Skip to content

chore(deps): bump github.com/tomwright/dasel/v3 from 3.10.1 to 3.11.1 - #1189

Closed
dependabot[bot] wants to merge 1 commit into
v3from
dependabot/go_modules/github.com/tomwright/dasel/v3-3.11.1
Closed

dependabot[bot] wants to merge 1 commit into
v3from
dependabot/go_modules/github.com/tomwright/dasel/v3-3.11.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/tomwright/dasel/v3 from 3.10.1 to 3.11.1.

Release notes

Sourced from github.com/tomwright/dasel/v3's releases.

v3.11.1

Full Changelog: TomWright/dasel@v3.11.0...v3.11.1

v3.11.0

What's Changed

Full Changelog: TomWright/dasel@v3.10.1...v3.11.0

Changelog

Sourced from github.com/tomwright/dasel/v3's changelog.

[v3.11.1] - 2026-06-20

Security

  • Fixed stack overflow (unrecoverable fatal error) in the JSON and XML readers when parsing deeply nested input (GHSA-cqxr-jxr2-85pq). Both readers now enforce a 10,000-level nesting depth limit and return a clean error (ErrJSONMaxDepthExceeded / ErrXMLMaxDepthExceeded) instead of crashing the process.

[v3.11.0] - 2026-05-19

Added

  • Support for newline-delimited JSON (NDJSON) input. Multiple JSON values in a single input are now parsed as a multi-document branch, matching the existing YAML multi-document behaviour.

Fixed

  • Strip leading "v" from version output for consistency across build methods (Docker vs Homebrew).
Commits
  • 5d609b8 Update CHANGELOG for v3.11.1 release
  • 4c91d0d Merge commit from fork
  • abc1e1d Update CHANGELOG for v3.11.0 release
  • e0bb4c0 Support newline-delimited JSON (NDJSON) input (#548)
  • dd41a97 Update CHANGELOG with version prefix fix
  • 8015335 Strip leading "v" from version output for consistency
  • a120e1a Add KDL to supported formats in README and man page
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/tomwright/dasel/v3](https://github.com/tomwright/dasel) from 3.10.1 to 3.11.1.
- [Release notes](https://github.com/tomwright/dasel/releases)
- [Changelog](https://github.com/TomWright/dasel/blob/master/CHANGELOG.md)
- [Commits](TomWright/dasel@v3.10.1...v3.11.1)

---
updated-dependencies:
- dependency-name: github.com/tomwright/dasel/v3
  dependency-version: 3.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 22, 2026
@github-actions

Copy link
Copy Markdown

Before this is reviewed, please read the AI-Assisted Contributions section of the contributing guide and make sure this change meets it: you can explain every line, the description is your own and brief, it fixes a bug you hit or a feature agreed in an issue, it does not touch undocumented options, and any substantial tool use is noted.

@dependabot @github

dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1190.

@dependabot dependabot Bot closed this Sep 22, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/tomwright/dasel/v3-3.11.1 branch September 22, 2026 19:53
@github-actions github-actions Bot locked and limited conversation to collaborators Sep 22, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants