Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-SQL-Abstract for openSUSE:Factory checked in at 2026-11-08 19:22:32 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-SQL-Abstract (Old) and /work/SRC/openSUSE:Factory/.perl-SQL-Abstract.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-SQL-Abstract" Sun Nov 8 19:22:32 2026 rev:18 rq:1396149 version:2.000003 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-SQL-Abstract/perl-SQL-Abstract.changes 2026-11-06 20:07:32.539295353 +0100 +++ /work/SRC/openSUSE:Factory/.perl-SQL-Abstract.new.3759290/perl-SQL-Abstract.changes 2026-11-08 19:23:04.263574733 +0100 @@ -1,0 +2,16 @@ +Fri Nov 6 22:07:18 UTC 2026 - Tina Müller <[email protected]> + +- updated to 2.000003 + see /usr/share/doc/packages/perl-SQL-Abstract/Changes + + 2.000003 - 2026-11-06 + - SECURITY, CVE-2026-121265: generate() (and so AUTOLOAD with + allow_autoload) also treats an arrayref in its hashref or arrayref + as one bind value. 2.000002 fixed only insert(), update() and + values(): generate('update t', { name => [ "(SELECT ...)" ] }) + still gave UPDATE T SET name = (SELECT ...). \[ $sql, @bind ] is + literal SQL in generate() too; array_datatypes => 0 restores the + old behaviour. + - every module has a $VERSION, the same as SQL::Abstract + +------------------------------------------------------------------- Old: ---- SQL-Abstract-2.000002.tar.gz New: ---- SQL-Abstract-2.000003.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-SQL-Abstract.spec ++++++ --- /var/tmp/diff_new_pack.mI3nVd/_old 2026-11-08 19:23:04.839598562 +0100 +++ /var/tmp/diff_new_pack.mI3nVd/_new 2026-11-08 19:23:04.841598645 +0100 @@ -18,7 +18,7 @@ %define cpan_name SQL-Abstract Name: perl-SQL-Abstract -Version: 2.000002 +Version: 2.000003 Release: 0 License: Artistic-1.0 OR GPL-1.0-or-later Summary: Generate SQL from Perl data structures ++++++ SQL-Abstract-2.000002.tar.gz -> SQL-Abstract-2.000003.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/Changes new/SQL-Abstract-2.000003/Changes --- old/SQL-Abstract-2.000002/Changes 2026-11-05 20:14:16.000000000 +0100 +++ new/SQL-Abstract-2.000003/Changes 2026-11-06 20:04:52.000000000 +0100 @@ -1,5 +1,15 @@ Revision history for SQL::Abstract +2.000003 - 2026-11-06 + - SECURITY, CVE-2026-121265: generate() (and so AUTOLOAD with + allow_autoload) also treats an arrayref in its hashref or arrayref + as one bind value. 2.000002 fixed only insert(), update() and + values(): generate('update t', { name => [ "(SELECT ...)" ] }) + still gave UPDATE T SET name = (SELECT ...). \[ $sql, @bind ] is + literal SQL in generate() too; array_datatypes => 0 restores the + old behaviour. + - every module has a $VERSION, the same as SQL::Abstract + 2.000002 - 2026-11-05 - SECURITY, CVE-2026-121265: array_datatypes is on by default, so an arrayref as a column value in insert() or update() (and values()) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/META.json new/SQL-Abstract-2.000003/META.json --- old/SQL-Abstract-2.000002/META.json 2026-11-05 20:19:44.000000000 +0100 +++ new/SQL-Abstract-2.000003/META.json 2026-11-06 20:08:19.000000000 +0100 @@ -83,6 +83,6 @@ }, "x_IRC" : "irc://irc.perl.org/#dbio" }, - "version" : "2.000002", + "version" : "2.000003", "x_serialization_backend" : "JSON::PP version 4.16" } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/META.yml new/SQL-Abstract-2.000003/META.yml --- old/SQL-Abstract-2.000002/META.yml 2026-11-05 20:19:44.000000000 +0100 +++ new/SQL-Abstract-2.000003/META.yml 2026-11-06 20:08:19.000000000 +0100 @@ -42,5 +42,5 @@ bugtracker: https://rt.cpan.org/Public/Dist/Display.html?Name=SQL-Abstract license: http://dev.perl.org/licenses/ repository: https://github.com/dbsrgits/sql-abstract.git -version: '2.000002' +version: '2.000003' x_serialization_backend: 'CPAN::Meta::YAML version 0.018' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/README new/SQL-Abstract-2.000003/README --- old/SQL-Abstract-2.000002/README 2026-11-05 20:19:45.000000000 +0100 +++ new/SQL-Abstract-2.000003/README 2026-11-06 20:08:20.000000000 +0100 @@ -401,8 +401,9 @@ array_datatypes On by default: an arrayref as a column value in INSERT or UPDATE - (and in "values") is one bind value, an array datatype passed - directly to the DBI layer. Literal SQL is "\[ $sql, @bind ]". + (and in "values" and "generate") is one bind value, an array + datatype passed directly to the DBI layer. Literal SQL is "\[ $sql, + @bind ]". "array_datatypes => 0" restores the behaviour from before 2.000002: the arrayref is literal SQL, its first element goes into the SQL @@ -545,6 +546,11 @@ You get the idea. Strings get their case twiddled, but everything else remains verbatim. + In a hashref or an arrayref, an arrayref is one bind value, as in + "insert" and "update" (see "array_datatypes"). Literal SQL is "\$sql" or + "\[ $sql, @bind ]". The second calling form puts every value into the + SQL text as-is, so use it only with values you trust. + EXPORTABLE FUNCTIONS is_plain_value Determines if the supplied argument is a plain value as understood by diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/SECURITY.md new/SQL-Abstract-2.000003/SECURITY.md --- old/SQL-Abstract-2.000002/SECURITY.md 2026-11-03 18:12:02.000000000 +0100 +++ new/SQL-Abstract-2.000003/SECURITY.md 2026-11-06 04:22:24.000000000 +0100 @@ -68,6 +68,9 @@ `quote_char`. - **Literal SQL is passed through as-is.** `\"..."` and `\["...", @bind]` are inserted verbatim by design. +- **`generate()` in scalar context** puts every value into the SQL text + (that is its documented second calling form). Call it in list context + to get bind values. - **Operator names** (`-op` keys, `special_ops`, `unary_ops`) are code, not data. Do not build them from untrusted input. - `injection_guard` is a last-resort check for a few obvious patterns, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/DBIx/Class/SQLMaker/Role/SQLA2Passthrough.pm new/SQL-Abstract-2.000003/lib/DBIx/Class/SQLMaker/Role/SQLA2Passthrough.pm --- old/SQL-Abstract-2.000002/lib/DBIx/Class/SQLMaker/Role/SQLA2Passthrough.pm 2026-09-21 23:06:16.000000000 +0200 +++ new/SQL-Abstract-2.000003/lib/DBIx/Class/SQLMaker/Role/SQLA2Passthrough.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package DBIx::Class::SQLMaker::Role::SQLA2Passthrough; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use strict; use warnings; use Exporter 'import'; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/DBIx/Class/Storage/Debug/PrettyPrint.pm new/SQL-Abstract-2.000003/lib/DBIx/Class/Storage/Debug/PrettyPrint.pm --- old/SQL-Abstract-2.000002/lib/DBIx/Class/Storage/Debug/PrettyPrint.pm 2026-09-21 23:06:16.000000000 +0200 +++ new/SQL-Abstract-2.000003/lib/DBIx/Class/Storage/Debug/PrettyPrint.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package DBIx::Class::Storage::Debug::PrettyPrint; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use strict; use warnings; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Formatter.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Formatter.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Formatter.pm 2026-11-03 07:01:32.000000000 +0100 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Formatter.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Formatter; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + require SQL::Abstract::Parts; # it loads us too, don't cross the streams use Moo; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Parts.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Parts.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Parts.pm 2026-09-22 08:09:35.000000000 +0200 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Parts.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Parts; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use Scalar::Util (); use strict; use warnings; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Plugin/BangOverrides.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Plugin/BangOverrides.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Plugin/BangOverrides.pm 2026-11-03 02:11:23.000000000 +0100 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Plugin/BangOverrides.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Plugin::BangOverrides; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use Moo; with 'SQL::Abstract::Role::Plugin'; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Plugin/ExtraClauses.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Plugin/ExtraClauses.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Plugin/ExtraClauses.pm 2026-09-22 06:56:48.000000000 +0200 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Plugin/ExtraClauses.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Plugin::ExtraClauses; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use Moo; with 'SQL::Abstract::Role::Plugin'; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Reference.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Reference.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Reference.pm 2026-09-22 04:42:41.000000000 +0200 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Reference.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Reference; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + 1; __END__ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Role/Plugin.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Role/Plugin.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Role/Plugin.pm 2026-09-08 17:32:42.000000000 +0200 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Role/Plugin.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Role::Plugin; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use Moo::Role; has sqla => ( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Test.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Test.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Test.pm 2026-09-08 17:32:42.000000000 +0200 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Test.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Test; # see doc at end of file +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use strict; use warnings; use base qw(Test::Builder::Module); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract/Tree.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract/Tree.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract/Tree.pm 2026-10-27 18:52:35.000000000 +0100 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract/Tree.pm 2026-11-06 04:43:22.000000000 +0100 @@ -1,5 +1,8 @@ package SQL::Abstract::Tree; +our $VERSION = '2.000003'; +$VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases + use Moo; no warnings 'qw'; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/lib/SQL/Abstract.pm new/SQL-Abstract-2.000003/lib/SQL/Abstract.pm --- old/SQL-Abstract-2.000002/lib/SQL/Abstract.pm 2026-11-05 19:43:08.000000000 +0100 +++ new/SQL-Abstract-2.000003/lib/SQL/Abstract.pm 2026-11-06 04:43:22.000000000 +0100 @@ -27,7 +27,7 @@ # GLOBALS #====================================================================== -our $VERSION = '2.000002'; +our $VERSION = '2.000003'; # This would confuse some packagers $VERSION = eval $VERSION if $VERSION =~ /_/; # numify for warning-free dev releases @@ -2139,9 +2139,13 @@ my $v = $_->{$k}; my $r = ref $v; my $label = $self->_quote($k); - if ($r eq 'ARRAY') { + if ($r eq 'ARRAY' && $self->{array_datatypes}) { + # array datatype: one bind value, like insert / update + push @sqlq, "$label = ?"; + push @sqlv, $self->_bindtype($k, $v); + } elsif ($r eq 'ARRAY' || $r eq 'REF' && ref $$v eq 'ARRAY') { # literal SQL with bind - my ($sql, @bind) = @$v; + my ($sql, @bind) = $r eq 'REF' ? @$$v : @$v; $self->_assert_bindval_matches_bindtype(@bind); push @sqlq, "$label = $sql"; push @sqlv, @bind; @@ -2158,8 +2162,13 @@ # unlike insert(), assume these are ONLY the column names, i.e. for SQL for my $v (@$_) { my $r = ref $v; - if ($r eq 'ARRAY') { # literal SQL with bind - my ($sql, @bind) = @$v; + if ($r eq 'ARRAY' && $self->{array_datatypes}) { + # array datatype: one bind value, like insert + push @sqlq, '?'; + push @sqlv, $v; + } elsif ($r eq 'ARRAY' || $r eq 'REF' && ref $$v eq 'ARRAY') { + # literal SQL with bind + my ($sql, @bind) = $r eq 'REF' ? @$$v : @$v; $self->_assert_bindval_matches_bindtype(@bind); push @sqlq, $sql; push @sqlv, @bind; @@ -2637,8 +2646,9 @@ =item array_datatypes On by default: an arrayref as a column value in INSERT or UPDATE -(and in C<values>) is one bind value, an array datatype passed -directly to the DBI layer. Literal SQL is C<\[ $sql, @bind ]>. +(and in C<values> and C<generate>) is one bind value, an array +datatype passed directly to the DBI layer. Literal SQL is +C<\[ $sql, @bind ]>. C<< array_datatypes => 0 >> restores the behaviour from before 2.000002: the arrayref is literal SQL, its first element goes into the @@ -2839,6 +2849,11 @@ You get the idea. Strings get their case twiddled, but everything else remains verbatim. +In a hashref or an arrayref, an arrayref is one bind value, as in +C<insert> and C<update> (see L</array_datatypes>). Literal SQL is +C<\$sql> or C<\[ $sql, @bind ]>. The second calling form puts every +value into the SQL text as-is, so use it only with values you trust. + =head1 EXPORTABLE FUNCTIONS =head2 is_plain_value diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SQL-Abstract-2.000002/t/28array_values_bound.t new/SQL-Abstract-2.000003/t/28array_values_bound.t --- old/SQL-Abstract-2.000002/t/28array_values_bound.t 2026-11-03 19:23:20.000000000 +0100 +++ new/SQL-Abstract-2.000003/t/28array_values_bound.t 2026-11-06 04:21:31.000000000 +0100 @@ -76,4 +76,55 @@ 'array_datatypes => 0: values() returns the binds of the literal', ); +# generate() and AUTOLOAD (allow_autoload) follow the same rule + +is_deeply( + [ $sqla->generate('update t', { name => [ $evil ] }) ], + [ 'UPDATE T SET name = ?', [ $evil ] ], + 'generate: arrayref in a hash is one bind value by default', +); + +is_deeply( + [ $sqla->generate('insert into t', [ 1, [ $evil ] ]) ], + [ 'INSERT INTO T (?, ?)', 1, [ $evil ] ], + 'generate: arrayref in a list of values is one bind value by default', +); + +is_deeply( + [ SQL::Abstract->new(bindtype => 'columns') + ->generate('update t', { name => [ $evil ] }) ], + [ 'UPDATE T SET name = ?', [ name => [ $evil ] ] ], + 'generate: arrayref bind value follows bindtype columns', +); + +is_deeply( + [ SQL::Abstract->new(allow_autoload => 1)->update_t({ name => [ $evil ] }) ], + [ 'UPDATE_T SET name = ?', [ $evil ] ], + 'AUTOLOAD: arrayref column value is one bind value by default', +); + +is_deeply( + [ $sqla->generate('update t', { a => \[ 'a + ?', 1 ] }) ], + [ 'UPDATE T SET a = a + ?', 1 ], + 'generate: \[ $sql, @bind ] in a hash is literal SQL', +); + +is_deeply( + [ $sqla->generate('insert into t', [ \[ 'lower(?)', 'X' ] ]) ], + [ 'INSERT INTO T (lower(?))', 'X' ], + 'generate: \[ $sql, @bind ] in a list of values is literal SQL', +); + +is_deeply( + [ $legacy->generate('update t', { a => [ 'a + ?', 1 ] }) ], + [ 'UPDATE T SET a = a + ?', 1 ], + 'array_datatypes => 0: generate keeps the arrayref in a hash as literal SQL', +); + +is_deeply( + [ $legacy->generate('insert into t', [ [ 'lower(?)', 'X' ] ]) ], + [ 'INSERT INTO T (lower(?))', 'X' ], + 'array_datatypes => 0: generate keeps the arrayref in a list as literal SQL', +); + done_testing; ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.mI3nVd/_old 2026-11-08 19:23:04.956603402 +0100 +++ /var/tmp/diff_new_pack.mI3nVd/_new 2026-11-08 19:23:04.959603526 +0100 @@ -1,6 +1,6 @@ -mtime: 1793975971 -commit: d1a0f4bc34098c2bb82e9436910b84ea2c76bc5e85d00125884e8a50e0f0546d +mtime: 1794002839 +commit: ccadd81dd13abf8ee6061778bc1e9adf5e895c8b96ceac7b9da60875b82c0290 url: https://src.opensuse.org/perl/perl-SQL-Abstract -revision: d1a0f4bc34098c2bb82e9436910b84ea2c76bc5e85d00125884e8a50e0f0546d +revision: ccadd81dd13abf8ee6061778bc1e9adf5e895c8b96ceac7b9da60875b82c0290 projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-06 23:07:19.000000000 +0100 @@ -0,0 +1 @@ +.osc
