[bdcravens]

Pipelining CLI commands or bash scripts. From a security perspective, it may be preferable to not ship with a runtime.

[jonfw]

Use a compiled language like golang if you don't want to ship with a runtime.

If you're willing to ship w/ bash then I don't understand the opposition to JS. Either tool puts you in a scenario where somebody who can exec into your env can do whatever they want

[vips7L]

bash and jq are both runtimes.

[bdcravens]

Very difficult (or often impractical) to not have a shell at all, and jq is at least limited in scope, and has no dependencies that need to be installed. Far better than a full language with its own standard library and set of dependencies to lock down.