Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Cpanel-JSON-XS for
openSUSE:Factory checked in at 2026-10-21 20:53:47
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Cpanel-JSON-XS (Old)
and /work/SRC/openSUSE:Factory/.perl-Cpanel-JSON-XS.new.2252680 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Cpanel-JSON-XS"
Wed Oct 21 20:53:47 2026 rev:48 rq:1386514 version:4.800.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Cpanel-JSON-XS/perl-Cpanel-JSON-XS.changes
2026-09-18 22:05:05.013934777 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Cpanel-JSON-XS.new.2252680/perl-Cpanel-JSON-XS.changes
2026-10-21 20:54:06.923473736 +0200
@@ -1,0 +2,77 @@
+Thu Oct 15 09:56:08 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 4.800.0 (4.80)
+ see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes
+
+ 4.80 2026-09-?? (rurban)
+ - Security fixes, reported by Stig Palmquist (CPANSec):
+ * CVE-2026-110672 decode: free the hash key on "Duplicate keys not
+ allowed" and on a missing ':' (leak). bsc#1286166
+ * CVE-2026-110673 decode: charge allow_tags "(" nesting against
+ max_depth (stack overflow). bsc#1286167
+ * CVE-2026-110674 decode: look bare keys up as UTF-8, so the
+ duplicate check no longer misses or crashes on non-ASCII keys.
bsc#1286168
+ * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like
+ quoted keys (malformed keys). bsc#1286169
+ * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat
+ values with huge exponents (30MB from 12 bytes). bsc#1286170
+ * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference
+ counts (leaked every array). bsc#1286173
+ * CVE-2026-110678 incr_parse: apply max_size to the buffered text
+ in every context. bsc#1286174
+ * CVE-2026-110680 encode: bound the canonical key snapshot for
+ growing tied or shared hashes (overflow). bsc#1286175
+ * CVE-2026-110681 new: clone the callbacks and buffer SVs on
+ ithread clone instead of sharing the parent's pointers. bsc#1286176
+ * CVE-2026-110682 incr_parse: reject a top-level number, true,
+ false or null unless allow_nonref was set explicitly, as
+ chunking changes their value. Strings, arrays and objects are
+ unchanged. bsc#1286177
+ * CVE-2026-110684 encode: release the temporary references when
+ stringifying overloaded objects (leak). bsc#1286179
+ * CVE-2026-110685 decode_tag: free the tag and its arguments when
+ THAW dies (leak). bsc#1286180
+ * CVE-2026-110686 decode: keep the filter callbacks alive while
+ they run (use-after-free when a filter removes itself). bsc#1286181
+ * CVE-2026-110687 canonical: sort byte-string keys as Latin-1.
bsc#1286182
+ * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of
+ the decoded text (quadratic CPU). bsc#1286183
+ - Add version markers to all module files. (PR #260 demerphq)
+ - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated
+ utf8n_to_uvuni API. (PR #260 demerphq)
+ - Add schema-based validation for decoded JSON (GH #238):
+ Cpanel::JSON::XS::Type now provides check_type($data, $schema[,
+ $found_type]), which validates an already-decoded perl structure
+ against a type spec built from the existing encoder building
+ blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /
+ json_type_anyof), plus the new json_type_optional() for hash keys
+ that may be absent, and short scalar type name sugar ('Str',
+ 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)
+ so a schema reads as "just a hash of keys and types", as
+ requested. Unlike the encoder's hash type spec, a plain hashref
+ schema is closed: unknown keys and missing required keys are
+ reported. New $json->decode_and_validate($json_text, $schema)
+ method decodes and croaks with all mismatches if validation
+ fails, using decode()'s own type introspection as ground truth to
+ avoid perl's usual dual-var/stringified-number ambiguity.
+ - json_type_optional() and the nullable '?' type-name suffixes
+ ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way
+ to declare a key/value as optional instead of demanding a
+ complete type specification for every key. The encoder now also
+ understands json_type_optional() directly (it unwraps to the
+ wrapped type, since encode() only ever sees keys that are
+ actually present): the exact same type spec built for
+ check_type()/decode_and_validate() can now be handed to encode()
+ as-is, instead of croaking with "no type was specified for hash
+ key '...'" for every optional key. Encoding stays strict by
+ default otherwise: a hash key with no entry at all in the type
+ spec still croaks (GH #242).
+ eg/bench_large.pl:
+ old encode: 20.5–22.9/s decode: 16.2–16.5/s for 4.53
+ new encode: 21.1–22.5/s decode: 15.7–16.3/s for 4.80
+
+ 4.53 2026-09-28 (rurban)
+ - Fix C90 violations with arm neon (GH #258 rjbs)
+ - Added a native arm64 test runner.
+
+-------------------------------------------------------------------
Old:
----
Cpanel-JSON-XS-4.52.tar.gz
New:
----
Cpanel-JSON-XS-4.80.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Cpanel-JSON-XS.spec ++++++
--- /var/tmp/diff_new_pack.TmLfC9/_old 2026-10-21 20:54:07.633503844 +0200
+++ /var/tmp/diff_new_pack.TmLfC9/_new 2026-10-21 20:54:07.638504056 +0200
@@ -18,10 +18,10 @@
%define cpan_name Cpanel-JSON-XS
Name: perl-Cpanel-JSON-XS
-Version: 4.520.0
+Version: 4.800.0
Release: 0
-# 4.52 -> normalize -> 4.520.0
-%define cpan_version 4.52
+# 4.80 -> normalize -> 4.800.0
+%define cpan_version 4.80
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: CPanel fork of JSON::XS, fast and correct serializing
URL: https://metacpan.org/release/%{cpan_name}
@@ -32,7 +32,8 @@
BuildRequires: perl-macros
BuildRequires: perl(Time::Piece)
Provides: perl(Cpanel::JSON::XS) = %{version}
-Provides: perl(Cpanel::JSON::XS::Type)
+Provides: perl(Cpanel::JSON::XS::Boolean) = %{version}
+Provides: perl(Cpanel::JSON::XS::Type) = %{version}
%undefine __perllib_provides
%{perl_requires}
++++++ Cpanel-JSON-XS-4.52.tar.gz -> Cpanel-JSON-XS-4.80.tar.gz ++++++
++++ 2175 lines of diff (skipped)
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.TmLfC9/_old 2026-10-21 20:54:07.973518262 +0200
+++ /var/tmp/diff_new_pack.TmLfC9/_new 2026-10-21 20:54:07.977518432 +0200
@@ -1,6 +1,6 @@
-mtime: 1789466948
-commit: f6a9d1bfa39f340efa60f597919e71d852b68c85ecb41f8296d5aed5b631fbd2
+mtime: 1792506013
+commit: 67667a1e3bfcc5596a278d0d4940242a7463c5999c612ab4ac1ef5a8819b0451
url: https://src.opensuse.org/perl/perl-Cpanel-JSON-XS
-revision: f6a9d1bfa39f340efa60f597919e71d852b68c85ecb41f8296d5aed5b631fbd2
+revision: 67667a1e3bfcc5596a278d0d4940242a7463c5999c612ab4ac1ef5a8819b0451
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-10-20 16:20:13.000000000 +0200
@@ -0,0 +1 @@
+.osc
