Debian published a jq regression update on September 25, 2026, after an earlier security fix disrupted some module-loading workflows. The corrected package is available for Debian 13 “Trixie.” Administrators who use jq in scripts should update promptly, then test jobs that import modules through other modules.
What broke after the earlier jq security fix?
The Debian Security Team’s new advisory, DSA-6416-2, says a fix for CVE-2026-44777 changed the order in which jq registered libraries and their dependencies. A module reached only through another module—a transitive import or include—could be treated as unreferenced. In that case, jq stopped with an assertion failure while compiling the filter.
This is a regression in functionality, not a new claim that the earlier security flaw returned. A simple jq command that does not load modules may not show the problem. Teams with shared filter libraries, build scripts, or data-processing pipelines have more reason to check.
The corrected Debian 13 package
For stable Debian 13, the advisory names jq 1.7.1-6+deb13u4 as the fixed version. The earlier DSA-6416-1 security update used 1.7.1-6+deb13u3. Debian recommends upgrading jq. Its security advisory index lists the September 25 regression notice alongside other current updates.
Use your configured Debian repositories rather than downloading an arbitrary package from another release. Run sudo apt update, then sudo apt install --only-upgrade jq. Afterward, check the installed version with dpkg-query -W jq. Package suffixes matter here because the correction is specific to the Debian stable build.
What to test after patching
Run a real module chain
Choose a jq command from your own environment that imports a module which itself imports another. Run it with representative input and confirm that it compiles and returns the expected output. A test that only calls jq . is too shallow to exercise the reported regression.
Check scheduled jobs and downstream distributions
Review cron jobs, CI tasks, and services that call jq. If they failed after the prior security update, re-run them after installing the corrected build. Keep a sample of the previous error so you can distinguish this regression from an unrelated data or syntax problem.
Debian-based distributions have their own package channels and release timing. Our MX Linux 25.3 coverage explains its Debian 13.7 base. That connection does not mean MX users should install a Debian package directly; they should check their distribution’s repository and advisory first.
The immediate lesson is operational: a security update can fix a vulnerability yet affect a narrow workflow. Debian’s follow-up provides a corrected package, and a focused test of module imports confirms whether your scripts recovered.