--- upstream
+++ pr
@@ -1,44 +1,41 @@
-From 33b3a68f9c32413cf3a1afa76addf0dd64c2922b Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Tue, 4 Nov 2025 21:21:21 +0900
-Subject: [PATCH] Fix expected value assertion (fix #3430, ref #3393) (#3431)
-
----
- src/jq_test.c | 16 +++++++++-------
- 1 file changed, 9 insertions(+), 7 deletions(-)
-
-diff --git a/src/jq_test.c b/src/jq_test.c
-index a0120b7f3c..4a0bfe0d60 100644
---- a/src/jq_test.c
-+++ b/src/jq_test.c
-@@ -2,7 +2,6 @@
- #include <stdio.h>
- #include <string.h>
- #include <stdlib.h>
--#include <math.h>
- #ifdef HAVE_PTHREAD
- #include <pthread.h>
- #endif
-@@ -200,13 +199,16 @@ static void run_jq_tests(jv lib_dirs, int verbose, FILE *testdata, int skip, int
-         pass = 0;
-       }
- #ifdef USE_DECNUM
--      if (!(jv_get_kind(expected) == JV_KIND_NUMBER && isnan(jv_number_value(expected)))) {
--        jv as_string = jv_dump_string(jv_copy(expected), rand() & ~(JV_PRINT_COLOR|JV_PRINT_REFCOUNT));
--        jv reparsed = jv_parse_sized(jv_string_value(as_string), jv_string_length_bytes(jv_copy(as_string)));
--        assert(jv_equal(jv_copy(expected), jv_copy(reparsed)));
--        jv_free(as_string);
--        jv_free(reparsed);
-+      jv as_string = jv_dump_string(jv_copy(expected), 0);
-+      jv reparsed = jv_parse_sized(jv_string_value(as_string), jv_string_length_bytes(jv_copy(as_string)));
-+      if (!jv_equal(jv_copy(expected), jv_copy(reparsed))) {
-+        printf("*** Expected result should be equal after reparsing, but got ");
-+        jv_dump(jv_copy(reparsed), 0);
-+        printf(" for test at line %u: %s\n", lineno, buf);
-+        pass = 0;
-       }
-+      jv_free(as_string);
-+      jv_free(reparsed);
- #endif
-       jv_free(expected);
-       jv_free(actual);
+diff --git a/SPECS/jq/CVE-2025-9403.patch b/SPECS/jq/CVE-2025-9403.patch
+new file mode 100644
+index 00000000000..0ff9b3a8a31
+--- /dev/null
++++ b/SPECS/jq/CVE-2025-9403.patch
+@@ -0,0 +1,35 @@
++From 33b3a68f9c32413cf3a1afa76addf0dd64c2922b Mon Sep 17 00:00:00 2001
++From: itchyny <itchyny@cybozu.co.jp>
++Date: Tue, 4 Nov 2025 21:21:21 +0900
++Subject: [PATCH] Fix expected value assertion (fix #3430, ref #3393) (#3431)
++
++Upstream patch reference: https://github.com/jqlang/jq/commit/33b3a68f9c32413cf3a1afa76addf0dd64c2922b.patch
++
++---
++ src/jq_test.c | 9 +++++++--
++ 1 file changed, 7 insertions(+), 2 deletions(-)
++
++diff --git a/src/jq_test.c b/src/jq_test.c
++index 3945686..9fa370a 100644
++--- a/src/jq_test.c
+++++ b/src/jq_test.c
++@@ -208,9 +208,14 @@ static void run_jq_tests(jv lib_dirs, int verbose, FILE *testdata, int skip, int
++         printf(" for test at line number %u: %s\n", lineno, prog);
++         pass = 0;
++       }
++-      jv as_string = jv_dump_string(jv_copy(expected), rand() & ~(JV_PRINT_COLOR|JV_PRINT_REFCOUNT));
+++      jv as_string = jv_dump_string(jv_copy(expected), 0);
++       jv reparsed = jv_parse_sized(jv_string_value(as_string), jv_string_length_bytes(jv_copy(as_string)));
++-      assert(jv_equal(jv_copy(expected), jv_copy(reparsed)));
+++      if (!jv_equal(jv_copy(expected), jv_copy(reparsed))) {
+++        printf("*** Expected result should be equal after reparsing, but got ");
+++        jv_dump(jv_copy(reparsed), 0);
+++        printf(" for test at line %u: %s\n", lineno, buf);
+++        pass = 0;
+++      }
++       jv_free(as_string);
++       jv_free(reparsed);
++       jv_free(expected);
++-- 
++2.45.4
++