[perl5-dbi/dbi] 315c6c: Load serializer class using Module::Load (CVE-2026...

  Branch: refs/heads/master
  Home:   https://github.com/perl5-dbi/dbi
  Commit: 315c6ce703b8b3cbe9188062d9ec80730293554a
      https://github.com/perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a
  Author: Robert Rothenberg <[email protected]>
  Date:   2026-08-22 (Sat, 22 Aug 2026)

  Changed paths:
    M MANIFEST
    M Makefile.PL
    M lib/DBD/DBM.pm
    A t/53dbm_module_name.t

  Log Message:
  -----------
  Load serializer class using Module::Load (CVE-2026-78030)

This replaces calls to require with Module::Load, and adds specific
checks that arguments are module names instead of filenames.

Instead of using our own regex matcher, we attempt to use the
Params::Util _CLASS function. The style of trying to import it or adding
our own is based on similar code in DBD::File. (This uses SPDX
annotations to indicate where the code comes from.)

This also adds a suggestion for Params::Util in Makefile.PL.

Note that code of the form

    $INC{"$tie_type.pm"} or require "$tie_type.pm"

is redundant, since require checks %INC.

See also the similar vulnerability to the DBI::Profile vulnerability
CVE-2026-14380 in commit b73d5d9901767fc1d16b6661ef08fbed4532e259.

Assisted-By: Claude Opus 5 (1M context) <[email protected]>

Signed-off-by: Robert Rothenberg <[email protected]>


  Commit: 247bc9136367d84d1c3024c317812d404172e477
      https://github.com/perl5-dbi/dbi/commit/247bc9136367d84d1c3024c317812d404172e477
  Author: Robert Rothenberg <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M MANIFEST
    M Makefile.PL
    M lib/DBD/DBM.pm
    A t/53dbm_module_name.t

  Log Message:
  -----------
  Merge commit from fork

Load serializer class using Module::Load (CVE-2026-78030)


Compare: https://github.com/perl5-dbi/dbi/compare/44c73098d98c...247bc9136367

To unsubscribe from these emails, change your notification settings at https://github.com/perl5-dbi/dbi/settings/notifications