Dynamic TOML badge no longer works with poetry.lock

[ReubenFrankel]

Are you experiencing an issue with...

shields.io

🐞 Description

I've been using the dynamic TOML badge to get a package version out of a poetry.lock file. Previously, this worked fine but recently it broke with the badge displaying query not supported - as far as I can see, this comes from #10551? Is this now a restriction due to this not being a .toml file?

🔗 Link to the badge

https://img.shields.io/badge/dynamic/toml?url=https%3A%2F%2Fraw.githubusercontent.com%2FMatatika%2Ftap-spotify%2Fmaster%2Fpoetry.lock&query=package%5B%3F(%40.name%3D%3D'singer-sdk')%5D.version&label=singer-sdk

💡 Possible Solution

No response

[github-actions]

Badge tested using npm run badge https://img.shields.io/badge/dynamic/toml?url=https%3A%2F%2Fraw.githubusercontent.com%2FMatatika%2Ftap-spotify%2Fmaster%2Fpoetry.lock&query=package%5B%3F(%40.name%3D%3D'singer-sdk')%5D.version&label=singer-sdk
Output is available here

[chris48s]

It isn't the input file. It is the query. For security reasons, we've now disabled script expressions in jsonpath queries.

There's more details on this in #10553 under "2. Users of Dynamic JSON/TOML/YAML badges"

[ReubenFrankel]

I see, thanks. Fair enough, I will find a different solution. 🙂