Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-DBI for openSUSE:Factory checked in at 2026-10-02 23:02:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-DBI (Old) and /work/SRC/openSUSE:Factory/.perl-DBI.new.1631729 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-DBI" Fri Oct 2 23:02:25 2026 rev:62 rq:1381947 version:1.655.0 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-DBI/perl-DBI.changes 2026-09-18 22:03:41.117418683 +0200 +++ /work/SRC/openSUSE:Factory/.perl-DBI.new.1631729/perl-DBI.changes 2026-10-02 23:03:00.987470857 +0200 @@ -1,0 +2,17 @@ +Wed Sep 30 11:11:31 UTC 2026 - Tina Müller <[email protected]> + +- updated to 1.655.0 (1.655) + see /usr/share/doc/packages/perl-DBI/ChangeLog + + 1.655 - 2026-09-30, H.Merijn Brand & Robert Rothenberg + * Fix for C89 (Paul Howarth, PR#197) + * Ignore invalid handles consistently (detected by Raj) + + 1.654 - 2026-09-25, H.Merijn Brand & Robert Rothenberg + * Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815) (reported by Raj) + bsc#1283055 + * Fix FetchHashKeyName on IV/NV (CVE-2026-88816) (reported by Raj) + bsc#1283056 + * Fix provided in META + +------------------------------------------------------------------- Old: ---- DBI-1.653.tgz New: ---- DBI-1.655.tgz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-DBI.spec ++++++ --- /var/tmp/diff_new_pack.U8ZCGN/_old 2026-10-02 23:03:01.932510411 +0200 +++ /var/tmp/diff_new_pack.U8ZCGN/_new 2026-10-02 23:03:01.936510578 +0200 @@ -18,10 +18,10 @@ %define cpan_name DBI Name: perl-DBI -Version: 1.653.0 +Version: 1.655.0 Release: 0 -# 1.653 -> normalize -> 1.653.0 -%define cpan_version 1.653 +# 1.655 -> normalize -> 1.655.0 +%define cpan_version 1.655 License: Artistic-1.0 OR GPL-1.0-or-later Summary: Database independent interface for Perl URL: https://metacpan.org/release/%{cpan_name} @@ -38,58 +38,22 @@ Requires: perl(Module::Load) >= 0.22 Provides: perl(Bundle::DBI) = 12.8.696 Provides: perl(DBD::DBM) = 0.80.0 -Provides: perl(DBD::DBM::Statement) -Provides: perl(DBD::DBM::Table) -Provides: perl(DBD::DBM::db) -Provides: perl(DBD::DBM::dr) -Provides: perl(DBD::DBM::st) Provides: perl(DBD::ExampleP) = 12.14.311 -Provides: perl(DBD::ExampleP::db) -Provides: perl(DBD::ExampleP::dr) -Provides: perl(DBD::ExampleP::st) Provides: perl(DBD::File) = 0.450.0 -Provides: perl(DBD::File::DataSource::File) -Provides: perl(DBD::File::DataSource::Stream) -Provides: perl(DBD::File::Statement) -Provides: perl(DBD::File::Table) -Provides: perl(DBD::File::TableSource::FileSystem) -Provides: perl(DBD::File::db) -Provides: perl(DBD::File::dr) -Provides: perl(DBD::File::st) Provides: perl(DBD::Gofer) = 0.15.327 Provides: perl(DBD::Gofer::Policy::Base) = 0.10.88 Provides: perl(DBD::Gofer::Policy::classic) = 0.10.88 Provides: perl(DBD::Gofer::Policy::pedantic) = 0.10.88 Provides: perl(DBD::Gofer::Policy::rush) = 0.10.88 Provides: perl(DBD::Gofer::Transport::Base) = 0.14.121 -Provides: perl(DBD::Gofer::Transport::corostream) +Provides: perl(DBD::Gofer::Transport::corostream) = 2.165.300 Provides: perl(DBD::Gofer::Transport::null) = 0.10.88 Provides: perl(DBD::Gofer::Transport::pipeone) = 0.10.88 Provides: perl(DBD::Gofer::Transport::stream) = 0.14.599 -Provides: perl(DBD::Gofer::db) -Provides: perl(DBD::Gofer::dr) -Provides: perl(DBD::Gofer::st) Provides: perl(DBD::Mem) = 0.1.0 -Provides: perl(DBD::Mem::DataSource) -Provides: perl(DBD::Mem::Statement) -Provides: perl(DBD::Mem::Table) -Provides: perl(DBD::Mem::db) -Provides: perl(DBD::Mem::dr) -Provides: perl(DBD::Mem::st) Provides: perl(DBD::NullP) = 12.14.715 -Provides: perl(DBD::NullP::db) -Provides: perl(DBD::NullP::dr) -Provides: perl(DBD::NullP::st) Provides: perl(DBD::Proxy) = 0.200.400 -Provides: perl(DBD::Proxy::RPC::PlClient) -Provides: perl(DBD::Proxy::db) -Provides: perl(DBD::Proxy::dr) -Provides: perl(DBD::Proxy::st) Provides: perl(DBD::Sponge) = 12.10.3 -Provides: perl(DBD::Sponge::db) -Provides: perl(DBD::Sponge::dr) -Provides: perl(DBD::Sponge::st) -Provides: perl(DBDI) Provides: perl(DBI) = %{version} Provides: perl(DBI::Const::GetInfo::ANSI) = 2.8.697 Provides: perl(DBI::Const::GetInfo::ODBC) = 2.11.374 @@ -98,15 +62,6 @@ Provides: perl(DBI::DBD) = 12.15.129 Provides: perl(DBI::DBD::Metadata) = 2.14.214 Provides: perl(DBI::DBD::SqlEngine) = 0.60.0 -Provides: perl(DBI::DBD::SqlEngine::DataSource) -Provides: perl(DBI::DBD::SqlEngine::Statement) -Provides: perl(DBI::DBD::SqlEngine::Table) -Provides: perl(DBI::DBD::SqlEngine::TableSource) -Provides: perl(DBI::DBD::SqlEngine::TieMeta) -Provides: perl(DBI::DBD::SqlEngine::TieTables) -Provides: perl(DBI::DBD::SqlEngine::db) -Provides: perl(DBI::DBD::SqlEngine::dr) -Provides: perl(DBI::DBD::SqlEngine::st) Provides: perl(DBI::Gofer::Execute) = 0.14.283 Provides: perl(DBI::Gofer::Request) = 0.12.537 Provides: perl(DBI::Gofer::Response) = 0.11.566 @@ -122,14 +77,9 @@ Provides: perl(DBI::ProfileDumper::Apache) = 2.14.121 Provides: perl(DBI::ProfileSubs) = 0.9.396 Provides: perl(DBI::ProxyServer) = 0.300.500 -Provides: perl(DBI::ProxyServer::db) -Provides: perl(DBI::ProxyServer::dr) -Provides: perl(DBI::ProxyServer::st) +Provides: perl(DBI::PurePerl) = 2.14.286 Provides: perl(DBI::SQL::Nano) = 1.15.544 -Provides: perl(DBI::SQL::Nano::Statement_) -Provides: perl(DBI::SQL::Nano::Table_) Provides: perl(DBI::Util::CacheMemory) = 0.10.315 -Provides: perl(DBI::common) %undefine __perllib_provides Recommends: perl(Encode) >= 3.24 %{perl_requires} ++++++ DBI-1.653.tgz -> DBI-1.655.tgz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/ChangeLog new/DBI-1.655/ChangeLog --- old/DBI-1.653/ChangeLog 2026-09-09 13:15:14.000000000 +0200 +++ new/DBI-1.655/ChangeLog 2026-09-30 10:54:32.000000000 +0200 @@ -1,3 +1,12 @@ +1.655 - 2026-09-30, H.Merijn Brand & Robert Rothenberg + * Fix for C89 (Paul Howarth, PR#197) + * Ignore invalid handles consistently (detected by Raj) + +1.654 - 2026-09-25, H.Merijn Brand & Robert Rothenberg + * Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815) (reported by Raj) + * Fix FetchHashKeyName on IV/NV (CVE-2026-88816) (reported by Raj) + * Fix provided in META + 1.653 - 2026-09-09, H.Merijn Brand & Robert Rothenberg * Fix test for 32bit-perl (report in PR#189) * Fix arbitrary module and file loading via dbm_type/dbm_mldbm (CVE-2026-78030) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/DBI.pm new/DBI-1.655/DBI.pm --- old/DBI-1.653/DBI.pm 2026-08-28 13:25:16.000000000 +0200 +++ new/DBI-1.655/DBI.pm 2026-09-25 15:13:27.000000000 +0200 @@ -16,7 +16,7 @@ our ($XS_VERSION, $VERSION); BEGIN { -$VERSION = "1.653"; # ==> ALSO update the version in the pod text below! +$VERSION = "1.655"; # ==> ALSO update the version in the pod text below! $XS_VERSION = $VERSION; $VERSION =~ tr/_//d; } @@ -148,7 +148,7 @@ =head2 NOTES -This is the DBI specification that corresponds to DBI version 1.653 +This is the DBI specification that corresponds to DBI version 1.655 (see L<DBI::Changes> for details). The DBI is evolving at a steady pace, so it's good to check that diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/DBI.xs new/DBI-1.655/DBI.xs --- old/DBI-1.653/DBI.xs 2026-08-18 09:35:44.000000000 +0200 +++ new/DBI-1.655/DBI.xs 2026-09-28 14:48:27.000000000 +0200 @@ -1925,6 +1925,8 @@ int cast_ok = 0; int grok_flags; UV uv; + STRLEN len; + char *p; /* do nothing for undef (NULL) or non-string values */ if (!sv || !SvOK(sv)) @@ -1957,8 +1959,9 @@ /* else no error and sv is untouched */ case SQL_NUMERIC: /* based on the code in perl's toke.c */ + p = SvPV(sv, len); /* force stringify, handle magic */ uv = 0; - grok_flags = grok_number(SvPVX(sv), SvCUR(sv), &uv); + grok_flags = grok_number(p, len, &uv); cast_ok = 1; if (grok_flags == IS_NUMBER_IN_UV) { /* +ve int */ if (uv <= IV_MAX) /* prefer IV over UV */ @@ -5304,7 +5307,7 @@ if (!keyattrib || !*keyattrib) { SV *kn = DBIc_FetchHashKeyName(imp_sth); if (kn && SvOK(kn)) - keyattrib = SvPVX(kn); + keyattrib = SvPV_nolen(kn); /* Also force stringification */ else keyattrib = "NAME"; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/Driver.xst new/DBI-1.655/Driver.xst --- old/DBI-1.653/Driver.xst 2026-05-28 14:03:05.000000000 +0200 +++ new/DBI-1.655/Driver.xst 2026-09-28 13:55:30.000000000 +0200 @@ -164,12 +164,16 @@ sth = mg->mg_obj; } else { + MAGIC *mg; sth = dbixst_bounce_method("prepare", 3); SPAGAIN; SP -= items; /* because stack might have been realloc'd */ if (!SvROK(sth)) XSRETURN_UNDEF; /* switch to inner handle */ - sth = mg_find(SvRV(sth),'P')->mg_obj; + mg = mg_find(SvRV(sth),'P'); + if (!mg) + XSRETURN_UNDEF; + sth = mg->mg_obj; } imp_sth = (imp_sth_t*)(DBIh_COM(sth)); /* --- bind_param --- */ @@ -204,10 +208,14 @@ MAGIC *mg; sth = ST(1); /* switch to inner handle if not already */ - if ( (mg = mg_find(SvRV(sth),'P')) ) - sth = mg->mg_obj; + mg = mg_find(SvRV(sth),'P'); + if (!mg) { + if (is_selectrow_array) { XSRETURN_EMPTY; } else { XSRETURN_UNDEF; } + } + sth = mg->mg_obj; } else { + MAGIC *mg; /* --- prepare --- */ sth = dbixst_bounce_method("prepare", 3); SPAGAIN; SP -= items; /* because stack might have been realloc'd */ @@ -215,7 +223,11 @@ if (is_selectrow_array) { XSRETURN_EMPTY; } else { XSRETURN_UNDEF; } } /* switch to inner handle */ - sth = mg_find(SvRV(sth),'P')->mg_obj; + mg = mg_find(SvRV(sth),'P'); + if (!mg) { + if (is_selectrow_array) { XSRETURN_EMPTY; } else { XSRETURN_UNDEF; } + } + sth = mg->mg_obj; } imp_sth = (imp_sth_t*)(DBIh_COM(sth)); /* --- bind_param --- */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/META.json new/DBI-1.655/META.json --- old/DBI-1.653/META.json 2026-09-09 16:01:28.000000000 +0200 +++ new/DBI-1.655/META.json 2026-09-30 12:46:14.000000000 +0200 @@ -1,58 +1,233 @@ { - "abstract" : "Database independent interface for Perl", + "meta-spec" : { + "version" : 2, + "url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec"; + }, "generated_by" : "Author", - "version" : "1.653", + "dynamic_config" : 1, "provides" : { + "DBI::Gofer::Serializer::Storable" : { + "version" : "0.015586", + "file" : "lib/DBI/Gofer/Serializer/Storable.pm" + }, + "DBD::ExampleP" : { + "file" : "lib/DBD/ExampleP.pm", + "version" : "12.014311" + }, + "DBI::Gofer::Transport::pipeone" : { + "file" : "lib/DBI/Gofer/Transport/pipeone.pm", + "version" : "0.012537" + }, + "DBI::Const::GetInfoType" : { + "file" : "lib/DBI/Const/GetInfoType.pm", + "version" : "2.008697" + }, + "DBI::ProfileDumper" : { + "version" : "2.015325", + "file" : "lib/DBI/ProfileDumper.pm" + }, + "DBD::Sponge" : { + "file" : "lib/DBD/Sponge.pm", + "version" : "12.010003" + }, + "DBI::Const::GetInfo::ANSI" : { + "version" : "2.008697", + "file" : "lib/DBI/Const/GetInfo/ANSI.pm" + }, + "DBI::Gofer::Request" : { + "file" : "lib/DBI/Gofer/Request.pm", + "version" : "0.012537" + }, + "DBI::Gofer::Response" : { + "version" : "0.011566", + "file" : "lib/DBI/Gofer/Response.pm" + }, + "DBD::DBM" : { + "file" : "lib/DBD/DBM.pm", + "version" : "0.08" + }, + "DBI::ProxyServer" : { + "file" : "lib/DBI/ProxyServer.pm", + "version" : "0.3005" + }, + "DBI::DBD::Metadata" : { + "version" : "2.014214", + "file" : "lib/DBI/DBD/Metadata.pm" + }, + "DBI::ProfileSubs" : { + "file" : "lib/DBI/ProfileSubs.pm", + "version" : "0.009396" + }, + "DBI::ProfileData" : { + "version" : "2.010008", + "file" : "lib/DBI/ProfileData.pm" + }, + "DBI::ProfileDumper::Apache" : { + "file" : "lib/DBI/ProfileDumper/Apache.pm", + "version" : "2.014121" + }, + "DBD::Gofer" : { + "version" : "0.015327", + "file" : "lib/DBD/Gofer.pm" + }, + "DBI::Util::CacheMemory" : { + "file" : "lib/DBI/Util/CacheMemory.pm", + "version" : "0.010315" + }, + "DBD::Proxy" : { + "version" : "0.2004", + "file" : "lib/DBD/Proxy.pm" + }, + "DBD::File" : { + "version" : "0.45", + "file" : "lib/DBD/File.pm" + }, + "DBD::NullP" : { + "file" : "lib/DBD/NullP.pm", + "version" : "12.014715" + }, + "Bundle::DBI" : { + "version" : "12.008696", + "file" : "lib/Bundle/DBI.pm" + }, + "DBD::Gofer::Transport::Base" : { + "file" : "lib/DBD/Gofer/Transport/Base.pm", + "version" : "0.014121" + }, + "DBI::Const::GetInfoReturn" : { + "file" : "lib/DBI/Const/GetInfoReturn.pm", + "version" : "2.008697" + }, + "DBI::PurePerl" : { + "version" : "2.014286", + "file" : "lib/DBI/PurePerl.pm" + }, + "DBI::Gofer::Execute" : { + "version" : "0.014283", + "file" : "lib/DBI/Gofer/Execute.pm" + }, + "DBD::Gofer::Transport::null" : { + "version" : "0.010088", + "file" : "lib/DBD/Gofer/Transport/null.pm" + }, + "DBD::Mem" : { + "file" : "lib/DBD/Mem.pm", + "version" : "0.001" + }, + "DBD::Gofer::Policy::classic" : { + "version" : "0.010088", + "file" : "lib/DBD/Gofer/Policy/classic.pm" + }, + "DBI::SQL::Nano" : { + "file" : "lib/DBI/SQL/Nano.pm", + "version" : "1.015544" + }, + "DBI::Gofer::Transport::Base" : { + "version" : "0.012537", + "file" : "lib/DBI/Gofer/Transport/Base.pm" + }, + "DBD::Gofer::Transport::stream" : { + "version" : "0.014599", + "file" : "lib/DBD/Gofer/Transport/stream.pm" + }, + "DBD::Gofer::Transport::pipeone" : { + "version" : "0.010088", + "file" : "lib/DBD/Gofer/Transport/pipeone.pm" + }, + "DBI::Gofer::Serializer::Base" : { + "file" : "lib/DBI/Gofer/Serializer/Base.pm", + "version" : "0.009950" + }, + "DBI::DBD::SqlEngine" : { + "file" : "lib/DBI/DBD/SqlEngine.pm", + "version" : "0.06" + }, + "DBD::Gofer::Policy::Base" : { + "file" : "lib/DBD/Gofer/Policy/Base.pm", + "version" : "0.010088" + }, + "DBD::Gofer::Transport::corostream" : { + "file" : "lib/DBD/Gofer/Transport/corostream.pm", + "version" : "2.165300" + }, + "DBI::Profile" : { + "file" : "lib/DBI/Profile.pm", + "version" : "2.015065" + }, + "DBD::Gofer::Policy::pedantic" : { + "file" : "lib/DBD/Gofer/Policy/pedantic.pm", + "version" : "0.010088" + }, + "DBD::Gofer::Policy::rush" : { + "version" : "0.010088", + "file" : "lib/DBD/Gofer/Policy/rush.pm" + }, + "DBI::Const::GetInfo::ODBC" : { + "file" : "lib/DBI/Const/GetInfo/ODBC.pm", + "version" : "2.011374" + }, + "DBI::DBD" : { + "file" : "lib/DBI/DBD.pm", + "version" : "12.015129" + }, + "DBI::Gofer::Serializer::DataDumper" : { + "file" : "lib/DBI/Gofer/Serializer/DataDumper.pm", + "version" : "0.009950" + }, "DBI" : { - "version" : "1.653", + "version" : "1.655", "file" : "DBI.pm" + }, + "DBI::Gofer::Transport::stream" : { + "version" : "0.012537", + "file" : "lib/DBI/Gofer/Transport/stream.pm" } }, + "abstract" : "Database independent interface for Perl", "license" : [ "perl_5" ], - "meta-spec" : { - "url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec";, - "version" : 2 - }, - "dynamic_config" : 1, + "author" : [ + "DBI team ([email protected])" + ], "release_status" : "stable", + "version" : "1.655", "prereqs" : { - "configure" : { + "runtime" : { + "suggests" : { + "SQL::Statement" : "1.414", + "Net::Daemon" : "0.52", + "DB_File" : "0", + "Params::Util" : "1.102", + "MLDBM" : "0", + "Module::Load" : "0.36", + "RPC::PlServer" : "0.2020", + "Clone" : "0.50", + "RPC::PlClient" : "0.2020" + }, "recommends" : { - "ExtUtils::MakeMaker" : "7.78" + "Encode" : "3.24" }, "requires" : { - "ExtUtils::MakeMaker" : "6.48" + "Module::Load" : "0.22", + "perl" : "5.012000", + "XSLoader" : "0" } }, "test" : { - "recommends" : { - "Test::More" : "1.302224" - }, "requires" : { "Test::More" : "0.96" + }, + "recommends" : { + "Test::More" : "1.302225" } }, - "runtime" : { + "configure" : { "recommends" : { - "Encode" : "3.24" - }, - "suggests" : { - "Net::Daemon" : "0.52", - "MLDBM" : "0", - "RPC::PlServer" : "0.2020", - "Clone" : "0.50", - "Params::Util" : "1.102", - "RPC::PlClient" : "0.2020", - "SQL::Statement" : "1.414", - "DB_File" : "0", - "Module::Load" : "0.36" + "ExtUtils::MakeMaker" : "7.78" }, "requires" : { - "XSLoader" : "0", - "Module::Load" : "0.22", - "perl" : "5.012000" + "ExtUtils::MakeMaker" : "6.48" } }, "build" : { @@ -61,22 +236,19 @@ } } }, - "author" : [ - "DBI team ([email protected])" - ], "name" : "DBI", "resources" : { "bugtracker" : { "web" : "https://github.com/perl5-dbi/dbi/issues"; }, + "x_IRC" : "irc://irc.perl.org/#dbi", "license" : [ "http://dev.perl.org/licenses/"; ], "repository" : { - "web" : "https://github.com/perl5-dbi/dbi";, "type" : "git", + "web" : "https://github.com/perl5-dbi/dbi";, "url" : "https://github.com/perl5-dbi/dbi"; - }, - "x_IRC" : "irc://irc.perl.org/#dbi" + } } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/META.yml new/DBI-1.655/META.yml --- old/DBI-1.653/META.yml 2026-09-09 16:01:28.000000000 +0200 +++ new/DBI-1.655/META.yml 2026-09-30 12:46:14.000000000 +0200 @@ -7,19 +7,148 @@ configure_requires: ExtUtils::MakeMaker: '6.48' dynamic_config: 1 -generated_by: Author, CPAN::Meta::Converter version 2.150013 +generated_by: Author, CPAN::Meta::Converter version 2.150015 license: perl meta-spec: url: http://module-build.sourceforge.net/META-spec-v1.4.html version: '1.4' name: DBI provides: + Bundle::DBI: + file: lib/Bundle/DBI.pm + version: '12.008696' + DBD::DBM: + file: lib/DBD/DBM.pm + version: '0.08' + DBD::ExampleP: + file: lib/DBD/ExampleP.pm + version: '12.014311' + DBD::File: + file: lib/DBD/File.pm + version: '0.45' + DBD::Gofer: + file: lib/DBD/Gofer.pm + version: '0.015327' + DBD::Gofer::Policy::Base: + file: lib/DBD/Gofer/Policy/Base.pm + version: '0.010088' + DBD::Gofer::Policy::classic: + file: lib/DBD/Gofer/Policy/classic.pm + version: '0.010088' + DBD::Gofer::Policy::pedantic: + file: lib/DBD/Gofer/Policy/pedantic.pm + version: '0.010088' + DBD::Gofer::Policy::rush: + file: lib/DBD/Gofer/Policy/rush.pm + version: '0.010088' + DBD::Gofer::Transport::Base: + file: lib/DBD/Gofer/Transport/Base.pm + version: '0.014121' + DBD::Gofer::Transport::corostream: + file: lib/DBD/Gofer/Transport/corostream.pm + version: '2.165300' + DBD::Gofer::Transport::null: + file: lib/DBD/Gofer/Transport/null.pm + version: '0.010088' + DBD::Gofer::Transport::pipeone: + file: lib/DBD/Gofer/Transport/pipeone.pm + version: '0.010088' + DBD::Gofer::Transport::stream: + file: lib/DBD/Gofer/Transport/stream.pm + version: '0.014599' + DBD::Mem: + file: lib/DBD/Mem.pm + version: '0.001' + DBD::NullP: + file: lib/DBD/NullP.pm + version: '12.014715' + DBD::Proxy: + file: lib/DBD/Proxy.pm + version: '0.2004' + DBD::Sponge: + file: lib/DBD/Sponge.pm + version: '12.010003' DBI: file: DBI.pm - version: '1.653' + version: '1.655' + DBI::Const::GetInfo::ANSI: + file: lib/DBI/Const/GetInfo/ANSI.pm + version: '2.008697' + DBI::Const::GetInfo::ODBC: + file: lib/DBI/Const/GetInfo/ODBC.pm + version: '2.011374' + DBI::Const::GetInfoReturn: + file: lib/DBI/Const/GetInfoReturn.pm + version: '2.008697' + DBI::Const::GetInfoType: + file: lib/DBI/Const/GetInfoType.pm + version: '2.008697' + DBI::DBD: + file: lib/DBI/DBD.pm + version: '12.015129' + DBI::DBD::Metadata: + file: lib/DBI/DBD/Metadata.pm + version: '2.014214' + DBI::DBD::SqlEngine: + file: lib/DBI/DBD/SqlEngine.pm + version: '0.06' + DBI::Gofer::Execute: + file: lib/DBI/Gofer/Execute.pm + version: '0.014283' + DBI::Gofer::Request: + file: lib/DBI/Gofer/Request.pm + version: '0.012537' + DBI::Gofer::Response: + file: lib/DBI/Gofer/Response.pm + version: '0.011566' + DBI::Gofer::Serializer::Base: + file: lib/DBI/Gofer/Serializer/Base.pm + version: '0.009950' + DBI::Gofer::Serializer::DataDumper: + file: lib/DBI/Gofer/Serializer/DataDumper.pm + version: '0.009950' + DBI::Gofer::Serializer::Storable: + file: lib/DBI/Gofer/Serializer/Storable.pm + version: '0.015586' + DBI::Gofer::Transport::Base: + file: lib/DBI/Gofer/Transport/Base.pm + version: '0.012537' + DBI::Gofer::Transport::pipeone: + file: lib/DBI/Gofer/Transport/pipeone.pm + version: '0.012537' + DBI::Gofer::Transport::stream: + file: lib/DBI/Gofer/Transport/stream.pm + version: '0.012537' + DBI::Profile: + file: lib/DBI/Profile.pm + version: '2.015065' + DBI::ProfileData: + file: lib/DBI/ProfileData.pm + version: '2.010008' + DBI::ProfileDumper: + file: lib/DBI/ProfileDumper.pm + version: '2.015325' + DBI::ProfileDumper::Apache: + file: lib/DBI/ProfileDumper/Apache.pm + version: '2.014121' + DBI::ProfileSubs: + file: lib/DBI/ProfileSubs.pm + version: '0.009396' + DBI::ProxyServer: + file: lib/DBI/ProxyServer.pm + version: '0.3005' + DBI::PurePerl: + file: lib/DBI/PurePerl.pm + version: '2.014286' + DBI::SQL::Nano: + file: lib/DBI/SQL/Nano.pm + version: '1.015544' + DBI::Util::CacheMemory: + file: lib/DBI/Util/CacheMemory.pm + version: '0.010315' recommends: Encode: '3.24' - Test::More: '1.302224' + Test::More: '1.302225' requires: Module::Load: '0.22' Test::More: '0.96' @@ -30,4 +159,4 @@ bugtracker: https://github.com/perl5-dbi/dbi/issues license: http://dev.perl.org/licenses/ repository: https://github.com/perl5-dbi/dbi -version: '1.653' +version: '1.655' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/cpanfile new/DBI-1.655/cpanfile --- old/DBI-1.653/cpanfile 2026-09-09 16:01:27.000000000 +0200 +++ new/DBI-1.655/cpanfile 2026-09-30 12:46:13.000000000 +0200 @@ -22,5 +22,5 @@ on "test" => sub { requires "Test::More" => "0.96"; - recommends "Test::More" => "1.302224"; + recommends "Test::More" => "1.302225"; }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/dbixs_rev.h new/DBI-1.655/dbixs_rev.h --- old/DBI-1.653/dbixs_rev.h 2026-09-09 16:01:22.000000000 +0200 +++ new/DBI-1.655/dbixs_rev.h 2026-09-30 12:46:08.000000000 +0200 @@ -1,4 +1,4 @@ -/* Wed Sep 9 16:01:22 2026 */ +/* Wed Sep 30 12:46:08 2026 */ #define DBIXS_RELEASE 1 -#define DBIXS_VERSION 653 -#define DBIXS_REVISION 1831 +#define DBIXS_VERSION 655 +#define DBIXS_REVISION 1845 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/lib/DBD/Gofer/Transport/corostream.pm new/DBI-1.655/lib/DBD/Gofer/Transport/corostream.pm --- old/DBI-1.653/lib/DBD/Gofer/Transport/corostream.pm 2013-04-05 08:08:36.000000000 +0200 +++ new/DBI-1.655/lib/DBD/Gofer/Transport/corostream.pm 2026-09-09 17:16:08.000000000 +0200 @@ -3,6 +3,8 @@ use strict; use warnings; +our $VERSION = "2.165300"; + use Carp; use Coro::Select; # a slow but coro-aware replacement for CORE::select (global effect!) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/lib/DBI/Changes.pm new/DBI-1.655/lib/DBI/Changes.pm --- old/DBI-1.653/lib/DBI/Changes.pm 2026-09-09 13:16:00.000000000 +0200 +++ new/DBI-1.655/lib/DBI/Changes.pm 2026-09-30 10:54:42.000000000 +0200 @@ -12,6 +12,38 @@ =encoding UTF-8 +=head2 Changes in DBI 1.655 - 30 Sep 2026 + +=over 2 + +=item * + +Fix for C89 (Paul Howarth, PR#197) + +=item * + +Ignore invalid handles consistently (detected by Raj) + +=back + +=head2 Changes in DBI 1.654 - 25 Sep 2026 + +=over 2 + +=item * + +Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815) (reported by Raj) + +=item * + +Fix FetchHashKeyName on IV/NV (CVE-2026-88816) (reported by Raj) + +=item * + +Fix provided in META + +=back + =head2 Changes in DBI 1.653 - 09 Sep 2026 =over 2 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/t/06attrs.t new/DBI-1.655/t/06attrs.t --- old/DBI-1.653/t/06attrs.t 2026-07-13 10:46:31.000000000 +0200 +++ new/DBI-1.655/t/06attrs.t 2026-09-10 11:22:26.000000000 +0200 @@ -328,6 +328,17 @@ } +{ # CVE-2026-88816 + my $h = DBI->connect("dbi:ExampleP:", "", "", { RaiseError => 0, PrintError => 0 }); + $dbh->{FetchHashKeyName} = 42; + my $s = $dbh->prepare("select mode,size,name from ."); + $s->execute; + my @err; + local $SIG{__DIE__} = sub { push @err => @_ }; + eval { $s->fetchrow_hashref; }; + like($err[0], qr{Can't use (?:attribute '42'|an undefined)}, "Invalid HashKeyName"); +} + done_testing(); 1; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.653/t/90sql_type_cast.t new/DBI-1.655/t/90sql_type_cast.t --- old/DBI-1.653/t/90sql_type_cast.t 2026-07-22 14:24:41.000000000 +0200 +++ new/DBI-1.655/t/90sql_type_cast.t 2026-09-10 10:54:46.000000000 +0200 @@ -49,6 +49,22 @@ "aa", SQL_NUMERIC, 0, NO_CAST_NO_STRICT, q{["aa"]}], ['non numeric cast to numeric (strict)', "aa", SQL_NUMERIC, DBIstcf_STRICT, NO_CAST_STRICT, q{["aa"]}], + # CVE-2026-88815 + ['invalid sql type', + 99, 123456789, 0, INVALID_TYPE, q{[99]}], + ['small int cast to int', + 99, SQL_INTEGER, 0, CAST_OK, q{[99]}], + ['2 byte max signed int cast to int', + 32767, SQL_INTEGER, 0, CAST_OK, q{[32767]}], + ['2 byte max unsigned int cast to int', + 65535, SQL_INTEGER, 0, CAST_OK, q{[65535]}], + ['4 byte max signed int cast to int', + 2147483647, SQL_INTEGER, 0, CAST_OK, q{[2147483647]}], + ['4 byte max unsigned int cast to int', + 4294967295, SQL_INTEGER, 0, CAST_OK, q{[4294967295]}], + ['small int cast to int (discard)', + 99, SQL_INTEGER, DBIstcf_DISCARD_STRING, + CAST_OK, q{[99]}], ); unless ($pp) { ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.U8ZCGN/_old 2026-10-02 23:03:02.275524767 +0200 +++ /var/tmp/diff_new_pack.U8ZCGN/_new 2026-10-02 23:03:02.280524976 +0200 @@ -1,7 +1,7 @@ -mtime: 1789655113 -commit: a5679b1de7140779dfd22422f4f41438468d2f41fa1ba7c890bb0dfd1fd72e37 +mtime: 1790872044 +commit: a313f90fd85df4c4fe2843c09105f7aac204913fdfc6806e1f071657c9f71c5c url: https://src.opensuse.org/perl/perl-DBI -revision: a5679b1de7140779dfd22422f4f41438468d2f41fa1ba7c890bb0dfd1fd72e37 +revision: a313f90fd85df4c4fe2843c09105f7aac204913fdfc6806e1f071657c9f71c5c trackingbranch: main projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-01 18:27:24.000000000 +0200 @@ -0,0 +1 @@ +.osc
