| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: perl-Cpanel-JSON-XS | Distribution: Fedora Project |
| Version: 4.80 | Vendor: Fedora Project |
| Release: 1.fc46 | Build date: Thu Oct 15 13:38:05 2026 |
| Group: Unspecified | Build host: buildvm-ppc64le-08.rdu3.fedoraproject.org |
| Size: 480063 | Source RPM: perl-Cpanel-JSON-XS-4.80-1.fc46.src.rpm |
| Packager: Fedora Project | |
| Url: https://metacpan.org/release/Cpanel-JSON-XS | |
| Summary: JSON::XS for Cpanel, fast and correct serializing | |
This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.
GPL-1.0-or-later OR Artistic-1.0-Perl
* Thu Oct 15 2026 Paul Howarth <paul@city-fan.org> - 4.80-1
- Update to 4.80
- Security fixes:
- CVE-2026-110672 decode: free the hash key on "Duplicate keys not allowed"
and on a missing ':' (leak)
- CVE-2026-110673 decode: charge allow_tags "(" nesting against max_depth
(stack overflow)
- CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate
check no longer misses or crashes on non-ASCII keys
- CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted keys
(malformed keys)
- CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with
huge exponents (30MB from 12 bytes)
- CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts
(leaked every array)
- CVE-2026-110678 incr_parse: apply max_size to the buffered text in every
context
- CVE-2026-110680 encode: bound the canonical key snapshot for growing tied
or shared hashes (overflow)
- CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone
instead of sharing the parent's pointers
- CVE-2026-110682 incr_parse: reject a top-level number, true, false or
null unless allow_nonref was set explicitly, as chunking changes their
value; strings, arrays and objects are unchanged
- CVE-2026-110684 encode: release the temporary references when
stringifying overloaded objects (leak)
- CVE-2026-110685 decode_tag: free the tag and its arguments when THAW dies
(leak)
- CVE-2026-110686 decode: keep the filter callbacks alive while they run
(use-after-free when a filter removes itself)
- CVE-2026-110687 canonical: sort byte-string keys as Latin-1
- CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the
decoded text (quadratic CPU)
- Add version markers to all module files (GH#260)
- Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated
utf8n_to_uvuni API (GH#260)
- Add schema-based validation for decoded JSON (GH#238):
- Cpanel::JSON::XS::Type now provides
check_type($data, $schema[, $found_type]), which validates an
already-decoded perl structure against a type spec built from the existing
encoder building blocks (JSON_TYPE_* / json_type_arrayof /
json_type_hashof / json_type_anyof), plus the new json_type_optional()
for hash keys that may be absent, and short scalar type name sugar
('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)
so a schema reads as "just a hash of keys and types", as requested;
unlike the encoder's hash type spec, a plain hashref schema is closed:
unknown keys and missing required keys are reported
- New $json->decode_and_validate($json_text, $schema) method decodes and
croaks with all mismatches if validation fails, using decode()'s own type
introspection as ground truth to avoid perl's usual
dual-var/stringified-number ambiguity
- json_type_optional() and the nullable '?' type-name suffixes ('Str?',
'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a
key/value as optional instead of demanding a complete type specification
for every key
- The encoder now also understands json_type_optional() directly (it
unwraps to the wrapped type, since encode() only ever sees keys that are
actually present): the exact same type spec built for check_type()/
decode_and_validate() can now be handed to encode() as-is, instead of
croaking with "no type was specified for hash key '...'" for every
optional key; encoding stays strict by default otherwise: a hash key with
no entry at all in the type spec still croaks (GH#242)
- eg/bench_large.pl:
old encode: 20.5–22.9/s decode: 16.2–16.5/s for 4.53
new encode: 21.1–22.5/s decode: 15.7–16.3/s for 4.80
* Mon Sep 28 2026 Paul Howarth <paul@city-fan.org> - 4.53-1
- Update to 4.53
- Fix C90 violations with arm neon (GH#258)
- Added a native arm64 test runner
* Tue Sep 15 2026 Paul Howarth <paul@city-fan.org> - 4.52-1
- Update to 4.52
- OSX 10.9 fix for SIMD UTF-8
- Change maintainer email to reini.urban@gmail.com
* Sat Sep 12 2026 Paul Howarth <paul@city-fan.org> - 4.51-1
- Update to 4.51
- Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly
to a filehandle instead of building the whole result in memory (GH#250,
GH#58); internally flushes a bounded 8k chunk buffer as it fills, keeping
peak memory bounded for large data structures
- Encoder performance improvements suggested in GH#237:
- Large-integer encoding now uses a 100-digit lookup table instead of
snprintf, roughly 2x faster for integers outside the existing branchless
small-integer fast path (|value| > 59000)
- encode_str now bulk-copies runs of consecutive bytes that need no
escaping instead of a need()+store per byte, notably faster for strings
with few or no characters to escape
- Added eg/bench_large.pl with results
- Add faster SIMD UTF-8 validation
(GH#213, https://github.com/cyb70289/utf8, MIT)
- Fix tests for yath (GH#255): the test files now work with Test2::Harness
instead of only Test::Harness, and a yath run is added to 'make xtest' when
yath is installed
- Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH#254)
* Wed Sep 02 2026 Paul Howarth <paul@city-fan.org> - 4.44-1
- Update to 4.44
- Fix canonical sort infinite loop (GH#252): malformed UTF-8 keys (e.g.
Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's
(STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer: now
checked as 0 or > remaining length
* Thu Jul 23 2026 Jitka Plesnikova <jplesnik@redhat.com> - 4.43-3
- Perl 5.44 re-rebuild of bootstrapped packages
* Wed Jul 22 2026 Jitka Plesnikova <jplesnik@redhat.com> - 4.43-2
- Perl 5.44 rebuild
* Sun Jul 19 2026 Paul Howarth <paul@city-fan.org> - 4.43-1
- Update to 4.43
- Fix canonical sort: Compare by UTF-16 code units per RFC 8785 (GH#248)
- Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8
decoding instead of checking SvUTF8 flag, since older Perls may store valid
UTF-8 hash keys without the flag set
- Fix quadmath encode dropping ".0" for large floats (GH #246)
- The .0 guard condition that suppressed appending for NV values > UV_MAX
was incorrect on high-precision FP (quadmath, 128-bit long double on
arm64) where %g uses fixed-point notation for values like 1.01e30
- Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g
naturally uses %e for large values
* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 4.42-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Sun Jun 07 2026 Paul Howarth <paul@city-fan.org> - 4.42-1
- Update to 4.42
- Ensure encode with a type spec hashref does not change the hashref argument
(GH#240)
- Fix -e docs: "written" → "read" (GH#239)
- Fix Boolean eq overload matching undef (GH#207); Cpanel::JSON::XS::Boolean
overloaded eq would match undef as equal to false because undef stringifies
to "" - added defined() guard
- Fix error messages showing overloaded stringification for blessed objects
(GH#191); error messages now use ClassName=TYPE(addr) format, bypassing any
"" overload
- Fix type_all_string overriding allow_blessed/convert_blessed (GH#175); with
type_all_string + allow_blessed, blessed objects are now encoded as null
(not stringified as HASH address)
- Fix infinite recursion when encode is called from a "" overload (GH#128);
the recursion guard temporarily clears convert_blessed and allow_stringify
flags on the JSON object before calling the overload, preventing re-entrant
encode loops
- Fix $obj->new creating a broken object (GH#93); when new() is called on an
existing object (e.g. $json->new->new), the class name is now extracted
from the object's stash rather than using the stringified reference
- Change allow_nonref default to true (GH#241, matching JSON::PP and
JSON::XS 4.0+ and the insecure RFC 7159); encode and decode now accept
non-reference values by default; decode_json() with an explicit 0/1 second
argument still works; allow_nonref(0) to disable scalars-only for secure
JSON
- Fix minor t/12_blessed.t typo
- Fix GH#112: encode large whole-number NV values without .0 on 32-bit Perl
(values exceeding UV_MAX that Perl stores as float)
- Fix GH#197: prefer IOK over pNOK when encoding values where IV is accurate
but NV is imprecise (SvNOK not set)
* Thu May 28 2026 Paul Howarth <paul@city-fan.org> - 4.41-1
- Update to 4.41
- Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
- Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)
- Fix incr_parse single-quote string delimiter (GH#245)
- Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
truncated input (GH#244)
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 4.40-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Tue Sep 09 2025 Paul Howarth <paul@city-fan.org> - 4.40-1
- Update to 4.40
- Fix overflow with overlong numbers, fuzzing only (CVE-2025-40929)
- Detect more malformed numbers, with two decimal points
- Pin Github actions to latest @v via pinact run -u
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.39-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Tue Jul 08 2025 Jitka Plesnikova <jplesnik@redhat.com> - 4.39-4
- Perl 5.42 re-rebuild of bootstrapped packages
* Mon Jul 07 2025 Jitka Plesnikova <jplesnik@redhat.com> - 4.39-3
- Perl 5.42 rebuild
* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.39-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Fri Dec 13 2024 Paul Howarth <paul@city-fan.org> - 4.39-1
- Update to 4.39
- Fix Windows -Dusequadmath (GH#229, GH#235)
- Fix inconsistent behavior between decoding escaped and unescaped
surrogates, and escaped non-characters vs. non-escaped non-characters; now
aligned to JSON::PP (GH#227, GH#233)
- Add type_all_string tests (GH#236)
- Silence UV to char cast warnings (GH#232)
- Fix MSVC preprocessor errors (GH#232)
- Fix -Wformat warnings on Windows (GH#228)
- Clarify BigInt decoding (GH#226)
- Drop EL-7 support
- Use %{make_build} and %{make_install}
/usr/bin/cpanel_json_xs /usr/lib/.build-id /usr/lib/.build-id/2f /usr/lib/.build-id/2f/fa311e11e4ecd70d0d8ec9754e4dac55f397d1 /usr/lib64/perl5/vendor_perl/Cpanel /usr/lib64/perl5/vendor_perl/Cpanel/JSON /usr/lib64/perl5/vendor_perl/Cpanel/JSON/XS /usr/lib64/perl5/vendor_perl/Cpanel/JSON/XS.pm /usr/lib64/perl5/vendor_perl/Cpanel/JSON/XS/Boolean.pm /usr/lib64/perl5/vendor_perl/Cpanel/JSON/XS/Type.pm /usr/lib64/perl5/vendor_perl/auto/Cpanel /usr/lib64/perl5/vendor_perl/auto/Cpanel/JSON /usr/lib64/perl5/vendor_perl/auto/Cpanel/JSON/XS /usr/lib64/perl5/vendor_perl/auto/Cpanel/JSON/XS/XS.so /usr/share/doc/perl-Cpanel-JSON-XS /usr/share/doc/perl-Cpanel-JSON-XS/Changes /usr/share/doc/perl-Cpanel-JSON-XS/README /usr/share/doc/perl-Cpanel-JSON-XS/eg /usr/share/doc/perl-Cpanel-JSON-XS/eg/bench /usr/share/doc/perl-Cpanel-JSON-XS/eg/bench_large.pl /usr/share/licenses/perl-Cpanel-JSON-XS /usr/share/licenses/perl-Cpanel-JSON-XS/COPYING /usr/share/man/man1/cpanel_json_xs.1.gz /usr/share/man/man3/Cpanel::JSON::XS.3pm.gz /usr/share/man/man3/Cpanel::JSON::XS::Boolean.3pm.gz /usr/share/man/man3/Cpanel::JSON::XS::Type.3pm.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Oct 16 23:51:26 2026