Description of the patch:
This update for yq fixes the following issues:
Changes in yq:
Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good (bsc#1267199).
update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix: decode properties array bracket paths. Fix: preserve floats with trailing zero when encoding YAML to JSON. Fix: JSON to TOML root scope and null handling. Fix: reset TOML decoder finished flag on Init for multi-doc evaluation. Fix: reset TOML decoder between files when evaluating all at once. Fix: preserve TOML inline table array scope. Fix: preserve empty TOML arrays in tables Fix: TOML encoder uses inline tables for YAML FlowStyle mappings. Fix nested inline YAML merge explode. Fix repeatString overflow test on 32-bit platforms.
Fix CVE-2026-56852 (GO-2026-5970) (bsc#1271994): A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
4.53.3-bp160.1.14.53.3-bp160.1.14.53.3-bp160.1.14.53.3-bp160.1.1Exploitability
AV:NAC:HPR:NUI:NScope
S:UImpact
C:HI:HA:N7.4/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N