CVS commit: [pkgsrc-2026Q2] pkgsrc/converters/p5-Cpanel-JSON-XS
"Maya Rashish" <[email protected]> Wed, 5 Aug 2026 15:40:37 +0000
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.cvs |
|---|---|
| Message-ID | <[email protected]> |
Module Name: pkgsrc
Committed By: maya
Date: Wed Aug 5 15:40:37 UTC 2026
Modified Files:
pkgsrc/converters/p5-Cpanel-JSON-XS [pkgsrc-2026Q2]: Makefile distinfo
Log Message:
Pullup ticket #7222 - requested by taca
converters/c5-Cpanel-JSON-XS: Security fix
Revisions pulled up:
- converters/p5-Cpanel-JSON-XS/Makefile 1.20
- converters/p5-Cpanel-JSON-XS/distinfo 1.12
---
Module Name: pkgsrc
Committed By: wen
Date: Fri Jul 24 02:58:23 UTC 2026
Modified Files:
pkgsrc/converters/p5-Cpanel-JSON-XS: Makefile distinfo
Log Message:
Update to 4.43
Upstream changes:
4.43 2026-07-18 (rurban)
- Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
- Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts
UTF-8 decoding instead of checking SvUTF8 flag, since older Perls
may store valid UTF-8 hash keys without the flag set.
- Fix quadmath encode dropping ".0" for large floats (GH #246, reported by Tux).
The .0 guard condition that suppressed appending for NV values > UV_MAX was
incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where
%g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31
to skip only on double/80-bit-ld where %g naturally uses %e for large values.
4.42 2026-06-27 (rurban)
- Ensure encode with a type spec hashref does not change the hashref argument (GH #240)
- Fix -e docs: "written" → "read" (GH #239, reported by Ron Savage).
- Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal
to false because undef stringifies to "". Added defined() guard.
- Fix error messages showing overloaded stringification for blessed
objects (GH #191, reported by karenetheridge). Error messages now
use ClassName=TYPE(addr) format, bypassing any "" overload.
- Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,
reported by alpha6). With type_all_string + allow_blessed, blessed
objects are now encoded as null (not stringified as HASH address).
- Fix infinite recursion when encode is called from a "" overload
(GH #128, reported by pbrthemaster). The recursion guard temporarily
clears convert_blessed and allow_stringify flags on the JSON object
before calling the overload, preventing re-entrant encode loops.
- Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
When new() is called on an existing object (e.g. $json->new->new),
the class name is now extracted from the object's stash rather than
using the stringified reference.
- Change allow_nonref default to true (GH #241, matching JSON::PP and
JSON::XS 4.0+ and the insecure RFC 7159).
encode and decode now accept non-reference values by default.
decode_json() with an explicit 0/1 second argument still works.
allow_nonref(0) to disable scalars-only for secure JSON.
- Fix minor t/12_blessed.t typo.
- Fix GH #112: encode large whole-number NV values without .0 on
32-bit Perl (values exceeding UV_MAX that Perl stores as float).
- Fix GH #197: prefer IOK over pNOK when encoding values where
IV is accurate but NV is imprecise (SvNOK not set).
4.41 2026-05-27 (rurban)
- Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516) (patch by Paul Johnson)
- Fix dupkeys_as_arrayref type confusion (CVE-2026-9334) (patch by Paul Johnson)
- Fix incr_parse single-quote string delimiter (GH #245, reported by
Paul Johnson)
- Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
truncated input (GH #244, reported by Paul Johnson)
4.40 2025-09-07 (rurban)
- Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
- Detect more malformed numbers, with two decimal points.
- Pin github actions to latest @v via pinact run -u
4.39 2024-12-12 (rurban)
- Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)
- Fix inconsistent behavior between decoding escaped and unescaped
surrogates, and escaped non-characters vs non-escaped non-characters.
Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)
- Add type_all_string tests (Bernhard Schmalhofer GH #236)
- Silence UV to char cast warnings (bulk88 GH #232)
- Fix MSVC preprocessor errors (bulk88 GH #232)
- Fix -Wformat warnings on Windows (sisyphus GH #228)
- Clarify BigInt decoding (GH #226)
4.38 2024-05-27 (rurban)
- Encode real core booleans as boolean notation (PR #224 leonerd)
- Minor test fixes by leonerd
- Fix docs typo (PR #225 karenetheridge)
4.37 2023-07-04 (rurban)
- Fix NAN/INF for AIX (Tux: AIX-5.3, tested by XSven on AIX-7.3) GH #165
- Fix empty string result in object stringification (PR #221 jixam)
- Allow \' in strings when allow_singlequote is enabled (PR #217 warpspin)
4.36 2023-03-02 (rurban)
- remove the SAVESTACK_POS noop. Merged from JSON-XS-3.02,
removed there with 4.0. requested to remove with
L<https://github.com/Perl/perl5/pull/20858>
4.35 2023-02-22 (rurban)
- fix utf8 object stringification (jixam PR #212)
4.34 2023-02-21 (rurban)
- fix c89 compilation regression, for loop init on centos. GH #211
4.33 2023-02-21 (rurban)
- fix a security issue, decoding hash keys without ending :
(GH #208)
- check all bare hash keys for utf8 (GH #209)
- improve overload warnings (Graham Knop PR #205)
- fix a croak leak (GH #206)
To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.18.8.1 pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile
cvs rdiff -u -r1.11 -r1.11.30.1 pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed)
(text/x-diff, 1.7 KB)
Modified files:
Index: pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile
diff -u pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile:1.18 pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile:1.18.8.1
--- pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile:1.18 Fri Jul 4 08:44:50 2025
+++ pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile Wed Aug 5 15:40:37 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.18 2025/07/04 08:44:50 wiz Exp $
+# $NetBSD: Makefile,v 1.18.8.1 2026/08/05 15:40:37 maya Exp $
-DISTNAME= Cpanel-JSON-XS-4.32
+DISTNAME= Cpanel-JSON-XS-4.43
PKGNAME= p5-${DISTNAME}
-PKGREVISION= 3
CATEGORIES= converters textproc perl5
MASTER_SITES= ${MASTER_SITE_PERL_CPAN:=../../authors/id/R/RU/RURBAN/}
Index: pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo
diff -u pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo:1.11 pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo:1.11.30.1
--- pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo:1.11 Fri Sep 30 23:41:55 2022
+++ pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo Wed Aug 5 15:40:37 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.11 2022/09/30 23:41:55 wen Exp $
+$NetBSD: distinfo,v 1.11.30.1 2026/08/05 15:40:37 maya Exp $
-BLAKE2s (Cpanel-JSON-XS-4.32.tar.gz) = 9dfac6d89c6fb3b046f5a9fcf32ee044afdb62af4db74e115c167f62ceed5e16
-SHA512 (Cpanel-JSON-XS-4.32.tar.gz) = f17809bb12c388e6344ef738abddd471d541e3854ca8775f518a4cda62f129a703bbaf85e4bf2fa960390df060a161f1ff61a3d3a35c269ae1dc4fe9af8389dd
-Size (Cpanel-JSON-XS-4.32.tar.gz) = 256502 bytes
+BLAKE2s (Cpanel-JSON-XS-4.43.tar.gz) = 8f41ef16be92fefedb83adc83c76a58dad64954f38180e9c9be8965e97bcbe00
+SHA512 (Cpanel-JSON-XS-4.43.tar.gz) = 42105fd0ee07fbd77e34572a9035e1e1837ce04e89bcd0191585eefdb2095b07f2c5a4ee0a64c261f63902cb7d25ce05edd11c9e66e14db46d06d28f8898e7ed
+Size (Cpanel-JSON-XS-4.43.tar.gz) = 270227 bytes