Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Sereal-Decoder for
openSUSE:Factory checked in at 2026-07-28 18:13:29
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Sereal-Decoder (Old)
and /work/SRC/openSUSE:Factory/.perl-Sereal-Decoder.new.2004 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Sereal-Decoder"
Tue Jul 28 18:13:29 2026 rev:16 rq:1368048 version:5.9.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Sereal-Decoder/perl-Sereal-Decoder.changes
2026-06-01 18:08:23.961237565 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Sereal-Decoder.new.2004/perl-Sereal-Decoder.changes
2026-07-28 18:15:38.605776853 +0200
@@ -1,0 +2,20 @@
+Sat Jul 18 07:13:20 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 5.9.0 (5.009)
+ see /usr/share/doc/packages/perl-Sereal-Decoder/Changes
+
+ 5.009
+ * Only use Perl's C<$Config{ccflags}> when building bundled zstd on
+ AIX / IBM toolchains, or when C<SEREAL_ZSTD_USE_CONFIG_CCFLAGS> is
+ set. Other platforms now use the normal zstd build flags again.
+
+ 5.008
+ * Decoder now supports C<thaw_allow_classes> and C<thaw_deny_action>
+ to control thaw callbacks during decoding. Thanks to James Rouzier
+ for the patches.
+
+ 5.007
+ * Use $Config{ccflags} to compile ztd with. Should fix AIX.
+ Thanks to Thomas Seeling for the suggestion.
+
+-------------------------------------------------------------------
Old:
----
Sereal-Decoder-5.006.tar.gz
New:
----
Sereal-Decoder-5.009.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Sereal-Decoder.spec ++++++
--- /var/tmp/diff_new_pack.06LAzS/_old 2026-07-28 18:15:39.845820202 +0200
+++ /var/tmp/diff_new_pack.06LAzS/_new 2026-07-28 18:15:39.849820342 +0200
@@ -18,10 +18,10 @@
%define cpan_name Sereal-Decoder
Name: perl-Sereal-Decoder
-Version: 5.6.0
+Version: 5.9.0
Release: 0
-# 5.006 -> normalize -> 5.6.0
-%define cpan_version 5.006
+# 5.009 -> normalize -> 5.9.0
+%define cpan_version 5.009
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: Binary serialization module for Perl (decoder part)
URL: https://metacpan.org/release/%{cpan_name}
++++++ Sereal-Decoder-5.006.tar.gz -> Sereal-Decoder-5.009.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/Changes
new/Sereal-Decoder-5.009/Changes
--- old/Sereal-Decoder-5.006/Changes 2026-05-20 11:41:11.000000000 +0200
+++ new/Sereal-Decoder-5.009/Changes 2026-07-17 09:59:58.000000000 +0200
@@ -5,6 +5,20 @@
* of the decoder before upgrading to version 5 of the *
* encoder! *
****************************************************************
+5.009
+ * Only use Perl's C<$Config{ccflags}> when building bundled zstd on
+ AIX / IBM toolchains, or when C<SEREAL_ZSTD_USE_CONFIG_CCFLAGS> is
+ set. Other platforms now use the normal zstd build flags again.
+
+5.008
+ * Decoder now supports C<thaw_allow_classes> and C<thaw_deny_action>
+ to control thaw callbacks during decoding. Thanks to James Rouzier
+ for the patches.
+
+5.007
+ * Use $Config{ccflags} to compile ztd with. Should fix AIX.
+ Thanks to Thomas Seeling for the suggestion.
+
5.006
* Use miniz 3.1.1
* Avoid deprecated ZSTD api.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/Decoder.xs
new/Sereal-Decoder-5.009/Decoder.xs
--- old/Sereal-Decoder-5.006/Decoder.xs 2023-02-01 05:14:58.000000000 +0100
+++ new/Sereal-Decoder-5.009/Decoder.xs 2026-07-10 12:47:32.000000000 +0200
@@ -347,6 +347,8 @@
SRL_INIT_OPTION( SRL_DEC_OPT_IDX_MAX_STRING_LENGTH,
SRL_DEC_OPT_STR_MAX_STRING_LENGTH );
SRL_INIT_OPTION( SRL_DEC_OPT_IDX_MAX_UNCOMPRESSED_SIZE,
SRL_DEC_OPT_STR_MAX_UNCOMPRESSED_SIZE );
SRL_INIT_OPTION( SRL_DEC_OPT_IDX_NO_THAW_OBJECTS,
SRL_DEC_OPT_STR_NO_THAW_OBJECTS );
+ SRL_INIT_OPTION( SRL_DEC_OPT_IDX_THAW_ALLOW_CLASSES,
SRL_DEC_OPT_STR_THAW_ALLOW_CLASSES );
+ SRL_INIT_OPTION( SRL_DEC_OPT_IDX_THAW_DENY_ACTION,
SRL_DEC_OPT_STR_THAW_DENY_ACTION );
}
#if USE_CUSTOM_OPS
{
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/MANIFEST
new/Sereal-Decoder-5.009/MANIFEST
--- old/Sereal-Decoder-5.006/MANIFEST 2026-05-20 11:43:08.000000000 +0200
+++ new/Sereal-Decoder-5.009/MANIFEST 2026-07-17 10:03:14.000000000 +0200
@@ -56,6 +56,7 @@
t/090_thaw.t
t/091_thaw_order.t
t/092_thaw_scalar.t
+t/094_thaw_allow.t
t/110_nobless.t
t/150_dec_exception.t
t/155_zipbomb.t
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/META.json
new/Sereal-Decoder-5.009/META.json
--- old/Sereal-Decoder-5.006/META.json 2026-05-20 11:43:08.000000000 +0200
+++ new/Sereal-Decoder-5.009/META.json 2026-07-17 10:03:14.000000000 +0200
@@ -4,7 +4,7 @@
"Steffen Mueller <[email protected]>, Yves Orton <[email protected]>"
],
"dynamic_config" : 1,
- "generated_by" : "ExtUtils::MakeMaker version 7.62, CPAN::Meta::Converter
version 2.150010",
+ "generated_by" : "ExtUtils::MakeMaker version 7.64, CPAN::Meta::Converter
version 2.150010",
"license" : [
"perl_5"
],
@@ -60,6 +60,6 @@
"url" : "git://github.com/Sereal/Sereal.git"
}
},
- "version" : "5.006",
- "x_serialization_backend" : "JSON::PP version 4.06"
+ "version" : "5.009",
+ "x_serialization_backend" : "JSON::PP version 4.07"
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/META.yml
new/Sereal-Decoder-5.009/META.yml
--- old/Sereal-Decoder-5.006/META.yml 2026-05-20 11:43:08.000000000 +0200
+++ new/Sereal-Decoder-5.009/META.yml 2026-07-17 10:03:14.000000000 +0200
@@ -16,7 +16,7 @@
Devel::CheckLib: '1.16'
ExtUtils::MakeMaker: '7.0'
dynamic_config: 1
-generated_by: 'ExtUtils::MakeMaker version 7.62, CPAN::Meta::Converter version
2.150010'
+generated_by: 'ExtUtils::MakeMaker version 7.64, CPAN::Meta::Converter version
2.150010'
license: perl
meta-spec:
url: http://module-build.sourceforge.net/META-spec-v1.4.html
@@ -32,5 +32,5 @@
resources:
bugtracker: https://github.com/Sereal/Sereal/issues
repository: git://github.com/Sereal/Sereal.git
-version: '5.006'
+version: '5.009'
x_serialization_backend: 'CPAN::Meta::YAML version 0.018'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/lib/Sereal/Decoder/Constants.pm
new/Sereal-Decoder-5.009/lib/Sereal/Decoder/Constants.pm
--- old/Sereal-Decoder-5.006/lib/Sereal/Decoder/Constants.pm 2026-05-20
11:41:17.000000000 +0200
+++ new/Sereal-Decoder-5.009/lib/Sereal/Decoder/Constants.pm 2026-07-17
10:01:31.000000000 +0200
@@ -4,7 +4,7 @@
require Exporter;
our @ISA = qw(Exporter);
-our $VERSION = '5.006';
+our $VERSION = '5.009';
our ( @EXPORT_OK, %DEFINE, %TAG_INFO_HASH, @TAG_INFO_ARRAY );
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/lib/Sereal/Decoder.pm
new/Sereal-Decoder-5.009/lib/Sereal/Decoder.pm
--- old/Sereal-Decoder-5.006/lib/Sereal/Decoder.pm 2026-05-20
11:41:17.000000000 +0200
+++ new/Sereal-Decoder-5.009/lib/Sereal/Decoder.pm 2026-07-17
10:01:31.000000000 +0200
@@ -5,7 +5,7 @@
use Carp qw/croak/;
use XSLoader;
-our $VERSION = '5.006';
+our $VERSION = '5.009';
our $XS_VERSION = $VERSION; $VERSION = eval $VERSION;
use Exporter 'import';
@@ -51,6 +51,7 @@
'SRL_F_DECODER_REUSE' => 1,
'SRL_F_DECODER_SET_READONLY' => 32768,
'SRL_F_DECODER_SET_READONLY_SCALARS' => 65536,
+ 'SRL_F_DECODER_THAW_DENY_RAW' => 1048576,
'SRL_F_DECODER_USE_UNDEF' => 16384,
'SRL_F_DECODER_VALIDATE_UTF8' => 256,
'SRL_F_DECODER_VOLATILE_FLAGS' => 133150,
@@ -74,7 +75,8 @@
'SET_READONLY_SCALARS',
'DECOMPRESS_ZSTD',
'REFUSE_ZSTD',
- 'NO_THAW_OBJECTS'
+ 'NO_THAW_OBJECTS',
+ 'THAW_DENY_RAW'
],
'_FLAG_NAME_STATIC' => [
'REUSE',
@@ -96,7 +98,8 @@
'SET_READONLY_SCALARS',
undef,
'REFUSE_ZSTD',
- 'NO_THAW_OBJECTS'
+ 'NO_THAW_OBJECTS',
+ 'THAW_DENY_RAW'
],
'_FLAG_NAME_VOLATILE' => [
undef,
@@ -118,6 +121,7 @@
undef,
'DECOMPRESS_ZSTD',
undef,
+ undef,
undef
]
}; #end generated
@@ -251,6 +255,44 @@
array ref of arguments that would be passed into the THAW subroutine instead of
calling THAW itself.
+=head3 thaw_allow_classes
+
+An allow-list restricting which classes may have their C<THAW> method invoked
+while decoding a frozen object (see L</FREEZE/THAW CALLBACK MECHANISM>). This
is
+useful as a defensive measure when decoding untrusted input, since C<THAW> runs
+arbitrary code in the named class. It may be one of:
+
+=over 4
+
+=item * an array ref of class names, e.g. C<< ['My::Class', 'Other::Class'] >>
+
+=item * a hash ref whose keys with a true value are the allowed class names,
+e.g. C<< { 'My::Class' => 1 } >>
+
+=item * a code ref predicate, called as C<< $cb->($classname) >> once per
frozen
+object, that returns a true value to allow C<THAW>
+
+=back
+
+When a frozen object's class is not allowed, the behaviour is controlled by
+L</thaw_deny_action>. This option only has an effect where C<THAW> would
+otherwise be called; it is moot under C<refuse_objects> or C<no_thaw_objects>.
+When not set (the default), every frozen object is thawed as before.
+
+=head3 thaw_deny_action
+
+Controls what happens when C<thaw_allow_classes> is set and a frozen object's
+class is B<not> allowed. Accepts a string:
+
+=over 4
+
+=item * C<'croak'> (the default) - throw an exception.
+
+=item * C<'raw'> - do not call C<THAW>; instead yield the raw argument array
+blessed into C<Sereal::Decoder::THAW_args>, exactly as C<no_thaw_objects> does.
+
+=back
+
=head3 validate_utf8
If set, the decoder will refuse invalid UTF-8 byte sequences. This is off
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/srl_decoder.c
new/Sereal-Decoder-5.009/srl_decoder.c
--- old/Sereal-Decoder-5.006/srl_decoder.c 2026-05-20 11:27:23.000000000
+0200
+++ new/Sereal-Decoder-5.009/srl_decoder.c 2026-07-10 12:47:32.000000000
+0200
@@ -133,6 +133,7 @@
SRL_STATIC_INLINE SV * srl_follow_refp_alias_reference(pTHX_ srl_decoder_t
*dec, UV offset);
SRL_STATIC_INLINE AV * srl_follow_objectv_reference(pTHX_ srl_decoder_t *dec,
UV offset);
SRL_STATIC_INLINE void srl_thaw_object(pTHX_ srl_decoder_t *dec, HV
*class_stash, SV *sv);
+SRL_STATIC_INLINE int srl_thaw_class_allowed(pTHX_ srl_decoder_t *dec, HV
*class_stash);
/* FIXME unimplemented!!! */
SRL_STATIC_INLINE SV *srl_read_extend(pTHX_ srl_decoder_t *dec, SV* into);
@@ -267,6 +268,57 @@
}
}
+ /* thaw_allow_classes: only THAW the listed classes. Accepts an array
+ * ref (list of names), a hash ref (keys with a true value) or a code
+ * ref (predicate called with the class name). */
+ my_hv_fetchs(he,val,opt, SRL_DEC_OPT_IDX_THAW_ALLOW_CLASSES);
+ if ( val && SvOK(val) ) {
+ SV *rv = SvROK(val) ? SvRV(val) : NULL;
+ if (rv && SvTYPE(rv) == SVt_PVAV) {
+ AV *av = (AV*)rv;
+ SSize_t i, len = av_len(av) + 1;
+ dec->thaw_allow_hash = newHV();
+ for (i = 0; i < len; i++) {
+ SV **elem = av_fetch(av, i, 0);
+ if (elem && SvOK(*elem)) {
+ STRLEN klen;
+ char *kstr = SvPV(*elem, klen);
+ (void)hv_store(dec->thaw_allow_hash, kstr,
SvUTF8(*elem) ? -(I32)klen : (I32)klen, &PL_sv_yes, 0);
+ }
+ }
+ }
+ else if (rv && SvTYPE(rv) == SVt_PVHV) {
+ HV *src = (HV*)rv;
+ HE *ent;
+ dec->thaw_allow_hash = newHV();
+ hv_iterinit(src);
+ while ((ent = hv_iternext(src))) {
+ if (SvTRUE(HeVAL(ent))) {
+ STRLEN klen;
+ char *kstr = HePV(ent, klen);
+ (void)hv_store(dec->thaw_allow_hash, kstr, HeUTF8(ent)
? -(I32)klen : (I32)klen, &PL_sv_yes, 0);
+ }
+ }
+ }
+ else if (rv && SvTYPE(rv) == SVt_PVCV) {
+ dec->thaw_allow_cb = newRV_inc(rv);
+ }
+ else {
+ croak("The 'thaw_allow_classes' option must be an array ref, "
+ "hash ref or code ref");
+ }
+ }
+
+ my_hv_fetchs(he,val,opt, SRL_DEC_OPT_IDX_THAW_DENY_ACTION);
+ if ( val && SvOK(val) ) {
+ STRLEN alen;
+ char *astr = SvPV(val, alen);
+ if (memEQs(astr, alen, "raw"))
+ SRL_DEC_SET_OPTION(dec, SRL_F_DECODER_THAW_DENY_RAW);
+ else if (!memEQs(astr, alen, "croak"))
+ croak("The 'thaw_deny_action' option must be 'croak' or
'raw'");
+ }
+
my_hv_fetchs(he,val,opt, SRL_DEC_OPT_IDX_VALIDATE_UTF8);
if ( val && SvTRUE(val) )
SRL_DEC_SET_OPTION(dec, SRL_F_DECODER_VALIDATE_UTF8);
@@ -381,6 +433,16 @@
SvREFCNT_inc(dec->alias_cache);
}
+ /* thaw allow-list is immutable config; share it with the clone. */
+ if (proto->thaw_allow_hash) {
+ dec->thaw_allow_hash = proto->thaw_allow_hash;
+ SvREFCNT_inc((SV*)dec->thaw_allow_hash);
+ }
+ if (proto->thaw_allow_cb) {
+ dec->thaw_allow_cb = proto->thaw_allow_cb;
+ SvREFCNT_inc(dec->thaw_allow_cb);
+ }
+
SRL_RDR_CLEAR(&dec->buf);
dec->pbuf = &dec->buf;
dec->flags = proto->flags;
@@ -410,6 +472,14 @@
}
if (dec->alias_cache)
SvREFCNT_dec(dec->alias_cache);
+ if (dec->thaw_allow_hash) {
+ SvREFCNT_dec((SV*)dec->thaw_allow_hash);
+ dec->thaw_allow_hash = NULL;
+ }
+ if (dec->thaw_allow_cb) {
+ SvREFCNT_dec(dec->thaw_allow_cb);
+ dec->thaw_allow_cb = NULL;
+ }
Safefree(dec);
}
@@ -763,6 +833,58 @@
return NULL;
}
+/* Decide whether the given class is allowed to have its THAW method invoked,
+ * according to the thaw_allow_classes option. Returns true when no allow-list
+ * is configured (the default), so ordinary decoding is unaffected. */
+SRL_STATIC_INLINE int
+srl_thaw_class_allowed(pTHX_ srl_decoder_t *dec, HV *class_stash)
+{
+ const char *classname;
+ STRLEN classname_len;
+ int is_utf8;
+
+ if (!dec->thaw_allow_hash && !dec->thaw_allow_cb)
+ return 1; /* no allow-list configured: allow everything */
+
+ classname = HvNAME_get(class_stash);
+ classname_len = HvNAMELEN_get(class_stash);
+#if PERL_VERSION >= 16
+ is_utf8 = HvNAMEUTF8(class_stash) ? 1 : 0;
+#else
+ is_utf8 = 0;
+#endif
+
+ if (dec->thaw_allow_hash) {
+ return hv_exists(dec->thaw_allow_hash, classname,
+ is_utf8 ? -(I32)classname_len : (I32)classname_len) ?
1 : 0;
+ }
+ else {
+ /* code ref predicate: $cb->($classname) */
+ int allowed = 0;
+ int count;
+ SV *name_sv;
+ dSP;
+
+ ENTER;
+ SAVETMPS;
+ PUSHMARK(SP);
+ name_sv = sv_2mortal(newSVpvn(classname, classname_len));
+ if (is_utf8) SvUTF8_on(name_sv);
+ XPUSHs(name_sv);
+ PUTBACK;
+ count = call_sv(dec->thaw_allow_cb, G_SCALAR);
+ SPAGAIN;
+ if (count >= 1) {
+ SV *res = POPs;
+ allowed = SvTRUE(res) ? 1 : 0;
+ }
+ PUTBACK;
+ FREETMPS;
+ LEAVE;
+ return allowed;
+ }
+}
+
SRL_STATIC_INLINE void
srl_finalize_structure(pTHX_ srl_decoder_t *dec)
{
@@ -866,13 +988,25 @@
HV *class_stash = (HV*)srl_fetch_register_frozen_object(aTHX_ dec,
sv, 0);
AV *additional_refs= NULL;
IV fixups = 0;
+ int thaw_this = 1; /* cleared if class is denied but fallback
allowed */
if (SvTYPE(class_stash) == SVt_PVAV) {
additional_refs = (AV*)class_stash;
fixups = av_len(additional_refs); /* no +1 because we do it
before the class_stash shift */
class_stash = (HV *)av_shift((AV*)additional_refs);
SvREFCNT_dec(class_stash);
}
- if (nothaw) {
+ /* Enforce the thaw allow-list (if any). A disallowed class either
+ * croaks (default) or falls back to the raw-args behavior below.
*/
+ if (!nothaw && !srl_thaw_class_allowed(aTHX_ dec, class_stash)) {
+ if (SRL_DEC_HAVE_OPTION(dec, SRL_F_DECODER_THAW_DENY_RAW)) {
+ thaw_this = 0;
+ } else {
+ SRL_RDR_ERRORf1(dec->pbuf,
+ "THAW not allowed for class '%s' (not in
thaw_allow_classes)",
+ HvNAME(class_stash));
+ }
+ }
+ if (nothaw || !thaw_this) {
/* do not actually thaw. In order to make it easier to find
these cases in a dump
* we push the class name into the AV, and then bless it into
a special class
* private to the Sereal project. */
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/srl_decoder.h
new/Sereal-Decoder-5.009/srl_decoder.h
--- old/Sereal-Decoder-5.006/srl_decoder.h 2023-02-01 05:14:58.000000000
+0100
+++ new/Sereal-Decoder-5.009/srl_decoder.h 2026-07-10 12:47:32.000000000
+0200
@@ -33,6 +33,9 @@
AV* weakref_av;
AV* thaw_av; /* AV of refs which have to be thawed
*/
+ HV* thaw_allow_hash; /* set of class names allowed to be
THAWed, or NULL */
+ SV* thaw_allow_cb; /* coderef predicate (RV to CV)
deciding THAW, or NULL */
+
AV* alias_cache; /* used to cache integers of different sizes. */
IV alias_varint_under;
@@ -139,6 +142,11 @@
/* Persistent flag: Make the decoder forget to thaw */
#define SRL_F_DECODER_NO_THAW_OBJECTS 0x00080000UL
+/* If set, a frozen object whose class is not in the thaw allow-list is not
+ * THAWed but instead yielded as the raw arg array (as no_thaw_objects does).
+ * If not set (the default), a disallowed class causes an exception. */
+#define SRL_F_DECODER_THAW_DENY_RAW 0x00100000UL
+
#define SRL_F_DECODER_ALIAS_CHECK_FLAGS ( SRL_F_DECODER_ALIAS_SMALLINT |
SRL_F_DECODER_ALIAS_VARINT | SRL_F_DECODER_USE_UNDEF )
#define SRL_F_DECODER_READONLY_FLAGS ( SRL_F_DECODER_SET_READONLY |
SRL_F_DECODER_SET_READONLY_SCALARS )
@@ -220,10 +228,16 @@
#define SRL_DEC_OPT_STR_NO_THAW_OBJECTS "no_thaw_objects"
#define SRL_DEC_OPT_IDX_NO_THAW_OBJECTS 17
+#define SRL_DEC_OPT_STR_THAW_ALLOW_CLASSES "thaw_allow_classes"
+#define SRL_DEC_OPT_IDX_THAW_ALLOW_CLASSES 18
+
+#define SRL_DEC_OPT_STR_THAW_DENY_ACTION "thaw_deny_action"
+#define SRL_DEC_OPT_IDX_THAW_DENY_ACTION 19
+
/* NOTE WELL: WHEN YOU ADD AN OPTION YOU **MUST** ADD A
* CORRESPONDING CALL TO SRL_INIT_OPTION() to Decoder.xs */
-#define SRL_DEC_OPT_COUNT 18
+#define SRL_DEC_OPT_COUNT 20
#if ((PERL_VERSION > 10) || (PERL_VERSION == 10 && PERL_SUBVERSION > 1 ))
# define MODERN_REGEXP
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/t/094_thaw_allow.t
new/Sereal-Decoder-5.009/t/094_thaw_allow.t
--- old/Sereal-Decoder-5.006/t/094_thaw_allow.t 1970-01-01 01:00:00.000000000
+0100
+++ new/Sereal-Decoder-5.009/t/094_thaw_allow.t 2026-07-10 12:47:32.000000000
+0200
@@ -0,0 +1,191 @@
+#!perl
+use strict;
+use warnings;
+
+use File::Spec;
+use lib File::Spec->catdir(qw(t lib));
+
+BEGIN {
+ lib->import('lib')
+ if !-d 't';
+}
+
+use Test::More;
+use Sereal::TestSet qw(:all);
+
+if ( !have_encoder_and_decoder() ) {
+ plan skip_all => 'Did not find right version of encoder';
+}
+
+# Two classes with FREEZE/THAW so we can exercise the allow-list.
+{
+
+ package TA::Allowed;
+ sub new { bless { n => $_[1] }, $_[0] }
+ sub FREEZE { my $self = shift; return $self->{n} }
+ sub THAW { my ( $class, $ser, $n ) = @_; return $class->new($n) }
+
+ package TA::Denied;
+ sub new { bless { n => $_[1] }, $_[0] }
+ sub FREEZE { my $self = shift; return $self->{n} }
+ sub THAW { my ( $class, $ser, $n ) = @_; return $class->new($n) }
+}
+
+my $enc = Sereal::Encoder->new( { freeze_callbacks => 1 } );
+my $allowed_blob = $enc->encode( TA::Allowed->new(11) );
+my $denied_blob = $enc->encode( TA::Denied->new(22) );
+
+# 1. No allow-list: everything thaws as before (backwards compatible).
+{
+ my $dec = Sereal::Decoder->new();
+ my $o = $dec->decode($denied_blob);
+ isa_ok( $o, 'TA::Denied', 'no allow-list thaws normally' );
+ is( $o->{n}, 22, ' ... with correct data' );
+}
+
+# 2. Allow-list as an array ref: allowed class thaws, disallowed croaks.
+{
+ my $dec = Sereal::Decoder->new( { thaw_allow_classes => ['TA::Allowed'] }
);
+ my $o = $dec->decode($allowed_blob);
+ isa_ok( $o, 'TA::Allowed', 'array-ref allow: allowed class thaws' );
+ is( $o->{n}, 11, ' ... with correct data' );
+
+ ok( !eval { $dec->decode($denied_blob); 1 },
+ 'array-ref allow: disallowed class croaks (default action)' );
+ like( $@, qr/THAW not allowed for class 'TA::Denied'/,
+ ' ... with a helpful message' );
+}
+
+# 3. Allow-list as a hash ref.
+{
+ my $dec = Sereal::Decoder->new(
+ { thaw_allow_classes => { 'TA::Allowed' => 1, 'TA::Denied' => 0 } } );
+ isa_ok( $dec->decode($allowed_blob), 'TA::Allowed', 'hash-ref allow: true
value allows' );
+ ok( !eval { $dec->decode($denied_blob); 1 },
+ 'hash-ref allow: false value disallows' );
+}
+
+# 4. Allow-list as a code ref predicate.
+{
+ my @seen;
+ my $dec = Sereal::Decoder->new(
+ { thaw_allow_classes => sub { push @seen, $_[0]; $_[0] eq
'TA::Allowed' }
+ }
+ );
+ isa_ok( $dec->decode($allowed_blob), 'TA::Allowed', 'code-ref allow:
predicate true allows' );
+ is_deeply( \@seen, ['TA::Allowed'], ' ... predicate received the class
name' );
+ ok( !eval { $dec->decode($denied_blob); 1 },
+ 'code-ref allow: predicate false disallows' );
+}
+
+# 5. thaw_deny_action => 'raw' yields the raw args instead of croaking.
+{
+ my $dec = Sereal::Decoder->new(
+ { thaw_allow_classes => ['TA::Allowed'],
+ thaw_deny_action => 'raw',
+ }
+ );
+ isa_ok( $dec->decode($allowed_blob), 'TA::Allowed', 'raw action: allowed
class still thaws' );
+ my $raw = $dec->decode($denied_blob);
+ isa_ok( $raw, 'Sereal::Decoder::THAW_args',
+ 'raw action: disallowed class yields raw THAW args' );
+}
+
+# 6. An explicit 'croak' action behaves like the default.
+{
+ my $dec = Sereal::Decoder->new(
+ { thaw_allow_classes => ['TA::Allowed'],
+ thaw_deny_action => 'croak',
+ }
+ );
+ ok( !eval { $dec->decode($denied_blob); 1 },
+ "explicit 'croak' action croaks on disallowed class" );
+}
+
+# 7. A bogus deny action and a bogus allow-list type are rejected at
construction.
+{
+ ok( !eval { Sereal::Decoder->new( { thaw_deny_action => 'nope' } ); 1 },
+ 'invalid thaw_deny_action croaks' );
+ ok( !eval { Sereal::Decoder->new( { thaw_allow_classes => 'scalar' } ); 1
},
+ 'invalid thaw_allow_classes type croaks' );
+}
+
+# 8. A structure mixing allowed and disallowed objects.
+{
+ my $mixed = $enc->encode( [ TA::Allowed->new(1), TA::Denied->new(2) ] );
+
+ my $dec = Sereal::Decoder->new( { thaw_allow_classes => ['TA::Allowed'] }
);
+ ok( !eval { $dec->decode($mixed); 1 },
+ 'mixed structure: a single disallowed member croaks the whole decode'
);
+
+ my $raw = Sereal::Decoder->new(
+ { thaw_allow_classes => ['TA::Allowed'], thaw_deny_action => 'raw' } );
+ my $out = $raw->decode($mixed);
+ isa_ok( $out->[0], 'TA::Allowed', 'mixed raw: allowed member is thawed' );
+ isa_ok( $out->[1], 'Sereal::Decoder::THAW_args', 'mixed raw: disallowed
member is kept raw' );
+}
+
+# 9. Referential integrity: several references to one allowed frozen object.
+{
+ my $a = TA::Allowed->new(42);
+ my $blob = $enc->encode( [ $a, $a ] );
+ my $dec = Sereal::Decoder->new( { thaw_allow_classes => ['TA::Allowed'] }
);
+ my $out = $dec->decode($blob);
+ isa_ok( $out->[0], 'TA::Allowed', 'refint: allowed object is thawed' );
+ is( $out->[0]{n}, 42, ' ... with correct data' );
+ is( $out->[0], $out->[1], 'refint: both references are the same thawed
object' );
+}
+
+# 10. A global no_thaw_objects makes the allow-list moot (never consulted,
never croaks).
+{
+ my $dec = Sereal::Decoder->new(
+ { thaw_allow_classes => ['TA::Allowed'], no_thaw_objects => 1 } );
+ my $out = eval { $dec->decode($denied_blob) };
+ isa_ok( $out, 'Sereal::Decoder::THAW_args',
+ 'no_thaw_objects: disallowed class is not consulted and does not
croak' );
+}
+
+# 11. refuse_objects still refuses everything, regardless of the allow-list.
+{
+ my $dec = Sereal::Decoder->new(
+ { thaw_allow_classes => ['TA::Allowed'], refuse_objects => 1 } );
+ ok( !eval { $dec->decode($allowed_blob); 1 },
+ 'refuse_objects overrides the allow-list (still refuses allowed
classes)' );
+}
+
+# 12. Re-entrancy: a THAW hook that re-invokes the same decoder must see the
+# allow-list on the cloned decoder struct.
+{
+
+ package TA::Inner;
+ sub new { bless { v => $_[1] }, $_[0] }
+ sub FREEZE { my $s = shift; return $s->{v} }
+ sub THAW { my ( $c, $ser, $v ) = @_; return $c->new($v) }
+
+ package TA::Outer;
+ our $DEC;
+ our $INNER_BLOB;
+ sub new { bless {}, $_[0] }
+ sub FREEZE { return $INNER_BLOB } # carries a nested Sereal document
+ sub THAW { my ( $c, $ser, $blob ) = @_; return bless { inner =>
$DEC->decode($blob) }, $c }
+}
+{
+ $TA::Outer::INNER_BLOB = $enc->encode( TA::Inner->new(99) );
+ my $outer_blob = $enc->encode( TA::Outer->new );
+
+ # TA::Inner is NOT allowed: the nested (cloned) decode must enforce it.
+ $TA::Outer::DEC = Sereal::Decoder->new( { thaw_allow_classes =>
['TA::Outer'] } );
+ ok( !eval { $TA::Outer::DEC->decode($outer_blob); 1 },
+ 're-entrant clone enforces the allow-list' );
+ like( $@, qr/THAW not allowed for class 'TA::Inner'/,
+ ' ... naming the disallowed nested class' );
+
+ # Now allow the nested class too: the whole thing round-trips.
+ $TA::Outer::DEC = Sereal::Decoder->new( { thaw_allow_classes => [
'TA::Outer', 'TA::Inner' ] } );
+ my $o = $TA::Outer::DEC->decode($outer_blob);
+ isa_ok( $o, 'TA::Outer', 're-entrant clone allows a listed nested class' );
+ isa_ok( $o->{inner}, 'TA::Inner', ' ... nested object thawed' );
+ is( $o->{inner}{v}, 99, ' ... with correct data' );
+}
+
+done_testing();
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.006/zstd/Makefile.PL
new/Sereal-Decoder-5.009/zstd/Makefile.PL
--- old/Sereal-Decoder-5.006/zstd/Makefile.PL 2026-05-20 11:16:17.000000000
+0200
+++ new/Sereal-Decoder-5.009/zstd/Makefile.PL 2026-07-17 09:45:25.000000000
+0200
@@ -17,6 +17,15 @@
my @source_files = @c_files;
my $disable_asm = "";
+my $use_config_ccflags =
+ $ENV{SEREAL_ZSTD_USE_CONFIG_CCFLAGS}
+ || $Config{osname} eq 'aix'
+ || $Config{cc} =~ /\b(?:xlc|xlclang|ibm)\b/i;
+my $zstd_cflags = $use_config_ccflags
+ ? $Config{ccflags}
+ : '-fPIC -Wall -Wextra -Wcast-qual -Wcast-align -Wshadow
-Wstrict-aliasing=1 '
+ . '-Wswitch-enum -Wdeclaration-after-statement -Wstrict-prototypes -Wundef
'
+ . '-Wpointer-arith';
if ( $ENV{NO_ASM} || $ENV{ZSTD_DISABLE_ASM} ) {
$disable_asm = "CPPFLAGS += -DZSTD_DISABLE_ASM\n";
}
@@ -62,9 +71,7 @@
CC = } . $Config{cc} . q{
CPPFLAGS+= -I. -I./common -DXXH_NAMESPACE=ZSTD_
CFLAGS ?= -O3
-CFLAGS += -fPIC -Wall -Wextra -Wcast-qual -Wcast-align -Wshadow
-Wstrict-aliasing=1 \
- -Wswitch-enum -Wdeclaration-after-statement -Wstrict-prototypes
-Wundef \
- -Wpointer-arith
+CFLAGS += } . $zstd_cflags . q{
CFLAGS += $(MOREFLAGS)
AR = ar
ARFLAGS = rcs
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.06LAzS/_old 2026-07-28 18:15:40.277835305 +0200
+++ /var/tmp/diff_new_pack.06LAzS/_new 2026-07-28 18:15:40.281835444 +0200
@@ -1,6 +1,6 @@
-mtime: 1780310377
-commit: d85e01ff180eaedd853e23adf3692ec0970eb013829a6ef2b090976464b3e45b
+mtime: 1784358800
+commit: 1a383fc7b74d83fcc8a802d4d2c6855fce453bb89eff897c95d695cd08e8d8c9
url: https://src.opensuse.org/perl/perl-Sereal-Decoder
-revision: d85e01ff180eaedd853e23adf3692ec0970eb013829a6ef2b090976464b3e45b
+revision: 1a383fc7b74d83fcc8a802d4d2c6855fce453bb89eff897c95d695cd08e8d8c9
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-07-18 09:13:20.000000000 +0200
@@ -0,0 +1 @@
+.osc
