260511.1 · f58787c41835d9b17795730cb04925fdba25c71c

Detect circular module imports to prevent stack overflow

jq used to recurse without bound on mutual or self-referential `import` declarations, exhausting the stack. Track each library's load state with a `loading` flag set before its dependencies are processed; a recursive reference to an in-progress library now reports "circular import of X".

Fixes CVE-2026-44777.

new file mode 100644@@ -0,0 +1,2 @@+import "cycle_a" as a;+def f: null;