chore(deps): update dependency mikefarah/yq to v4.54.3 #28

Merged

CSRBot merged 1 commits from renovate/mikefarah-yq-4.x into master 2026-11-09 18:50:52 +01:00

Conversation 0 Commits 1 Files Changed 3

+3 -3

CSRBot commented 2026-11-09 18:14:59 +01:00

Collaborator

Copy link

Copy source

This PR contains the following updates:

Package	Update	Change
mikefarah/yq	patch	v4.54.1 → v4.54.3

---

Release Notes

mikefarah/yq (mikefarah/yq)

v4.54.3

Compare Source

• Fixed preservation of YAML aliases across documents within the same input stream, without leaking anchors between files (#​2956) Thanks @​ingydotnet
  • Restricted --split-exp output paths to the current directory by default. Use --security-allow-write-any-path with trusted input to restore the previous behaviour (#​2965)
  • Fixed --inplace to reject direct updates to read-only files and replace symbolic links instead of modifying their targets. (#​2973)

v4.54.2

Compare Source

• Fixed command injection risk in shell output with -o=shell -r: unsafe values are now quoted and a warning is logged. Use --security-force-never-escape-shell-output to restore the previous unsafe behaviour (GHSA-h2cv-65fq-jgrp)
  • Fixed YAML structure being changed when assigning head comments (#​2847) Thanks @​rootsec1
  • Fixed ireduce to run per pipeline input, matching jq's reduce behaviour (#​2869) Thanks @​00200200
  • Fixed map_values to remove entries when the expression returns nothing (#​2862) Thanks @​yuefdev
  • Fixed preservation of comments on TOML inline table values (#​2879) Thanks @​iamhuman-cheolheelee
  • Fixed INI keys containing colons (#​2886)
  • Fixed YAML line numbers after header preprocessing (#​2939) Thanks @​imharjot
  • Fixed an extra leading comment blank line with CRLF input (#​2856) Thanks @​cestercian
  • Cleaned up failed in-place edits (#​2920) Thanks @​Boulea7
  • Bumped dependencies

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mikefarah/yq](https://github.com/mikefarah/yq) | patch | `v4.54.1` → `v4.54.3` | --- ### Release Notes <details> <summary>mikefarah/yq (mikefarah/yq)</summary> ### [`v4.54.3`](https://github.com/mikefarah/yq/releases/tag/v4.54.3) [Compare Source](https://github.com/mikefarah/yq/compare/v4.54.2...v4.54.3) - Fixed preservation of YAML aliases across documents within the same input stream, without leaking anchors between files ([#&#8203;2956](https://github.com/mikefarah/yq/issues/2956)) Thanks [@&#8203;ingydotnet](https://github.com/ingydotnet) - Restricted `--split-exp` output paths to the current directory by default. Use `--security-allow-write-any-path` with trusted input to restore the previous behaviour ([#&#8203;2965](https://github.com/mikefarah/yq/issues/2965)) - Fixed `--inplace` to reject direct updates to read-only files and replace symbolic links instead of modifying their targets. ([#&#8203;2973](https://github.com/mikefarah/yq/issues/2973)) ### [`v4.54.2`](https://github.com/mikefarah/yq/releases/tag/v4.54.2) [Compare Source](https://github.com/mikefarah/yq/compare/v4.54.1...v4.54.2) - Fixed command injection risk in shell output with `-o=shell -r`: unsafe values are now quoted and a warning is logged. Use `--security-force-never-escape-shell-output` to restore the previous unsafe behaviour (GHSA-h2cv-65fq-jgrp) - Fixed YAML structure being changed when assigning head comments ([#&#8203;2847](https://github.com/mikefarah/yq/issues/2847)) Thanks [@&#8203;rootsec1](https://github.com/rootsec1) - Fixed `ireduce` to run per pipeline input, matching jq's `reduce` behaviour ([#&#8203;2869](https://github.com/mikefarah/yq/issues/2869)) Thanks [@&#8203;00200200](https://github.com/00200200) - Fixed `map_values` to remove entries when the expression returns nothing ([#&#8203;2862](https://github.com/mikefarah/yq/issues/2862)) Thanks [@&#8203;yuefdev](https://github.com/yuefdev) - Fixed preservation of comments on TOML inline table values ([#&#8203;2879](https://github.com/mikefarah/yq/issues/2879)) Thanks [@&#8203;iamhuman-cheolheelee](https://github.com/iamhuman-cheolheelee) - Fixed INI keys containing colons ([#&#8203;2886](https://github.com/mikefarah/yq/issues/2886)) - Fixed YAML line numbers after header preprocessing ([#&#8203;2939](https://github.com/mikefarah/yq/issues/2939)) Thanks [@&#8203;imharjot](https://github.com/imharjot) - Fixed an extra leading comment blank line with CRLF input ([#&#8203;2856](https://github.com/mikefarah/yq/issues/2856)) Thanks [@&#8203;cestercian](https://github.com/cestercian) - Cleaned up failed in-place edits ([#&#8203;2920](https://github.com/mikefarah/yq/issues/2920)) Thanks [@&#8203;Boulea7](https://github.com/Boulea7) - Bumped dependencies </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTYuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjExNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSJdfQ==-->

CSRBot added 1 commit 2026-11-09 18:14:59 +01:00

chore(deps): update dependency mikefarah/yq to v4.54.3 8e2f86fbb4

CODEOWNERS rules requested review from volker.raschek 2026-11-09 18:15:00 +01:00

CSRBot scheduled this pull request to auto merge when all checks succeed 2026-11-09 18:15:02 +01:00

CSRBot merged commit 00c8d25331 into master 2026-11-09 18:50:52 +01:00

CSRBot deleted branch renovate/mikefarah-yq-4.x 2026-11-09 18:50:53 +01:00

Sign in to join this conversation.

Reviewers

No Reviewers

volker.raschek

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

CSRBot (CSRBot) volker.raschek (Markus Pesch)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/ah-annotations#28