[dependabot]

Bumps github.com/itchyny/gojq from 0.12.17 to 0.12.19.

Release notes

Sourced from github.com/itchyny/gojq's releases.

Release v0.12.19

• fix gsub and sub when the replacement emits multiple values
• fix fmax, fmin, modf functions against NaN and infinities
• fix join/1 to use add/0 implementation and handle null separator
• fix del and delpaths on null to emit null
• fix arithmetic operations on the minimum integer
• fix significand function against subnormal numbers
• fix handling of -- in cli flag parsing for jq compatibility
• fix flatten/1 to emit error when the depth is NaN
• fix array slice update to validate index types
• fix string repetition boundary check to match jq behavior
• implement splits/2 using match/2 for better jq compatibility
• implement to_entries and from_entries in jq for simplicity
• improve performance of regexp functions by caching compiled regexps

Release v0.12.18

• implement trimstr/1, toboolean/0 function
• fix last/1 to be included in builtins/0
• fix --indent 0 to preserve newlines
• fix string repetition to emit error when the result is too large
• increase the array index limit to 536870912 (2^29)
• stop numeric normalization for concurrent execution (see 1ace748d08df)
• support binding expressions with binary operators (1 + 2 as $x | -$x)
• improve gojq.NewIter to be a generic function
• improve logic for getting file contents on JSON parse error
• improve JSON parsing to preserve the precision of floating-point numbers
• improve YAML parsing performance and preserve the precision of large integers
• improve performance and reduce memory allocation of long-running queries

Changelog

Sourced from github.com/itchyny/gojq's changelog.

v0.12.19 (2026-04-01)

• fix gsub and sub when the replacement emits multiple values
• fix fmax, fmin, modf functions against NaN and infinities
• fix join/1 to use add/0 implementation and handle null separator
• fix del and delpaths on null to emit null
• fix arithmetic operations on the minimum integer
• fix significand function against subnormal numbers
• fix handling of -- in cli flag parsing for jq compatibility
• fix flatten/1 to emit error when the depth is NaN
• fix array slice update to validate index types
• fix string repetition boundary check to match jq behavior
• implement splits/2 using match/2 for better jq compatibility
• implement to_entries and from_entries in jq for simplicity
• improve performance of regexp functions by caching compiled regexps

v0.12.18 (2025-12-02)

• implement trimstr/1, toboolean/0 function
• fix last/1 to be included in builtins/0
• fix --indent 0 to preserve newlines
• fix string repetition to emit error when the result is too large
• increase the array index limit to 536870912 (2^29)
• stop numeric normalization for concurrent execution (see 1ace748d08df)
• support binding expressions with binary operators (1 + 2 as $x | -$x)
• improve gojq.NewIter to be a generic function
• improve logic for getting file contents on JSON parse error
• improve JSON parsing to preserve the precision of floating-point numbers
• improve YAML parsing performance and preserve the precision of large integers
• improve performance and reduce memory allocation of long-running queries

Commits

• b7ebffb bump up version to 0.12.19
• b02c97b update CHANGELOG.md for v0.12.19
• d7ca9b5 implement to_entries and from_entries in jq for simplicity
• bac8b0b update dependencies
• 183cbec bump up Docker actions
• 40707cf fix repeated argument type any
• b5ece86 fix handling of -- in cli flag parsing for jq compatibility
• cca2307 re-generate the parser.go file
• ca5066d fix gsub and sub when the replacement emits multiple values
• 0878958 improve performance of regexp functions by caching compiled regexps (fix #230)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Farjaad]

Dependency review: safe to merge

• Scope: github.com/itchyny/gojq 0.12.17 → 0.12.19. Only src/go.mod/src/go.sum change; no Go version change. Transitive bumps: timefmt-go 0.1.6 → 0.1.8 and go-runewidth 0.0.16 → 0.0.19. go-runewidth is only pulled in by changie/bubbletea, which are build tools, not part of the CLI.
• How we use it: Only opslevel graphql --aggregate (src/cmd/graphql.go): gojq.Parse → gojq.Compile → Code.Run. Input is decoded with encoding/json and output is encoded with json.Marshal, so gojq's own CLI, encoder and JSON/YAML parser are not used.
• Breaking changes: None that affect us. The 0.12.18 change that stops normalizing input numbers doesn't apply, because encoding/json already gives us float64. The --indent/-- fixes are in gojq's CLI. Changes users might notice in --aggregate, all of them fixes: join(null) no longer errors, fmax/fmin with NaN return values, 1 + 2 as $x | -$x now parses, and the from_entries error message is worded differently.
• Verification: The Tests workflow passed. Locally: go mod verify, go build ./... and go vet ./cmd/ passed. I also ran 40 representative --aggregate expressions through the same pipeline on 0.12.17 and 0.12.19 and compared the output: numbers, large integers, string functions, to_entries, @csv and error paths were identical apart from the fixes above. The cmd/e2e tests need an API token and weren't run.