Skip to content

chore(deps): bump github.com/tomwright/dasel/v3 from 3.10.1 to 3.11.2 - #1190

Merged
jdkato merged 1 commit into
v3from
dependabot/go_modules/github.com/tomwright/dasel/v3-3.11.2
Sep 24, 2026
Merged

jdkato merged 1 commit into
v3from
dependabot/go_modules/github.com/tomwright/dasel/v3-3.11.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/tomwright/dasel/v3 from 3.10.1 to 3.11.2.

Release notes

Sourced from github.com/tomwright/dasel/v3's releases.

v3.11.2

Full Changelog: TomWright/dasel@v3.11.1...v3.11.2

v3.11.1

Full Changelog: TomWright/dasel@v3.11.0...v3.11.1

v3.11.0

What's Changed

Full Changelog: TomWright/dasel@v3.10.1...v3.11.0

Changelog

Sourced from github.com/tomwright/dasel/v3's changelog.

[v3.11.2] - 2026-06-27

Security

  • Fixed panic (index out of range) in the selector lexer when the input ends with whitespace, e.g. dasel query 'a ' (GHSA-65gg-g7rw-6cpc). The whitespace-skip loop could advance the position to the end of input, after which the next character access had no bounds check.

[v3.11.1] - 2026-06-20

Security

  • Fixed stack overflow (unrecoverable fatal error) in the JSON and XML readers when parsing deeply nested input (GHSA-cqxr-jxr2-85pq). Both readers now enforce a 10,000-level nesting depth limit and return a clean error (ErrJSONMaxDepthExceeded / ErrXMLMaxDepthExceeded) instead of crashing the process.

[v3.11.0] - 2026-05-19

Added

  • Support for newline-delimited JSON (NDJSON) input. Multiple JSON values in a single input are now parsed as a multi-document branch, matching the existing YAML multi-document behaviour.

Fixed

  • Strip leading "v" from version output for consistency across build methods (Docker vs Homebrew).
Commits
  • 008b0ed Update CHANGELOG
  • eee03ae Merge commit from fork
  • 5d609b8 Update CHANGELOG for v3.11.1 release
  • 4c91d0d Merge commit from fork
  • abc1e1d Update CHANGELOG for v3.11.0 release
  • e0bb4c0 Support newline-delimited JSON (NDJSON) input (#548)
  • dd41a97 Update CHANGELOG with version prefix fix
  • 8015335 Strip leading "v" from version output for consistency
  • a120e1a Add KDL to supported formats in README and man page
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/tomwright/dasel/v3](https://github.com/tomwright/dasel) from 3.10.1 to 3.11.2.
- [Release notes](https://github.com/tomwright/dasel/releases)
- [Changelog](https://github.com/TomWright/dasel/blob/master/CHANGELOG.md)
- [Commits](TomWright/dasel@v3.10.1...v3.11.2)

---
updated-dependencies:
- dependency-name: github.com/tomwright/dasel/v3
  dependency-version: 3.11.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 22, 2026
@github-actions

Copy link
Copy Markdown

Before this is reviewed, please read the AI-Assisted Contributions section of the contributing guide and make sure this change meets it: you can explain every line, the description is your own and brief, it fixes a bug you hit or a feature agreed in an issue, it does not touch undocumented options, and any substantial tool use is noted.

@jdkato
jdkato merged commit 123e3f9 into v3 Sep 24, 2026
11 of 12 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/tomwright/dasel/v3-3.11.2 branch September 24, 2026 18:30
@github-actions github-actions Bot locked and limited conversation to collaborators Sep 24, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant