Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Sereal-Encoder for
openSUSE:Factory checked in at 2026-09-01 15:47:18
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Sereal-Encoder (Old)
and /work/SRC/openSUSE:Factory/.perl-Sereal-Encoder.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Sereal-Encoder"
Tue Sep 1 15:47:18 2026 rev:17 rq:1374863 version:5.10.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Sereal-Encoder/perl-Sereal-Encoder.changes
2026-06-03 20:25:54.173873656 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Sereal-Encoder.new.1265/perl-Sereal-Encoder.changes
2026-09-01 15:48:26.510934770 +0200
@@ -1,0 +2,18 @@
+Thu Aug 6 07:52:35 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 5.10.0 (5.010)
+ see /usr/share/doc/packages/perl-Sereal-Encoder/Changes
+
+ 5.010
+ * Released to match Decoder version.
+ 5.009
+ * Only use Perl's C<$Config{ccflags}> when building bundled zstd on
+ AIX / IBM toolchains, or when C<SEREAL_ZSTD_USE_CONFIG_CCFLAGS> is
+ set. Other platforms now use the normal zstd build flags again.
+ 5.008
+ * Released to match Decoder version.
+ 5.007
+ * Use $Config{ccflags} to compile ztd with. Should fix AIX.
+ Thanks to Thomas Seeling for the suggestion.
+
+-------------------------------------------------------------------
Old:
----
Sereal-Encoder-5.006.tar.gz
New:
----
Sereal-Encoder-5.010.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Sereal-Encoder.spec ++++++
--- /var/tmp/diff_new_pack.jm9Wep/_old 2026-09-01 15:48:27.216959402 +0200
+++ /var/tmp/diff_new_pack.jm9Wep/_new 2026-09-01 15:48:27.217959436 +0200
@@ -18,10 +18,10 @@
%define cpan_name Sereal-Encoder
Name: perl-Sereal-Encoder
-Version: 5.6.0
+Version: 5.10.0
Release: 0
-# 5.006 -> normalize -> 5.6.0
-%define cpan_version 5.006
+# 5.010 -> normalize -> 5.10.0
+%define cpan_version 5.010
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: Binary serialization module for Perl (encoder part)
URL: https://metacpan.org/release/%{cpan_name}
@@ -33,13 +33,13 @@
BuildRequires: perl(Devel::CheckLib) >= 1.160
BuildRequires: perl(ExtUtils::MakeMaker) >= 7.0
BuildRequires: perl(ExtUtils::ParseXS) >= 2.21
-BuildRequires: perl(Sereal::Decoder) >= 5.6
+BuildRequires: perl(Sereal::Decoder) >= 5.10
BuildRequires: perl(Test::Deep)
BuildRequires: perl(Test::Differences)
BuildRequires: perl(Test::LongString)
BuildRequires: perl(Test::More) >= 0.88
BuildRequires: perl(Test::Warn)
-Requires: perl(Sereal::Decoder) >= 5.6
+Requires: perl(Sereal::Decoder) >= 5.10
Provides: perl(Sereal::Encoder) = %{version}
Provides: perl(Sereal::Encoder::Constants) = %{version}
%undefine __perllib_provides
++++++ Sereal-Encoder-5.006.tar.gz -> Sereal-Encoder-5.010.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/Changes
new/Sereal-Encoder-5.010/Changes
--- old/Sereal-Encoder-5.006/Changes 2026-05-20 11:41:11.000000000 +0200
+++ new/Sereal-Encoder-5.010/Changes 2026-08-05 13:51:27.000000000 +0200
@@ -5,6 +5,21 @@
* of the decoder before upgrading to version 5 of the *
* encoder! *
****************************************************************
+5.010
+ * Released to match Decoder version.
+
+5.009
+ * Only use Perl's C<$Config{ccflags}> when building bundled zstd on
+ AIX / IBM toolchains, or when C<SEREAL_ZSTD_USE_CONFIG_CCFLAGS> is
+ set. Other platforms now use the normal zstd build flags again.
+
+5.008
+ * Released to match Decoder version.
+
+5.007
+ * Use $Config{ccflags} to compile ztd with. Should fix AIX.
+ Thanks to Thomas Seeling for the suggestion.
+
5.006
* Use miniz 3.1.1
* Avoid deprecated ZSTD api.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/Encoder.xs
new/Sereal-Encoder-5.010/Encoder.xs
--- old/Sereal-Encoder-5.006/Encoder.xs 2023-04-18 15:53:15.000000000 +0200
+++ new/Sereal-Encoder-5.010/Encoder.xs 2026-07-10 12:47:32.000000000 +0200
@@ -190,6 +190,8 @@
SRL_INIT_OPTION( SRL_ENC_OPT_IDX_USE_PROTOCOL_V1,
SRL_ENC_OPT_STR_USE_PROTOCOL_V1 );
SRL_INIT_OPTION( SRL_ENC_OPT_IDX_WARN_UNKNOWN,
SRL_ENC_OPT_STR_WARN_UNKNOWN );
SRL_INIT_OPTION( SRL_ENC_OPT_IDX_USE_STANDARD_DOUBLE,
SRL_ENC_OPT_STR_USE_STANDARD_DOUBLE );
+ SRL_INIT_OPTION( SRL_ENC_OPT_IDX_FREEZE_ALLOW_CLASSES,
SRL_ENC_OPT_STR_FREEZE_ALLOW_CLASSES );
+ SRL_INIT_OPTION( SRL_ENC_OPT_IDX_FREEZE_DENY_ACTION,
SRL_ENC_OPT_STR_FREEZE_DENY_ACTION );
}
#if USE_CUSTOM_OPS
{
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/MANIFEST
new/Sereal-Encoder-5.010/MANIFEST
--- old/Sereal-Encoder-5.006/MANIFEST 2026-05-20 11:44:31.000000000 +0200
+++ new/Sereal-Encoder-5.010/MANIFEST 2026-08-05 13:54:53.000000000 +0200
@@ -60,6 +60,7 @@
t/110_nobless.t
t/120_hdr_data.t
t/130_freezethaw.t
+t/131_freeze_allow.t
t/160_recursion.t
t/170_cyclic_weakrefs.t
t/180_magic_array.t
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/META.json
new/Sereal-Encoder-5.010/META.json
--- old/Sereal-Encoder-5.006/META.json 2026-05-20 11:44:30.000000000 +0200
+++ new/Sereal-Encoder-5.010/META.json 2026-08-05 13:54:53.000000000 +0200
@@ -4,7 +4,7 @@
"Steffen Mueller <[email protected]>, Yves Orton <[email protected]>"
],
"dynamic_config" : 1,
- "generated_by" : "ExtUtils::MakeMaker version 7.62, CPAN::Meta::Converter
version 2.150010",
+ "generated_by" : "ExtUtils::MakeMaker version 7.64, CPAN::Meta::Converter
version 2.150010",
"license" : [
"perl_5"
],
@@ -33,7 +33,7 @@
},
"runtime" : {
"requires" : {
- "Sereal::Decoder" : "5.006",
+ "Sereal::Decoder" : "5.01",
"XSLoader" : "0",
"perl" : "5.008"
}
@@ -44,7 +44,7 @@
"File::Spec" : "0",
"Hash::Util" : "0",
"Scalar::Util" : "0",
- "Sereal::Decoder" : "5.006",
+ "Sereal::Decoder" : "5.01",
"Test::Deep" : "0",
"Test::Differences" : "0",
"Test::LongString" : "0",
@@ -63,6 +63,6 @@
"url" : "git://github.com/Sereal/Sereal.git"
}
},
- "version" : "5.006",
- "x_serialization_backend" : "JSON::PP version 4.06"
+ "version" : "5.010",
+ "x_serialization_backend" : "JSON::PP version 4.07"
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/META.yml
new/Sereal-Encoder-5.010/META.yml
--- old/Sereal-Encoder-5.006/META.yml 2026-05-20 11:44:30.000000000 +0200
+++ new/Sereal-Encoder-5.010/META.yml 2026-08-05 13:54:53.000000000 +0200
@@ -8,7 +8,7 @@
File::Spec: '0'
Hash::Util: '0'
Scalar::Util: '0'
- Sereal::Decoder: '5.006'
+ Sereal::Decoder: '5.01'
Test::Deep: '0'
Test::Differences: '0'
Test::LongString: '0'
@@ -18,7 +18,7 @@
Devel::CheckLib: '1.16'
ExtUtils::MakeMaker: '7.0'
dynamic_config: 1
-generated_by: 'ExtUtils::MakeMaker version 7.62, CPAN::Meta::Converter version
2.150010'
+generated_by: 'ExtUtils::MakeMaker version 7.64, CPAN::Meta::Converter version
2.150010'
license: perl
meta-spec:
url: http://module-build.sourceforge.net/META-spec-v1.4.html
@@ -29,11 +29,11 @@
- t
- inc
requires:
- Sereal::Decoder: '5.006'
+ Sereal::Decoder: '5.01'
XSLoader: '0'
perl: '5.008'
resources:
bugtracker: https://github.com/Sereal/Sereal/issues
repository: git://github.com/Sereal/Sereal.git
-version: '5.006'
+version: '5.010'
x_serialization_backend: 'CPAN::Meta::YAML version 0.018'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/Makefile.PL
new/Sereal-Encoder-5.010/Makefile.PL
--- old/Sereal-Encoder-5.006/Makefile.PL 2026-05-20 11:41:17.000000000
+0200
+++ new/Sereal-Encoder-5.010/Makefile.PL 2026-08-05 13:52:37.000000000
+0200
@@ -6,7 +6,7 @@
use ExtUtils::MakeMaker;
use Config;
-our $VERSION = '5.006'; # what version are we and what version of Decoder
do we need.
+our $VERSION = '5.010'; # what version are we and what version of Decoder
do we need.
$VERSION = eval $VERSION or die "WTF: $VERSION: $@"; # deal with underbars
my $shared_dir = "../shared";
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/lib/Sereal/Encoder/Constants.pm
new/Sereal-Encoder-5.010/lib/Sereal/Encoder/Constants.pm
--- old/Sereal-Encoder-5.006/lib/Sereal/Encoder/Constants.pm 2026-05-20
11:41:17.000000000 +0200
+++ new/Sereal-Encoder-5.010/lib/Sereal/Encoder/Constants.pm 2026-08-05
13:52:37.000000000 +0200
@@ -4,7 +4,7 @@
require Exporter;
our @ISA = qw(Exporter);
-our $VERSION = '5.006';
+our $VERSION = '5.010';
our ( @EXPORT_OK, %DEFINE, %TAG_INFO_HASH, @TAG_INFO_ARRAY );
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/lib/Sereal/Encoder.pm
new/Sereal-Encoder-5.010/lib/Sereal/Encoder.pm
--- old/Sereal-Encoder-5.006/lib/Sereal/Encoder.pm 2026-05-20
11:41:17.000000000 +0200
+++ new/Sereal-Encoder-5.010/lib/Sereal/Encoder.pm 2026-08-05
13:52:37.000000000 +0200
@@ -5,7 +5,7 @@
use Carp qw/croak/;
use XSLoader;
-our $VERSION = '5.006';
+our $VERSION = '5.010';
our $XS_VERSION = $VERSION; $VERSION = eval $VERSION;
# Make sure to keep these constants in sync with the C code in srl_encoder.c.
@@ -33,6 +33,7 @@
'SRL_F_DEDUPE_STRINGS' => 2048,
'SRL_F_ENABLE_FREEZE_SUPPORT' => 16384,
'SRL_F_ENCODER_COMPRESS_FLAGS_MASK' => 262592,
+ 'SRL_F_FREEZE_DENY_SERIALIZE' => 1048576,
'SRL_F_NOWARN_UNKNOWN_OVERLOAD' => 512,
'SRL_F_NO_BLESS_OBJECTS' => 8192,
'SRL_F_REUSE_ENCODER' => 2,
@@ -270,6 +271,43 @@
method, the additional method look up will cost a small amount of runtime.
Yes, C<Sereal::Encoder> is so fast that this may make a difference.
+=head3 freeze_allow_classes
+
+An allow-list restricting which classes may have their C<FREEZE> method
+invoked. Setting this option implies C<freeze_callbacks> (so you do not need to
+enable both). It may be one of:
+
+=over 4
+
+=item * an array ref of class names, e.g. C<< ['My::Class', 'Other::Class'] >>
+
+=item * a hash ref whose keys with a true value are the allowed class names,
+e.g. C<< { 'My::Class' => 1 } >>
+
+=item * a code ref predicate, called as C<< $cb->($classname, $object) >> for
+each object that has a C<FREEZE> method, that returns a true value to allow
+C<FREEZE>
+
+=back
+
+Classes that do not have a C<FREEZE> method are unaffected (they serialize as
+usual). When an object's class has a C<FREEZE> method but is not allowed, the
+behaviour is controlled by L</freeze_deny_action>.
+
+=head3 freeze_deny_action
+
+Controls what happens when C<freeze_allow_classes> is set and an object whose
+class has a C<FREEZE> method is B<not> allowed. Accepts a string:
+
+=over 4
+
+=item * C<'croak'> (the default) - throw an exception.
+
+=item * C<'serialize'> - do not call C<FREEZE>; serialize the object normally
+(as an ordinary blessed reference).
+
+=back
+
=head3 no_bless_objects
If this option is set, then the encoder will serialize blessed references
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/srl_encoder.c
new/Sereal-Encoder-5.010/srl_encoder.c
--- old/Sereal-Encoder-5.006/srl_encoder.c 2023-04-18 15:53:15.000000000
+0200
+++ new/Sereal-Encoder-5.010/srl_encoder.c 2026-07-10 12:47:32.000000000
+0200
@@ -94,6 +94,7 @@
SRL_STATIC_INLINE void srl_dump_ivuv(pTHX_ srl_encoder_t *enc, SV *src);
SRL_STATIC_INLINE int srl_dump_classname(pTHX_ srl_encoder_t *enc, SV
*referent, SV *replacement);
SRL_STATIC_INLINE SV *srl_get_frozen_object(pTHX_ srl_encoder_t *enc, SV *src,
SV *referent);
+SRL_STATIC_INLINE int srl_freeze_class_allowed(pTHX_ srl_encoder_t *enc, HV
*stash, SV *src);
SRL_STATIC_INLINE PTABLE_t *srl_init_string_hash(srl_encoder_t *enc);
SRL_STATIC_INLINE PTABLE_t *srl_init_ref_hash(srl_encoder_t *enc);
SRL_STATIC_INLINE PTABLE_t *srl_init_freezeobj_svhash(srl_encoder_t *enc);
@@ -412,6 +413,10 @@
PTABLE_free(enc->weak_seenhash);
if (enc->string_deduper_hv != NULL)
SvREFCNT_dec(enc->string_deduper_hv);
+ if (enc->freeze_allow_hash != NULL)
+ SvREFCNT_dec((SV*)enc->freeze_allow_hash);
+ if (enc->freeze_allow_cb != NULL)
+ SvREFCNT_dec(enc->freeze_allow_cb);
SvREFCNT_dec(enc->sereal_string_sv);
SvREFCNT_dec(enc->scratch_sv);
@@ -496,13 +501,74 @@
if ( val && SvTRUE(val) )
SRL_ENC_SET_OPTION(enc, SRL_F_NO_BLESS_OBJECTS);
- my_hv_fetchs(he, val, opt, SRL_ENC_OPT_IDX_FREEZE_CALLBACKS);
- if ( val && SvTRUE(val) ) {
- if (SRL_ENC_HAVE_OPTION(enc, SRL_F_NO_BLESS_OBJECTS))
- croak("The no_bless_objects and freeze_callback_support "
- "options are mutually exclusive");
- SRL_ENC_SET_OPTION(enc, SRL_F_ENABLE_FREEZE_SUPPORT);
- enc->sereal_string_sv = newSVpvs("Sereal");
+ {
+ int want_freeze = 0;
+
+ my_hv_fetchs(he, val, opt, SRL_ENC_OPT_IDX_FREEZE_CALLBACKS);
+ if ( val && SvTRUE(val) )
+ want_freeze = 1;
+
+ /* freeze_allow_classes: only invoke FREEZE for the listed classes.
+ * Accepts an array ref (list of names), a hash ref (keys with a
+ * true value) or a code ref (predicate called with the class name
+ * and the object). Providing it implies freeze support. */
+ my_hv_fetchs(he, val, opt, SRL_ENC_OPT_IDX_FREEZE_ALLOW_CLASSES);
+ if ( val && SvOK(val) ) {
+ SV *rv = SvROK(val) ? SvRV(val) : NULL;
+ if (rv && SvTYPE(rv) == SVt_PVAV) {
+ AV *av = (AV*)rv;
+ SSize_t i, len = av_len(av) + 1;
+ enc->freeze_allow_hash = newHV();
+ for (i = 0; i < len; i++) {
+ SV **elem = av_fetch(av, i, 0);
+ if (elem && SvOK(*elem)) {
+ STRLEN klen;
+ char *kstr = SvPV(*elem, klen);
+ (void)hv_store(enc->freeze_allow_hash, kstr,
SvUTF8(*elem) ? -(I32)klen : (I32)klen, &PL_sv_yes, 0);
+ }
+ }
+ }
+ else if (rv && SvTYPE(rv) == SVt_PVHV) {
+ HV *src = (HV*)rv;
+ HE *ent;
+ enc->freeze_allow_hash = newHV();
+ hv_iterinit(src);
+ while ((ent = hv_iternext(src))) {
+ if (SvTRUE(HeVAL(ent))) {
+ STRLEN klen;
+ char *kstr = HePV(ent, klen);
+ (void)hv_store(enc->freeze_allow_hash, kstr,
HeUTF8(ent) ? -(I32)klen : (I32)klen, &PL_sv_yes, 0);
+ }
+ }
+ }
+ else if (rv && SvTYPE(rv) == SVt_PVCV) {
+ enc->freeze_allow_cb = newRV_inc(rv);
+ }
+ else {
+ croak("The 'freeze_allow_classes' option must be an array "
+ "ref, hash ref or code ref");
+ }
+ want_freeze = 1;
+ }
+
+ my_hv_fetchs(he, val, opt, SRL_ENC_OPT_IDX_FREEZE_DENY_ACTION);
+ if ( val && SvOK(val) ) {
+ STRLEN alen;
+ char *astr = SvPV(val, alen);
+ if (memEQs(astr, alen, "serialize"))
+ SRL_ENC_SET_OPTION(enc, SRL_F_FREEZE_DENY_SERIALIZE);
+ else if (!memEQs(astr, alen, "croak"))
+ croak("The 'freeze_deny_action' option must be 'croak' or
'serialize'");
+ }
+
+ if ( want_freeze ) {
+ if (SRL_ENC_HAVE_OPTION(enc, SRL_F_NO_BLESS_OBJECTS))
+ croak("The no_bless_objects option is mutually exclusive "
+ "with freeze support (freeze_callbacks / "
+ "freeze_allow_classes)");
+ SRL_ENC_SET_OPTION(enc, SRL_F_ENABLE_FREEZE_SUPPORT);
+ enc->sereal_string_sv = newSVpvs("Sereal");
+ }
}
my_hv_fetchs(he, val, opt, SRL_ENC_OPT_IDX_COMPRESS);
@@ -663,6 +729,15 @@
if (expect_false(SRL_ENC_HAVE_OPTION(enc, SRL_F_ENABLE_FREEZE_SUPPORT))) {
enc->sereal_string_sv = newSVpvs("Sereal");
}
+ /* freeze allow-list is immutable config; share it with the clone. */
+ if (proto->freeze_allow_hash) {
+ enc->freeze_allow_hash = proto->freeze_allow_hash;
+ SvREFCNT_inc((SV*)enc->freeze_allow_hash);
+ }
+ if (proto->freeze_allow_cb) {
+ enc->freeze_allow_cb = proto->freeze_allow_cb;
+ SvREFCNT_inc(enc->freeze_allow_cb);
+ }
enc->protocol_version = proto->protocol_version;
enc->scratch_sv= newSViv(0);
DEBUG_ASSERT_BUF_SANE(&enc->buf);
@@ -876,6 +951,60 @@
}
}
+/* Decide whether the given class is allowed to have its FREEZE method invoked,
+ * according to the freeze_allow_classes option. Returns true when no
allow-list
+ * is configured (the default), so ordinary encoding is unaffected. */
+SRL_STATIC_INLINE int
+srl_freeze_class_allowed(pTHX_ srl_encoder_t *enc, HV *stash, SV *src)
+{
+ const char *classname;
+ STRLEN classname_len;
+ int is_utf8;
+
+ if (!enc->freeze_allow_hash && !enc->freeze_allow_cb)
+ return 1; /* no allow-list configured: allow everything */
+
+ classname = HvNAME_get(stash);
+ classname_len = HvNAMELEN_get(stash);
+#if PERL_VERSION >= 16
+ is_utf8 = HvNAMEUTF8(stash) ? 1 : 0;
+#else
+ is_utf8 = 0;
+#endif
+
+ if (enc->freeze_allow_hash) {
+ return hv_exists(enc->freeze_allow_hash, classname,
+ is_utf8 ? -(I32)classname_len : (I32)classname_len) ?
1 : 0;
+ }
+ else {
+ /* code ref predicate: $cb->($classname, $object) */
+ int allowed = 0;
+ int count;
+ SV *name_sv;
+ dSP;
+
+ ENTER;
+ SAVETMPS;
+ PUSHMARK(SP);
+ EXTEND(SP, 2);
+ name_sv = sv_2mortal(newSVpvn(classname, classname_len));
+ if (is_utf8) SvUTF8_on(name_sv);
+ PUSHs(name_sv);
+ PUSHs(src);
+ PUTBACK;
+ count = call_sv(enc->freeze_allow_cb, G_SCALAR);
+ SPAGAIN;
+ if (count >= 1) {
+ SV *res = POPs;
+ allowed = SvTRUE(res) ? 1 : 0;
+ }
+ PUTBACK;
+ FREETMPS;
+ LEAVE;
+ return allowed;
+ }
+}
+
/* Dumps the tag and class name of an object doing all necessary callbacks or
* exception-throwing.
* The provided SV must already have been identified as a Perl object
@@ -896,7 +1025,19 @@
if (expect_false( method != NULL )) {
SV *replacement= NULL;
- PTABLE_t *freezeobj_svhash = SRL_GET_FREEZEOBJ_SVHASH(enc);
+ PTABLE_t *freezeobj_svhash;
+
+ /* Enforce the freeze allow-list (if any). A disallowed class
either
+ * croaks (default) or is serialized normally (freeze_deny_action
+ * => 'serialize'), which we signal by returning NULL here. */
+ if (expect_false( !srl_freeze_class_allowed(aTHX_ enc, stash, src)
)) {
+ if (SRL_ENC_HAVE_OPTION(enc, SRL_F_FREEZE_DENY_SERIALIZE))
+ return NULL;
+ croak("FREEZE not allowed for class '%s' (not in
freeze_allow_classes)",
+ HvNAME(stash));
+ }
+
+ freezeobj_svhash = SRL_GET_FREEZEOBJ_SVHASH(enc);
if (SvREFCNT(referent)>1) {
replacement= (SV *) PTABLE_fetch(freezeobj_svhash, referent);
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/srl_encoder.h
new/Sereal-Encoder-5.010/srl_encoder.h
--- old/Sereal-Encoder-5.006/srl_encoder.h 2023-04-18 15:53:15.000000000
+0200
+++ new/Sereal-Encoder-5.010/srl_encoder.h 2026-07-10 12:47:32.000000000
+0200
@@ -42,6 +42,9 @@
/* only used if SRL_F_ENABLE_FREEZE_SUPPORT is
set. */
SV *sereal_string_sv; /* SV that says "Sereal" for FREEZE support */
SV *scratch_sv; /* SV used by encoder for scratch operations */
+
+ HV *freeze_allow_hash; /* set of class names allowed to be FROZEN, or
NULL */
+ SV *freeze_allow_cb; /* coderef predicate (RV to CV) deciding FREEZE,
or NULL */
} srl_encoder_t;
typedef struct {
@@ -144,6 +147,11 @@
#define SRL_F_USE_STANDARD_DOUBLE 0x80000UL
+/* If set, an object whose class is not in the freeze allow-list is serialized
+ * normally (as a blessed reference) instead of via its FREEZE method. If not
+ * set (the default), a disallowed class causes an exception. */
+#define SRL_F_FREEZE_DENY_SERIALIZE 0x100000UL
+
/* ====================================================================
* oper flags
*/
@@ -248,6 +256,12 @@
#define SRL_ENC_OPT_STR_USE_STANDARD_DOUBLE "use_standard_double"
#define SRL_ENC_OPT_IDX_USE_STANDARD_DOUBLE 21
-#define SRL_ENC_OPT_COUNT 22
+#define SRL_ENC_OPT_STR_FREEZE_ALLOW_CLASSES "freeze_allow_classes"
+#define SRL_ENC_OPT_IDX_FREEZE_ALLOW_CLASSES 22
+
+#define SRL_ENC_OPT_STR_FREEZE_DENY_ACTION "freeze_deny_action"
+#define SRL_ENC_OPT_IDX_FREEZE_DENY_ACTION 23
+
+#define SRL_ENC_OPT_COUNT 24
#endif
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/t/131_freeze_allow.t
new/Sereal-Encoder-5.010/t/131_freeze_allow.t
--- old/Sereal-Encoder-5.006/t/131_freeze_allow.t 1970-01-01
01:00:00.000000000 +0100
+++ new/Sereal-Encoder-5.010/t/131_freeze_allow.t 2026-07-10
12:47:32.000000000 +0200
@@ -0,0 +1,197 @@
+#!perl
+use strict;
+use warnings;
+
+use File::Spec;
+use Test::More;
+use Data::Dumper;
+
+use lib File::Spec->catdir(qw(t lib));
+
+BEGIN {
+ lib->import('lib')
+ if !-d 't';
+}
+
+use Sereal::TestSet qw(:all);
+
+if ( !have_encoder_and_decoder() ) {
+ plan skip_all => 'Did not find right version of decoder';
+}
+
+our ( %FREEZE_CALLED, %THAW_CALLED );
+
+# Two classes with FREEZE/THAW plus one plain blessed class (no FREEZE).
+{
+
+ package FA::Allowed;
+ sub new { bless { n => $_[1] }, $_[0] }
+ sub FREEZE { $FREEZE_CALLED{'FA::Allowed'}++; return $_[0]->{n} }
+ sub THAW { $THAW_CALLED{'FA::Allowed'}++; my ( $c, $s, $n ) = @_; return
$c->new($n) }
+
+ package FA::Denied;
+ sub new { bless { n => $_[1] }, $_[0] }
+ sub FREEZE { $FREEZE_CALLED{'FA::Denied'}++; return $_[0]->{n} }
+ sub THAW { $THAW_CALLED{'FA::Denied'}++; my ( $c, $s, $n ) = @_; return
$c->new($n) }
+
+ package FA::Plain;
+ sub new { bless { n => $_[1] }, $_[0] } # no FREEZE method
+}
+
+my $dec = Sereal::Decoder->new();
+
+# 1. freeze_allow_classes implies freeze support: allowed class is FROZEN and
+# round-trips through THAW.
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my $enc = Sereal::Encoder->new( { freeze_allow_classes => ['FA::Allowed']
} );
+ my $blob = $enc->encode( FA::Allowed->new(11) );
+ ok( $FREEZE_CALLED{'FA::Allowed'}, 'allowed class: FREEZE was invoked
(freeze support auto-enabled)' );
+ my $o = $dec->decode($blob);
+ isa_ok( $o, 'FA::Allowed', 'allowed class round-trips' );
+ ok( $THAW_CALLED{'FA::Allowed'}, ' ... via THAW' );
+ is( $o->{n}, 11, ' ... with correct data' );
+}
+
+# 2. Disallowed class that has a FREEZE method croaks by default.
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my $enc = Sereal::Encoder->new( { freeze_allow_classes => ['FA::Allowed']
} );
+ ok( !eval { $enc->encode( FA::Denied->new(22) ); 1 },
+ 'disallowed class croaks (default action)' );
+ like( $@, qr/FREEZE not allowed for class 'FA::Denied'/, ' ... with a
helpful message' );
+ ok( !$FREEZE_CALLED{'FA::Denied'}, ' ... and FREEZE was never invoked' );
+}
+
+# 3. freeze_deny_action => 'serialize' serializes the disallowed object
normally.
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my $enc = Sereal::Encoder->new(
+ { freeze_allow_classes => ['FA::Allowed'],
+ freeze_deny_action => 'serialize',
+ }
+ );
+ my $blob = $enc->encode( FA::Denied->new(22) );
+ ok( !$FREEZE_CALLED{'FA::Denied'}, 'serialize action: FREEZE not invoked
for disallowed class' );
+ my $o = $dec->decode($blob);
+ isa_ok( $o, 'FA::Denied', 'serialize action: object serialized as a plain
blessed ref' );
+ ok( !$THAW_CALLED{'FA::Denied'}, ' ... and THAW was not called' );
+ is( $o->{n}, 22, ' ... structure preserved' );
+}
+
+# 4. Classes without a FREEZE method are unaffected by the allow-list.
+{
+ my $enc = Sereal::Encoder->new( { freeze_allow_classes => ['FA::Allowed']
} );
+ my $blob = $enc->encode( FA::Plain->new(33) );
+ my $o = $dec->decode($blob);
+ isa_ok( $o, 'FA::Plain', 'class without FREEZE is unaffected' );
+ is( $o->{n}, 33, ' ... structure preserved' );
+}
+
+# 5. Hash-ref and code-ref allow-list forms.
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my $enc = Sereal::Encoder->new( { freeze_allow_classes => { 'FA::Allowed'
=> 1 } } );
+ isa_ok( $dec->decode( $enc->encode( FA::Allowed->new(1) ) ),
'FA::Allowed', 'hash-ref allow works' );
+ ok( !eval { $enc->encode( FA::Denied->new(2) ); 1 }, 'hash-ref allow:
false/absent disallows' );
+}
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my @seen;
+ my $enc = Sereal::Encoder->new(
+ { freeze_allow_classes => sub { push @seen, [ $_[0], ref $_[1] ];
$_[0] eq 'FA::Allowed' } } );
+ isa_ok( $dec->decode( $enc->encode( FA::Allowed->new(1) ) ),
'FA::Allowed', 'code-ref allow works' );
+ is_deeply( $seen[0], [ 'FA::Allowed', 'FA::Allowed' ],
+ ' ... predicate received class name and the object' );
+ ok( !eval { $enc->encode( FA::Denied->new(2) ); 1 }, 'code-ref allow:
predicate false disallows' );
+}
+
+# 6. Bad option values are rejected at construction.
+{
+ ok( !eval { Sereal::Encoder->new( { freeze_allow_classes => 'scalar' } );
1 },
+ 'invalid freeze_allow_classes type croaks' );
+ ok( !eval {
+ Sereal::Encoder->new(
+ { freeze_allow_classes => ['FA::Allowed'], freeze_deny_action
=> 'nope' } );
+ 1;
+ },
+ 'invalid freeze_deny_action croaks'
+ );
+}
+
+# 7. A structure mixing an allowed and a disallowed object.
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my $enc = Sereal::Encoder->new( { freeze_allow_classes => ['FA::Allowed']
} );
+ ok( !eval { $enc->encode( [ FA::Allowed->new(1), FA::Denied->new(2) ] ); 1
},
+ 'mixed structure: a single disallowed member croaks the whole encode'
);
+
+ my $ser = Sereal::Encoder->new(
+ { freeze_allow_classes => ['FA::Allowed'], freeze_deny_action =>
'serialize' } );
+ my $out = $dec->decode( $ser->encode( [ FA::Allowed->new(1),
FA::Denied->new(2) ] ) );
+ isa_ok( $out->[0], 'FA::Allowed', 'mixed serialize: allowed member
frozen+thawed' );
+ isa_ok( $out->[1], 'FA::Denied', 'mixed serialize: disallowed member
serialized normally' );
+ ok( !$THAW_CALLED{'FA::Denied'}, ' ... and the disallowed member never
THAWed' );
+}
+
+# 8. Referential integrity: an allowed frozen object referenced twice is FROZEN
+# once and round-trips to a single shared instance.
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my $enc = Sereal::Encoder->new( { freeze_allow_classes => ['FA::Allowed']
} );
+ my $a = FA::Allowed->new(42);
+ my $out = $dec->decode( $enc->encode( [ $a, $a ] ) );
+ isa_ok( $out->[0], 'FA::Allowed', 'refint: allowed frozen object thawed' );
+ is( $out->[0], $out->[1], 'refint: both references are the same thawed
object' );
+ is( $FREEZE_CALLED{'FA::Allowed'}, 1, 'refint: FREEZE was invoked only
once' );
+}
+
+# 9. The functional interface honors the allow-list too.
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+ my $blob = Sereal::Encoder::encode_sereal( FA::Allowed->new(7),
+ { freeze_allow_classes => ['FA::Allowed'] } );
+ isa_ok( $dec->decode($blob), 'FA::Allowed', 'encode_sereal honors
freeze_allow_classes' );
+ ok( !eval {
+ Sereal::Encoder::encode_sereal( FA::Denied->new(8),
+ { freeze_allow_classes => ['FA::Allowed'] } );
+ 1;
+ },
+ 'encode_sereal enforces the deny action (croak)'
+ );
+}
+
+# 10. Re-entrancy: a FREEZE hook that re-invokes the same encoder must see the
+# allow-list on the cloned encoder struct.
+{
+
+ package FA::ReInner;
+ sub new { bless { v => $_[1] }, $_[0] }
+ sub FREEZE { $FREEZE_CALLED{'FA::ReInner'}++; return $_[0]->{v} }
+ sub THAW { my ( $c, $ser, $v ) = @_; return $c->new($v) }
+
+ package FA::ReOuter;
+ our $ENC;
+ sub new { bless {}, $_[0] }
+ sub FREEZE { return $ENC->encode( FA::ReInner->new(7) ) } # re-entrant
encode
+ sub THAW { my ( $c, $ser, $blob ) = @_; return bless { inner_blob =>
$blob }, $c }
+}
+{
+ local ( %FREEZE_CALLED, %THAW_CALLED );
+
+ # FA::ReInner is NOT allowed: the nested (cloned) encode must enforce it.
+ $FA::ReOuter::ENC = Sereal::Encoder->new( { freeze_allow_classes =>
['FA::ReOuter'] } );
+ ok( !eval { $FA::ReOuter::ENC->encode( FA::ReOuter->new ); 1 },
+ 're-entrant clone enforces the allow-list' );
+ like( $@, qr/FREEZE not allowed for class 'FA::ReInner'/,
+ ' ... naming the disallowed nested class' );
+
+ # Now allow the nested class too: the nested encode succeeds.
+ $FA::ReOuter::ENC =
+ Sereal::Encoder->new( { freeze_allow_classes => [ 'FA::ReOuter',
'FA::ReInner' ] } );
+ my $blob = eval { $FA::ReOuter::ENC->encode( FA::ReOuter->new ) };
+ ok( defined $blob && length $blob, 're-entrant clone allows a listed
nested class' );
+ ok( $FREEZE_CALLED{'FA::ReInner'}, ' ... and the nested FREEZE actually
ran' );
+}
+
+done_testing();
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Encoder-5.006/zstd/Makefile.PL
new/Sereal-Encoder-5.010/zstd/Makefile.PL
--- old/Sereal-Encoder-5.006/zstd/Makefile.PL 2026-05-20 11:16:17.000000000
+0200
+++ new/Sereal-Encoder-5.010/zstd/Makefile.PL 2026-07-17 09:45:25.000000000
+0200
@@ -17,6 +17,15 @@
my @source_files = @c_files;
my $disable_asm = "";
+my $use_config_ccflags =
+ $ENV{SEREAL_ZSTD_USE_CONFIG_CCFLAGS}
+ || $Config{osname} eq 'aix'
+ || $Config{cc} =~ /\b(?:xlc|xlclang|ibm)\b/i;
+my $zstd_cflags = $use_config_ccflags
+ ? $Config{ccflags}
+ : '-fPIC -Wall -Wextra -Wcast-qual -Wcast-align -Wshadow
-Wstrict-aliasing=1 '
+ . '-Wswitch-enum -Wdeclaration-after-statement -Wstrict-prototypes -Wundef
'
+ . '-Wpointer-arith';
if ( $ENV{NO_ASM} || $ENV{ZSTD_DISABLE_ASM} ) {
$disable_asm = "CPPFLAGS += -DZSTD_DISABLE_ASM\n";
}
@@ -62,9 +71,7 @@
CC = } . $Config{cc} . q{
CPPFLAGS+= -I. -I./common -DXXH_NAMESPACE=ZSTD_
CFLAGS ?= -O3
-CFLAGS += -fPIC -Wall -Wextra -Wcast-qual -Wcast-align -Wshadow
-Wstrict-aliasing=1 \
- -Wswitch-enum -Wdeclaration-after-statement -Wstrict-prototypes
-Wundef \
- -Wpointer-arith
+CFLAGS += } . $zstd_cflags . q{
CFLAGS += $(MOREFLAGS)
AR = ar
ARFLAGS = rcs
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.jm9Wep/_old 2026-09-01 15:48:27.453967670 +0200
+++ /var/tmp/diff_new_pack.jm9Wep/_new 2026-09-01 15:48:27.457967810 +0200
@@ -1,6 +1,6 @@
-mtime: 1779357938
-commit: 8315a70e4b0ba5f837394fd871570bef62143875c8a2f124d9414de44886157c
+mtime: 1786002755
+commit: 04d2afcf55e73e3cfeef6c2c733c50321bb9ae2d43e06a0b9a9d0335cb69c805
url: https://src.opensuse.org/perl/perl-Sereal-Encoder
-revision: 8315a70e4b0ba5f837394fd871570bef62143875c8a2f124d9414de44886157c
+revision: 04d2afcf55e73e3cfeef6c2c733c50321bb9ae2d43e06a0b9a9d0335cb69c805
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-08-06 09:52:35.000000000 +0200
@@ -0,0 +1 @@
+.osc
