encoding for HCL\n  * Add --yaml-compact-seq-indent / -c flag for compact sequence\n    indentation (#2583) Thanks @jfenal\n  * Add symlink check to file rename util (#2576) Thanks @Elias-\n    elastisys\n  * Powershell fixed default command used for __completeNoDesc\n    alias (#2568) Thanks @teejaded\n  * Unwrap scalars in shell output mode. (#2548) Thanks\n    @flintwinters\n  * Added K8S KYAML output format support (#2560) Thanks @robbat2\n\n- update to 4.50.1:\n  * Added HCL Support - First cut - hopefully it works well!\n  * Fixing handling of CRLF #2352\n\n- update to 4.49.2:\n  * Fixing escape character bugs :sweat: #2517\n  * Fixing snap release pipeline #2518 Thanks @aalexjo\n\n- update to 4.49.1:\n  * Added `--security` flags to disable env and file ops #2515\n  * Fixing TOML ArrayTable parsing issues #1758\n  * Fixing parsing of escaped characters #2506\n\n- update to 4.48.2:\n  * Strip whitespace when decoding base64 #2507\n  * Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)\n  * Add linux/loong64 to release target (thanks @znley)\n  * Added --shell-key-separator flag for customizable shell\n    output format #2497 (thanks @rsleedbx)\n\n- update to 4.48.1:\n  * Added 'parents' operator, to return a list of all the\n    hierarchical parents of a node\n  * Added 'first(exp)' operator, to return the first entry\n    matching an expression in an array\n  * Fixed xml namespace prefixes #1730 (thanks @baodrate)\n  * Fixed out of range panic in yaml decoder #2460 (thanks\n    @n471d)\n  * Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540)\n          CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by\n    updating golang.org/x/net to v0.46.0.\n\n- update to 4.47.2:\n  * Conversion from TOML to JSON no longer omits empty tables\n    #2459 (thanks @louislouislouislouis)\n\n- update to 4.47.1:\n  * Fixed merge anchor behaviour (`<<`); #2404, #2110, #2386,\n    #2178 Huge thanks to @stevenwdv!\n\n- Fix zsh completion location\n\n- update to 4.46.1:\n  * Added INI support\n  * Fixed 'add' operator when piped in with no data #2378, #2383,\n    #2384\n  * Fixed delete after slice problem (bad node path) #2387 Thanks\n    @antoinedeschenes\n  * Fixed yq small build Thanks @imzue\n  * Switched to YAML org supported go-yaml!\n\n- update to 4.45.4:\n  * Fixing wrong map() behaviour on empty map #2359\n\n- update to 4.45.3:\n  * Fixing regression (#2353, #2359, #2325) introduced with in\n    4.45.2 with #2325 fix\n\n- update to 4.45.2:\n  * Added windows arm builds (Thanks @albertocavalcante,\n    @ShukantPal)\n  * Added s390x platform support (Thanks @ashokpariya0)\n  * Additionally push docker images to ghcr.io (Thanks @reegnz)\n  * Fixing add when there is no node match #2325\n  * sort_by works on maps\n  * Fixed CVE-2025-22872 (GO-2025-3595) (bsc#1241719) by\n     updating golang.org/x/net to 0.39.0.\n\n- update to 4.45.1:\n  * Create parent directories when --split-exp is used, Thanks\n    @rudo-thomas\n\n- Updated to 4.44.6:\n  * Fixed deleting items in array bug #2027, #2172; Thanks @jandubois\n  * Docker image for armv7 / raspberry pi3, Thanks @brianegge\n  * Fixed no-colors regression #2218\n  * Fixed various panic scenarios #2211\n  * Bumped dependencies\n\n- Changes from 4.44.5 (4.44.4 was skipped)\n  * Format comments with a gray foreground (Thanks @gabe565)\n  * Fixed handling of nulls with sort_by expressions #2164\n  * Force no color output when NO_COLOR env presents (Thanks @narqo)\n  * Fixed array subtraction update bug #2159\n  * Fixed index out of range error\n  * Can traverse straight from parent operator (parent.blah)\n  * Bumped dependencies\n\n- Bumped x/net to 0.33.0 to fix CVE-2024-45338\n","references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1241719"},{"type":"REPORT","url":"https://bugzilla.suse.com/1251339"},{"type":"REPORT","url":"https://bugzilla.suse.com/1251540"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266248"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267053"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267199"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-45338"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22872"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-47911"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58190"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25680"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25681"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27136"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33814"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42502"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42506"}]}