jq CVE-2026-44777

Upgrade jq to version 1.8.2 or later once released by the jqlang project. Immediate patch availability is not confirmed from input data; check the GitHub security advisory at https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9 for the exact patched release version and timeline. As a temporary workaround for systems processing untrusted jq scripts, disable the module loading feature by running jq with appropriate command-line flags (if available in your version) or sandboxing execution in containers with strict resource limits (memory and CPU cgroups) to prevent denial of service. For web services accepting user-supplied jq filters, implement a whitelist of allowed jq operations and explicitly disable or restrict the import/include directives; note this may break legitimate module-based workflows. Run jq processes with resource limits (ulimit -m, ulimit -s) to cap memory and stack usage, mitigating (but not preventing) the infinite recursion impact.