Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Mojolicious for
openSUSE:Factory checked in at 2026-08-19 17:57:36
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Mojolicious (Old)
and /work/SRC/openSUSE:Factory/.perl-Mojolicious.new.1258 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Mojolicious"
Wed Aug 19 17:57:36 2026 rev:187 rq:1371815 version:9.490.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Mojolicious/perl-Mojolicious.changes
2026-07-15 22:15:34.047180178 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Mojolicious.new.1258/perl-Mojolicious.changes
2026-08-19 17:57:44.878764914 +0200
@@ -1,0 +2,10 @@
+Mon Aug 10 06:23:09 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 9.490.0 (9.49)
+ see /usr/share/doc/packages/perl-Mojolicious/Changes
+
+ 9.49 2026-08-10
+ - Added EXPERIMENTAL support for partitioned cookies. (rawleyfowler)
+ - Added EXPERIMENTAL partitioned attributes to Mojo::Cookie::Response and
Mojolicious::Sessions.
+
+-------------------------------------------------------------------
Old:
----
Mojolicious-9.48.tar.gz
New:
----
Mojolicious-9.49.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Mojolicious.spec ++++++
--- /var/tmp/diff_new_pack.5K4z9R/_old 2026-08-19 17:57:45.730795471 +0200
+++ /var/tmp/diff_new_pack.5K4z9R/_new 2026-08-19 17:57:45.732795543 +0200
@@ -18,10 +18,10 @@
%define cpan_name Mojolicious
Name: perl-Mojolicious
-Version: 9.480.0
+Version: 9.490.0
Release: 0
-# 9.48 -> normalize -> 9.480.0
-%define cpan_version 9.48
+# 9.49 -> normalize -> 9.490.0
+%define cpan_version 9.49
License: Artistic-2.0
Summary: Real-time web framework
URL: https://metacpan.org/release/%{cpan_name}
++++++ Mojolicious-9.48.tar.gz -> Mojolicious-9.49.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mojolicious-9.48/Changes new/Mojolicious-9.49/Changes
--- old/Mojolicious-9.48/Changes 2026-07-14 14:52:03.000000000 +0200
+++ new/Mojolicious-9.49/Changes 2026-08-10 01:56:51.000000000 +0200
@@ -1,4 +1,8 @@
+9.49 2026-08-10
+ - Added EXPERIMENTAL support for partitioned cookies. (rawleyfowler)
+ - Added EXPERIMENTAL partitioned attributes to Mojo::Cookie::Response and
Mojolicious::Sessions.
+
9.48 2026-07-14
- Fixed a security issue where CSRF tokens were vulnerable to BREACH
attacks. Tokens are now masked with a fresh
random value on every request, instead of being reused for the whole
lifetime of a session.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mojolicious-9.48/META.json
new/Mojolicious-9.49/META.json
--- old/Mojolicious-9.48/META.json 2026-07-14 14:53:10.000000000 +0200
+++ new/Mojolicious-9.49/META.json 2026-08-10 01:58:01.000000000 +0200
@@ -64,6 +64,6 @@
"web" : "https://web.libera.chat/#mojo";
}
},
- "version" : "9.48",
+ "version" : "9.49",
"x_serialization_backend" : "JSON::PP version 4.16"
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mojolicious-9.48/META.yml
new/Mojolicious-9.49/META.yml
--- old/Mojolicious-9.48/META.yml 2026-07-14 14:53:10.000000000 +0200
+++ new/Mojolicious-9.49/META.yml 2026-08-10 01:58:00.000000000 +0200
@@ -35,5 +35,5 @@
homepage: https://mojolicious.org
license: https://opensource.org/license/artistic-2-0
repository: https://github.com/mojolicious/mojo.git
-version: '9.48'
+version: '9.49'
x_serialization_backend: 'CPAN::Meta::YAML version 0.020'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mojolicious-9.48/lib/Mojo/Cookie/Response.pm
new/Mojolicious-9.49/lib/Mojo/Cookie/Response.pm
--- old/Mojolicious-9.48/lib/Mojo/Cookie/Response.pm 2025-10-01
16:35:24.000000000 +0200
+++ new/Mojolicious-9.49/lib/Mojo/Cookie/Response.pm 2026-08-10
01:54:19.000000000 +0200
@@ -4,9 +4,9 @@
use Mojo::Date;
use Mojo::Util qw(quote split_cookie_header);
-has [qw(domain expires host_only httponly max_age path samesite secure)];
+has [qw(domain expires host_only httponly max_age partitioned path samesite
secure)];
-my %ATTRS = map { $_ => 1 } qw(domain expires httponly max-age path samesite
secure);
+my %ATTRS = map { $_ => 1 } qw(domain expires httponly max-age partitioned
path samesite secure);
sub parse {
my ($self, $str) = @_;
@@ -21,7 +21,7 @@
next unless $ATTRS{my $attr = lc $name};
$value =~ s/^\.// if $attr eq 'domain' && defined $value;
$value = Mojo::Date->new($value // '')->epoch if $attr eq 'expires';
- $value = 1 if $attr eq 'secure' ||
$attr eq 'httponly';
+ $value = 1 if $attr eq 'secure' || $attr eq 'httponly' || $attr eq
'partitioned';
$cookies[-1]{$attr eq 'max-age' ? 'max_age' : $attr} = $value;
}
}
@@ -47,6 +47,9 @@
# "path"
if (my $path = $self->path) { $cookie .= "; path=$path" }
+ # "Partitioned"
+ $cookie .= "; Partitioned" if $self->partitioned;
+
# "secure"
$cookie .= "; secure" if $self->secure;
@@ -123,6 +126,16 @@
Max age for cookie.
+=head2 partitioned
+
+ my $partitioned = $cookie->partitioned;
+ $cookie = $cookie->partitioned(1);
+
+Partitioned flag, this is to be used in accordance to the CHIPS amendment to
RFC 6265.
+Note that this attribute is B<EXPERIMENTAL> because even though most commonly
used browsers support the
+feature, there is no specification yet besides L<this
+draft|https://www.ietf.org/archive/id/draft-cutler-httpbis-partitioned-cookies-00.html>.
+
=head2 path
my $path = $cookie->path;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mojolicious-9.48/lib/Mojolicious/Sessions.pm
new/Mojolicious-9.49/lib/Mojolicious/Sessions.pm
--- old/Mojolicious-9.48/lib/Mojolicious/Sessions.pm 2025-10-01
16:39:19.000000000 +0200
+++ new/Mojolicious-9.49/lib/Mojolicious/Sessions.pm 2026-08-10
01:54:19.000000000 +0200
@@ -4,7 +4,7 @@
use Mojo::JSON;
use Mojo::Util qw(b64_decode b64_encode);
-has [qw(cookie_domain encrypted secure)];
+has [qw(cookie_domain encrypted partitioned secure)];
has cookie_name => 'mojolicious';
has cookie_path => '/';
has default_expiration => 3600;
@@ -52,12 +52,13 @@
my $value = b64_encode $self->serialize->($session), '';
$value =~ y/=/-/;
my $options = {
- domain => $self->cookie_domain,
- expires => $session->{expires},
- httponly => 1,
- path => $self->cookie_path,
- samesite => $self->samesite,
- secure => $self->secure
+ domain => $self->cookie_domain,
+ expires => $session->{expires},
+ httponly => 1,
+ partitioned => $self->partitioned,
+ path => $self->cookie_path,
+ samesite => $self->samesite,
+ secure => $self->secure,
};
my $method = $self->encrypted ? 'encrypted_cookie' : 'signed_cookie';
$c->$method($self->cookie_name, $value, $options);
@@ -149,6 +150,18 @@
Use encrypted session cookies instead of merely cryptographically signed ones.
+=head2 partitioned
+
+ my $bool = $sessions->partitioned;
+ $sessions = $sessions->partitioned($bool);
+
+Partitioned flag, this is to be used in accordance to the CHIPS amendment to
RFC 6265.
+Note that this attribute is B<EXPERIMENTAL> because even though most commonly
used browsers support the
+feature, there is no specification yet besides L<this
+draft|https://www.ietf.org/archive/id/draft-cutler-httpbis-partitioned-cookies-00.html>.
+
+Partitioned cookies are held within a separate cookie jar per top-level site.
+
=head2 samesite
my $samesite = $sessions->samesite;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mojolicious-9.48/lib/Mojolicious.pm
new/Mojolicious-9.49/lib/Mojolicious.pm
--- old/Mojolicious-9.48/lib/Mojolicious.pm 2026-07-05 16:02:24.000000000
+0200
+++ new/Mojolicious-9.49/lib/Mojolicious.pm 2026-07-14 14:53:45.000000000
+0200
@@ -57,7 +57,7 @@
has validator => sub { Mojolicious::Validator->new };
our $CODENAME = 'Waffle';
-our $VERSION = '9.48';
+our $VERSION = '9.49';
sub BUILD_DYNAMIC {
my ($class, $method, $dyn_methods) = @_;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mojolicious-9.48/t/mojo/cookie.t
new/Mojolicious-9.49/t/mojo/cookie.t
--- old/Mojolicious-9.48/t/mojo/cookie.t 2023-11-23 19:13:07.000000000
+0100
+++ new/Mojolicious-9.49/t/mojo/cookie.t 2026-08-10 01:54:19.000000000
+0200
@@ -168,13 +168,14 @@
$cookie->value('ba r');
$cookie->domain('example.com');
$cookie->path('/test');
+ $cookie->partitioned(1);
$cookie->max_age(60);
$cookie->expires(1218092879);
$cookie->secure(1);
$cookie->httponly(1);
$cookie->samesite('Lax');
is $cookie->to_string, '0="ba r"; expires=Thu, 07 Aug 2008 07:07:59 GMT;
domain=example.com;'
- . ' path=/test; secure; HttpOnly; SameSite=Lax; Max-Age=60', 'right
format';
+ . ' path=/test; Partitioned; secure; HttpOnly; SameSite=Lax; Max-Age=60',
'right format';
};
subtest 'Empty response cookie' => sub {
@@ -216,6 +217,16 @@
is $cookies->[1], undef, 'no more cookies';
};
+subtest 'Partitioned cookie (RFC 6265 CHIPS)' => sub {
+ my $cookies = Mojo::Cookie::Response->parse('foo="bar"; Domain=example.com;
Partitioned; Path=/test;'
+ . 'Max-Age=60; Expires=Thu, 07 Aug 2008 07:07:59 GMT; Secure;');
+ is $cookies->[0]->partitioned, 1, 'right partitioned value';
+
+ $cookies = Mojo::Cookie::Response->parse(
+ 'foo="bar"; Domain=example.com; Path=/test; Max-Age=60; Expires=Thu, 07
Aug 2008 07:07:59 GMT; Secure;');
+ is $cookies->[0]->partitioned, undef, 'no partitioned value';
+};
+
subtest 'Parse response cookie with invalid flag (RFC 6265)' => sub {
my $cookies = Mojo::Cookie::Response->parse(
'foo="ba r"; Domain=.example.com; Path=/test; Max-Age=60;' . '
Expires=Thu, 07 Aug 2008 07:07:59 GMT; InSecure;');
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.5K4z9R/_old 2026-08-19 17:57:46.070807666 +0200
+++ /var/tmp/diff_new_pack.5K4z9R/_new 2026-08-19 17:57:46.074807809 +0200
@@ -1,6 +1,6 @@
-mtime: 1784127264
-commit: c4d329c531d49a3eac7b713f705ebdb8e0d4bfb55b2b81a27b789623c08d24f4
+mtime: 1786342990
+commit: bc39cbbac6582a7ed624a7c1dac0d4ad6af49906e60cd92a11733a43eb334ec6
url: https://src.opensuse.org/perl/perl-Mojolicious
-revision: c4d329c531d49a3eac7b713f705ebdb8e0d4bfb55b2b81a27b789623c08d24f4
+revision: bc39cbbac6582a7ed624a7c1dac0d4ad6af49906e60cd92a11733a43eb334ec6
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-08-10 08:23:10.000000000 +0200
@@ -0,0 +1 @@
+.osc
