News
Updated 2026-09-21
-
Weekly Challenge 392 opens with Convert Palindrome and Words Length Product
Week 392 of The Weekly Challenge, dated 21 September, asks for the shortest palindrome formed by prepending characters to a given string, then the largest product of two word lengths whose letters do not overlap. Lance Wicks returned with Perl solutions for week 391. Solutions are due 23:59 UK time Sunday 27 September.
-
Dancer2 2.2.1 blocks YAML object and code injection in request bodies
Jason A. Crome released Dancer2 2.2.1 on 19 September as a security follow-up to 2.2.0. Serializer::YAML no longer lets YAML::Load instantiate blessed objects or eval code from request bodies; YAML 1.30 is now the floor, and CLI::Osprey 0.09 is declared. Apps that never set a YAML serializer can still be reached through Serializer::Mutable on text/x-yaml and text/html.
-
HTTP::API::Core splits JSON client policy from the HTTP transport
Shingo Kawamura published HTTP::API::Core, a small layer for JSON HTTP API clients that leaves the actual request to HTTP::Tiny, LWP, Mojo::UserAgent, or Furl. The library owns retries, pagination helpers, and default headers so a client does not have to pick one UserAgent forever. The code is on GitHub at kawamurashingo/HTTP-API-Core.
-
Dancer2 2.2.0 ships path-traversal and session-id security fixes
Dancer2 2.2.0, dated 16 September, patches a high-severity static-file path traversal (GHSA-6xw8-v24c-m783) affecting 2.1.0 and earlier, plus a moderate hook-halt bypass (GHSA-v527-r4px-7vx7). Session IDs now always come from Crypt::URandom. The Data::Dumper serializer left core; apps that still need it should take Dancer2::Serializer::Dumper from CPAN.
-
New PSC plans 5.44 and 5.42 point releases
The newly elected Perl Steering Council posted its first minutes as meeting 235 on 14 September. After GitHub and mailing-list handover, the group said it intends point releases of 5.44 and 5.42 for security and build fixes, and is taking suggestions for other backports. The same notes start a discussion of core support for local::lib-style layouts across perl upgrades, and of a less error-prone dual-life release process.
-
Weekly Challenge 391 opens with Array Median and Arrange Box
Week 391 of The Weekly Challenge, dated 13 September, asks for the median of two already-sorted arrays after a merge, then the longest nest of boxes that are strictly smaller in both dimensions. Matthias Muth and Matt Martini asked for shared JSON examples; the club repo now has a Week 390 examples/json tree. Solutions are due 23:59 UK time Sunday 20 September.
-
German Perl Workshop 2026 lightning talks are on YouTube
Max Maischein posted on 13 September that the lightning talks from the German Perl/Raku Workshop 2026 are up as a YouTube video, after Lee Johnson's edit. The post is a pointer to that five-minutes-or-less reel, separate from the full-session playlist he linked the week before.
-
rjbs ships perl-ci images for old Perls on Debian trixie
Ricardo Signes published perl-ci, a set of one-image-per-perl-version containers built on Debian trixie for amd64 and arm64. The point is to test CPAN dists on older interpreters without the docker-perl / docker-perl-tester split, where official images only cover recent stables. The build and GHCR packages are at github.com/rjbs/perl-ci.
-
Dave Mitchell documents the regex super-linear cache
The Perl Foundation posted Mitchell's August 2026 core grant report on 13 September: 24 hours 10 minutes, most of it (18h29) documenting the regex engine's super-linear cache and its comments. The rest covers GH #24763 (stale numeric value after a string change), a review of the MAYBE modifier for ExtUtils::ParseXS, and a perlxs.pod tweak.
-
Tony Cook's August 2026 grant log is on TPF news
The Perl Foundation published Tony Cook's Maintaining Perl grant report for August on 13 September. The log is a day-by-day ticket review: GitHub PRs in the 245xx-246xx range, a possible dXSTARG/constant-folding issue, and CI pushes. It is the companion August core-maintenance report to Dave Mitchell's same-day post.
-
WebDyne runs PAGI apps on Cloudflare Workers through WASM
Andrew Speer described a zeroperl fork plus a Worker harness that keeps a Perl interpreter in WebAssembly and presents Cloudflare HTTP and WebSocket events as PAGI $scope/$receive/$send. Pure-Perl CPAN modules bundle more easily than XS; the tooling is on npm as @webdyne/webdyne-zeroperl. Demos include a time Worker, a WebSocket Scott Adams interpreter, and a D1/KV/R2 wine-cellar sample.
-
Weekly Challenge 390 names Robbie Hatley champion of the month
Week 390 of The Weekly Challenge opened 7 September with Decode String (repeat K[encoded] brackets) and Order Characters (greedy moves of one of the first k letters). Mohammad Sajid Anwar named Robbie Hatley champion of the month — rank 25, 1100 points, 376 Perl solutions and 174 posts as of that issue. Solutions are due 23:59 UK time Sunday 13 September.
-
German Perl Workshop 2026 talks are on YouTube
Max Maischein posted on 6 September that recordings from the German Perl/Raku Workshop 2026 are on a YouTube playlist. Lee Johnson recorded the sessions on site; postproduction used ffmpeg. The post is the playlist pointer, not a talk-by-talk recap.
-
App::SlimPacker 0.04 fatpacks with deflate on by default
Nicolas Mendoza's 0.04, dated 6 September, minifies with PPI and, unless --no-compress, deflates each bundled module (and the boot program) through core Compress::Raw::Zlib for lazy decode. A boot program that has a __DATA__ or __END__ section stays uncompressed with a warning. The cut also stops the whitespace collapser from gluing the previous line onto those markers, which had dropped data sections.
-
Dist::Zilla 6.038 requires Perl 5.22
Ricardo Signes uploaded Dist::Zilla 6.038 on 5 September, the first cut since 6.037 in January. The toolchain now requires Perl 5.22 — already implied by some upstream libraries, the Changes file notes — and swaps Params::Util for Params::SomeUtil.
-
AmberDB 5.24.0 ships ABR v5 binary records
Maruf Çetin's 5.24.0, dated 5 September, replaces delimiter and regex text encoding with ABR v5: a core-only pack/unpack record format with a five-byte magic header, nested array/hash nodes, and a fallback decoder for older tables. Secondary indexes move to 8-byte packed buffers; bin/update_tables.pl migrates mixed-era files with timestamped backups. The Changes file cites 440 assertions in 47 test files passing.
-
yath 1.000178 cuts make test time about fivefold
Chad Granum's Test2-Harness 1.000178, dated 4 September, drops fixed waits from the dist's own suite and moves its slowest tests behind AUTHOR_TESTING. App::Yath::Tester now sleeps the interval it claims to wait, and sends KILL if a yath child ignores TERM so a hung run cannot stall the file that spawned it.
-
PAGI::FastAPI 1.7.2 stops awaiting non-Future SSE handlers
Mohammad Sajid Anwar's 1.7.2, dated 3 September, no longer unconditionally awaits a route handler's return. That had crashed every plain (non-async) sub that returned PAGI::FastAPI::Response::SSE — the pattern in that class's own SYNOPSIS — with AWAIT_IS_READY. Non-async SSE generators now fail immediately with a diagnostic instead of leaving an empty open stream. 1.7.3 on 5 September adds SECURITY.md only.
-
Perl Weekly 788 leads with LPW 2026
Mohammad Sajid Anwar's 31 August edition opens on the London Perl & Raku Workshop (21 November) and notes YAPC::Tokyo 2026 the following weekend, with Larry Wall listed among Tokyo speakers. It also flags Gabor Szabo's 7 September online session on PAGI::FastAPI and rounds up PAGI, PetaPerl ReJIT, CPerl-on-ELPA, and Weekly Challenge 389.
-
PAGI::FastAPI 1.7.1 adds uploads, background tasks, and OpenAPI links
Mohammad Sajid Anwar's 1.7.0 cut on 29 August adds multipart file uploads ($c->uploaded_file / uploaded_files), $c->background for work after the response, and per-route OpenAPI tags, summaries, and response links for Swagger UI. 1.7.1 the next day fixes parsing when several files share one form field name.
-
PetaPerl starts ReJIT, a machine-code tier for Perl regex
Richard C. Jelinek wrote on 29 August that pperl's op JIT cannot close the regex-redux gap with V8 Irregexp, because almost all of that benchmark retires inside the matcher. ReJIT will compile perl's existing regnode program through Cranelift, admit a subset (scan loops first), and leave declined patterns on the stock engine. The post predicts a 3–5× instruction drop on the scan-loop tier alone and does not give a ship date.
-
London Perl & Raku Workshop 2026 set for 21 November
Organisers announced on 28 August that LPW returns Saturday 21 November at The Café at Zoopla, The Cooperage, 5 Copper Row, London SE1 2LH. Registration and talk submissions are open, including the ~15-seat breakout for BOFs and hackathons. The one-day event is free; advance registration is requested so venue access and headcount are easier.
-
Devel::Camelcadedb v2026.1 is the first CPAN cut since 2023
Alexandr Evstigneev uploaded v2026.1 on 28 August, the first MetaCPAN release after v2023.1 in March 2023. The dist is the Perl side of the Camelcade debugger for IntelliJ IDEA and other JetBrains IDEs.
-
Ubuntu 24.04 gets USN-8684-1 for Perl CVEs
Canonical published USN-8684-1 on 27 August, shipping perl 5.38.2-3.2ubuntu0.4 to noble-security. The notice covers the same Socket pack_ip_mreq_source, regex-trie, pack/unpack, and Storable SX_HOOK issues as jammy's USN-8675-1 two days earlier, plus further denial-of-service and HTTP::Tiny credential-on-redirect items listed on the notice (CVE-2026-48962, CVE-2026-7017, and others).
-
CPerl mode is now on GNU ELPA
Harald Jörg wrote on 26 August that CPerl mode, long shipped inside Emacs, is also on GNU ELPA as cperl-mode 32.0.50. Emacs 27 or newer can install it from M-x list-packages without waiting for the next Emacs release. The current cut covers Perl syntax through 5.44; development stays in the GNU Emacs savannah tree, with a GitHub mirror for issues.
-
MIME-tools 5.518 tightens boundary-parameter parsing
Dianne Skoll's 5.518, dated 26 August, takes three MIME::Parser patches from Dominik Csapak at Proxmox. Encoded boundary= values are decoded and flagged as an ambiguous parse (Claws-Mail decodes them; Thunderbird does not), invalid whitespace after boundary= is no longer dropped, and comments between tokens (foo(comment)=bar) parse as foo=bar.
-
DBD::Pg 3.21.2 compiles on GCC older than 5
Greg Sabino Mullane's 3.21.2, dated 26 August, is a build-and-test cut after 3.21.1's allocation fixes. It supports compiling with GCC older than 5, puts the test plan after skip_all, and hardens the test setup script's port discovery, uid comparison, and su -c quoting.
-
yath 1.000177 notes slow tester waits instead of looking hung
Chad Granum's Test2-Harness 1.000177, dated 26 August, prints a note every ten seconds while App::Yath::Tester waits on a yath run so a slow suite is not mistaken for a hang, and stops t/integration/resource.t failing when the scheduler does not hand the same number of tests to each resource slot.
-
OpenTelemetry 0.037 switches to Crypt::SysRandom
José Joaquín Atria's 0.037, dated 26 August, drops Bytes::Random::Secure for Crypt::SysRandom. The 0.036 cut six days earlier added a DBI connect span, moved db.system to db.system.name, and removed the deprecated db.user and db.connection_string attributes.
-
JPA will end full-scale YAPC::Japan after Tokyo 2026
The Japan Perl Association said on 26 August that YAPC::Tokyo 2026 (27–29 November, Tokyo Big Sight) will be the last YAPC::Japan run at the current scale — sponsors, invited speakers, multiple tracks. Rising venue costs, a thinner sponsor market, and volunteer load were the stated reasons. JPA itself continues after the event and will keep backing smaller gatherings such as 大吉祥寺.pm; a community conversation about what follows is planned once Tokyo is over.
-
PAGI 0.002005 and PAGI-Server 0.002009 pin HEAD, trailers, and incomplete responses
John Napiorkowski's spec cuts 0.002003–0.002005 (24–26 August) spell out HEAD body suppression, at-most-one of body/file/fh per event, and that a response left incomplete after http.response.start must tear the connection down rather than invent a terminator. PAGI-Server 0.002007–0.002009 implement that on HTTP/1.1 and HTTP/2 (RST_STREAM INTERNAL_ERROR), add HTTP/2 trailers and WebSocket keepalive, reuse HTTP/1.1 SSE connections that advertised keep-alive, and drop lifespan_mode off. Version 0.002009 also stops a second PAGI::Server in the same process from closing the first one's listeners.
-
DateTime::Locale 1.46 rebuilds from CLDR 48.2
Dave Rolsky's 1.46, uploaded 26 August, regenerates every locale from Unicode CLDR 48.2.0. The previous cut, 1.45 in April 2025, was still on CLDR 47.
-
Perl::Tidy 20260826 fixes heredoc extra spaces and missing-semicolon checks
Steve Hancock's 20260826, uploaded 25 August, repairs --heredoc-extra-spaces (git #213) and adds more checks aimed at missing semicolons. The previous cut, 20260808, had already landed indented-heredoc controls, map-eval stability, and extra semicolon diagnostics.
-
PerlOnJava 5.44.1 finishes regex, ithreads, taint, and async/await
Flávio Glock tagged PerlOnJava 5.44.1 on 24 August and posted it to blogs.perl.org the next day. The JVM Perl runtime now reports 686,288 of 696,597 core-suite assertions passing (98.5%) and 7,522 of 16,311 sampled CPAN dists. The cut completes the Joni-backed regex path, interpreter threads plus threads::shared, native Future::AsyncAwait, and -T taint on both backends; WWW::Mechanize, Moo, Template Toolkit, DBIx::Class, and Catalyst::Runtime install via jcpan, and a Plack::Handler::Netty plus PAGI HTTP/WebSocket/SSE stack ships for single-process Catalyst.
-
Ubuntu 22.04 gets USN-8675-1 for four Perl CVEs
Canonical published USN-8675-1 on 25 August, shipping perl 5.34.0-3ubuntu1.8 to jammy-security. The notice covers an out-of-bounds Socket pack_ip_mreq_source read (CVE-2026-12087), a 16-bit regex-trie overflow that can make a match succeed when it should not (CVE-2026-13221), a pack/unpack template overflow (CVE-2026-57432), and a Storable SX_HOOK integer overflow (CVE-2026-57433). Older Ubuntu LTS releases get the same fixes through Ubuntu Pro.
-
PAGI::FastAPI 1.6.0 stops BotProtection trusting X-Forwarded-For by default
Mohammad Sajid Anwar's 1.5.0 and 1.6.0 cuts, both dated 25 August, close two more holes in the bot-mitigation middleware. 1.5.0 removes the compiled-in secret fallback change_me_in_production (CWE-1188) and dies if no secret is set. 1.6.0 ignores X-Forwarded-For unless trust_proxies is on, matching the rate-limiter change in 1.3.0.
-
yath 1.000176 no longer dies on a plugin option clash
Chad Granum's Test2-Harness 1.000176, dated 25 August, reports and skips a plugin whose CLI options collide instead of aborting every yath command, and stops non-TAP STDERR from closing a subtest the harness is still parsing. 1.000175 three days earlier added # HARNESS-SHARES-XXX so tests can share a named resource without running next to a # HARNESS-CONFLICTS-XXX exclusive claim, plus an optional --stall-report.
-
Hyperman 0.35 turns on io_uring completion reads and kernel TLS
LNATION's 0.35 cut of the event-loop PSGI server, tagged 25 August, makes completion-mode reads the default on the io_uring backend (run(completion => 0) turns them off) and, when both the OpenSSL build and the kernel support it, uses kernel TLS so HTTPS connections get the writev and sendfile fast paths. Hyperman->has_ktls and SSL_KTLS in $env report whether a given connection actually got kTLS; Plack::Handler::Hyperman passes the completion option through.
-
Punk 0.33 keeps small static files in worker memory
LNATION's 0.33 cut, tagged 25 August, holds small static-mount files in each worker so a hit does no file syscall. Version 0.32 the same weekend adds punk serve [DIR] (Hyperman on 127.0.0.1:8000 by default), index and list options on Punk::Static, and drops the plaintext-secret guardrail in Punk::Config so a value written in the clear is treated as the author's decision.
-
Punk::TOTP 0.05 moves lockouts off the session cookie
LNATION's 0.05 cut, tagged 25 August, stops totp_use_recovery comparing user_id values numerically (identifiers with no leading digits all coerced to 0) and moves failed-attempt counts from the session onto the user row as totp_failed and totp_failed_at, with an attempt_window defaulting to 900 seconds. Changes tags those as CVE-2026-78619 and CVE-2026-78655. plugin 'TOTP' => { sqitch => 1 } ships the columns as the punk_totp Sqitch project.