[codesphere-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/mikefarah/yq/v4	v4.54.1 → v4.54.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

mikefarah/yq (github.com/mikefarah/yq/v4)

v4.54.3

Compare Source

• Fixed preservation of YAML aliases across documents within the same input stream, without leaking anchors between files (#​2956) Thanks @​ingydotnet
  • Restricted --split-exp output paths to the current directory by default. Use --security-allow-write-any-path with trusted input to restore the previous behaviour (#​2965)
  • Fixed --inplace to reject direct updates to read-only files and replace symbolic links instead of modifying their targets. (#​2973)

v4.54.2

Compare Source

• Fixed command injection risk in shell output with -o=shell -r: unsafe values are now quoted and a warning is logged. Use --security-force-never-escape-shell-output to restore the previous unsafe behaviour (GHSA-h2cv-65fq-jgrp)
  • Fixed YAML structure being changed when assigning head comments (#​2847) Thanks @​rootsec1
  • Fixed ireduce to run per pipeline input, matching jq's reduce behaviour (#​2869) Thanks @​00200200
  • Fixed map_values to remove entries when the expression returns nothing (#​2862) Thanks @​yuefdev
  • Fixed preservation of comments on TOML inline table values (#​2879) Thanks @​iamhuman-cheolheelee
  • Fixed INI keys containing colons (#​2886)
  • Fixed YAML line numbers after header preprocessing (#​2939) Thanks @​imharjot
  • Fixed an extra leading comment blank line with CRLF input (#​2856) Thanks @​cestercian
  • Cleaned up failed in-place edits (#​2920) Thanks @​Boulea7
  • Bumped dependencies

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[codesphere-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated

Details:

Package	Change
github.com/dimchansky/utfbom	v1.1.1 -> v1.2.0
github.com/goccy/go-json	v0.10.6 -> v0.12.0
go.yaml.in/yaml/v4	v4.0.0-rc.6 -> v4.0.0-rc.7
golang.org/x/crypto	v0.57.0 -> v0.58.0
golang.org/x/mod	v0.41.0 -> v0.42.0
golang.org/x/net	v0.59.0 -> v0.62.0
golang.org/x/sync	v0.23.0 -> v0.24.0
golang.org/x/sys	v0.48.0 -> v0.49.0
golang.org/x/text	v0.42.0 -> v0.43.0
golang.org/x/tools	v0.49.0 -> v0.51.0