jq CVE-2026-43895

Update jq to the patched version released after 1.8.1 (exact version to be confirmed from GitHub security advisory GHSA-7q7g-mrq3-phxr at https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr). As an immediate compensating control, restrict filesystem permissions to prevent local users from accessing sensitive files that jq might load, enforce SELinux or AppArmor policies to limit jq's file access regardless of path resolution, and audit jq scripts for NUL byte usage (grep for '\x00', '\000', or null bytes in import statements). If jq must process untrusted scripts, run it in a strict chroot or container with minimal filesystem visibility. Note that these controls do not address the root cause but reduce exploitability.