#cpan — Public Fediverse posts

Spent a productive hour diagnosing a test failure that I had reported back in December through the #CPANtesters. When the module's author asked me for help I marked his email as important, and then Christmas happened and it got lost in my mailbox. Anyway, diagnosis: one of the dependencies was buggy, and has already been fixed so the author should just update the dependency version.

#CPAN #perl #testing #DependencyHell #hashtag

I've uploaded a new version of File::Rotate::Simple to #CPAN.

It's a simple file rotation utility in #Perl.

This version includes a security fix for dangling symlinks (since v0.4.0) and some bug fixes related to the security fix.

https://metacpan.org/release/RRWO/File-Rotate-Simple-v0.4.2

I've uploaded Catalyst::View::ChromePDF to #CPAN. It is a #Catalyst view that converts HTML pages to PDF, as an almost drop-in replacement for Catalyst::View::Wkhtmltopdf.

The latter uses the #wkhtmltopdf utility, which is no longer maintained and has known security issues.

#perl

https://metacpan.org/dist/Catalyst-View-ChromePDF

The CPAN is a thing about Perl which is just crazy, in a positive sense.

Happened to me multiple times already: I had a small bit of knowledge about a tool or a framework, like `Dancer2` or `Code::TidyAll`. Next up, I discovered that the thing in question does have a plugin system (`Dancer2` teaches you about that in the tutorial; found out about `Code::TidyAll`'s plugin system by searching on #GitHub and came across @oalders [`Code::TidyAll::Plugin::YAML`](https://github.com/oalders/code-tidyall-plugin-yaml)).

Having a plugin system is a cool thing on its own behalf, but the number of plugins and the richness in features is just crazy. All kinds of things, some to just make common things easy, some for specific use cases - but they are just... there!

#Perl #CPAN #Dancer2 #CodeTidyAll

CVE-2026-18536: Data::Entropy versions before 0.010 for #Perl read remote entropy sources over plain HTTP

https://lists.security.metacpan.org/cve-announce/msg/42317754/

The module has been deprecated since version 0.008. https://metacpan.org/release/RRWO/Data-Entropy-0.008/view/lib/Data/Entropy.pm#STATUS

Please stop using it. There are several better alternatives. See
https://security.metacpan.org/docs/guides/random-data-for-security.html

#security #cpan

I've uploaded a new version of Plack-App-Prerender to #CPAN

This is a #Plack #Perl application for a pre-rendering proxy using Chrome.

This version fixes a potentially critical security issue, so if you use it, please upgrade ASAP.

https://metacpan.org/release/RRWO/Plack-App-Prerender-v0.3.0

One resource which I'd like to recommend: https://github.com/cpan-authors/Release-Checklist

It greatly helped me reading into how to do a CPAN release.

#Perl #CPAN

Catalyst::View::Wkhtnltopdf new version uploaded to #CPAN with documentation and bug fixes

https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.3

#Perl #Catalyst

I've taken over maintenance of Catalyst::View::Wkhtmltopdf, and released a new version with a security fix, among other changes.

This is a view that returns a PDF instead from a HTML template.

https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.0

Note that #wkhtmltopdf is no longer maintained. This module will soon be deprecated.

#Perl #Catalyst #CPAN

Edit: the fix was incomplete so version v0.6.1 was released

I just did my very first release on CPAN: https://metacpan.org/pod/Dancer2::Plugin::Feed

I have to admit that I'm nearly evenly proud and nervous. I took some days to read into `Dist::Zilla` and today felt secure enough to actually run `dzil release` (with auto upload enabled).

#Perl #CPAN #Dancer2

Back in April the #Perl NOC turned off the #CPAN mail forwarding.

https://log.perl.org/2026/04/cpanorg-email-forwarding-has-been-shut.html

If you're like me, you've been using that for 25+ years, and it's everywhere (and unfortunately that includes spammer lists).

Here's what you can do in the meantime, via @timlegge @cpansec

https://security.metacpan.org/2026/06/14/cpan.org-email-forwarding-shutdown.html

I've started reading into Dist::Zilla recently, and the capabilities and configuration possibilities are just overwhelming.

#Perl #CPAN #DistZilla

Building #perl 5.44 for one of my #CPANtesting machines, and as normal I'm running all of levels 4 and 5 of the #CPAN river through it. Perturbed to see that #CGI is still that popular.

(in case you aren't familiar with the CPAN river, see https://neilb.org/2015/04/20/river-of-cpan.html)

This Week in Security: Another Record Patch Tuesday, LAME is More Secure, Secure Boot is Less Secure, and Milk Malware

https://fed.brid.gy/r/https://hackaday.com/2026/07/17/this-week-in-security-another-record-patch-tuesday-lame-is-more-secure-secure-boot-is-less-secure-and-milk-malware/

Announcing the April Task Force – a project funded by Alpha-Omega and the Linux Foundation, to strengthen the #Perl and #CPAN #CNA function, and more.

https://security.metacpan.org/2026/07/15/april-task-force-announcement

CPANSec @cpansec has revised our default disclosure dates

#Perl #CPAN #infosec

https://security.metacpan.org/docs/revised-disclosure-delay

New release of CPAN::FindDependencies. This fixes a small infelicity where if you told it to use a directory for its cache and that directory doesn't exist, it just ignores what you said. It now tries to create the directory. If after that there's still no usable directory that is a fatal error.

Thanks to Kurt Starsinic for the bug report.

https://metacpan.org/release/DCANTRELL/CPAN-FindDependencies-3.14

#CPAN #perl #dependencies #bugfix

New Sticker onboard.

#Underbar #Perl #CPAN

@offseq Wow, the details are pretty wrong here.

The session ID generation relies on an MD5 hash seeded with the built-in rand() function, which is seeded with predictable 32-bit values derived from process ID, epoch time, and object reference address.

• Perl's built-in PRNG has a 48-bit internal state and is seeded with 48 bits, not 32 bits. Edit: See below. Perl internally seeds its PRNG with 32 bits from /dev/urandom.
• The code in WebDyne::Session does not seed the PRNG explicitly.
• The value passed to rand() is converted to a double-precision floating point value and acts as an upper bound on the generated number. It is not a seed.
• WebDyne::Session effectively generates this bound as (process_id * 10_000_000_000.0 + unix_time()) * 10. The object address plays no part in this calculation. (It tries to, but the code is buggy and always multiplies by 10 instead.)

This predictability makes the session IDs insecure and potentially guessable by attackers, risking unauthorized access.

Yes. The generated session IDs are effectively something like md5_hex("2.84319174058601e+16").

The vulnerability affects versions through 2. 075 and does not apply to versions 1. 042 and earlier, which are distributed separately.

Incorrect. The vulnerability affects all versions of WebDyne::Session. The only difference is that in versions before 2.0, the "multiply by 10" code wasn't there, so the upper bound on generated random numbers was process_id * 10_000_000_000.0 + unix_time(). Everything else (md5_hex(), rand(), etc) was exactly the same.

#perl #CPAN #cve

@manwar Test2 is great, but whenever I see something using yath on one of my #CPAN testing machines it seems to be incredibly slow. Don't know why, and have better things to do than investigate, but that's put me off using it.

"575 Pull Requests in Three Weeks: What Happens When #AI Meets #CPAN Maintenance"

This is an interesting read, including the comments.

https://blogs.perl.org/users/todd_rinaldo/2026/04/575-pull-requests-in-three-weeks-what-happens-when-ai-meets-cpan-maintenance.html

#Perl #LLM #Claude

I've uploaded a new #Perl Critic policy that checks code for naive random data generation from a hash over not-so-randonm sources like rand(), system time, pid such as

md5_hex( rand . time . $$ . ++$counter )

This anti-pattern is used in many places, and has been the reason for several CVEs.

https://metacpan.org/release/RRWO/Perl-Critic-Policy-Security-RandBytesFromHash-v0.1.0

#CPAN #security

As a scholarly aside, I am curious as to who first came up this anti-pattern.

Gonna build a #CPAN testing VM with #DragonflyBSD. Any gotchas that my fedihomies think that a seasoned Unixhead should know about?

#perl

A few days ago I tried to build some perls with 32 bit ints and 128 bit floats. Cue test failures. Today I tried again, and this time I read my notes from last time on how to do it, and it Just Works.

Yay past me!

(the #BigInt modules bundled with some versions of perl don't like that combination of data sizes; the solution is to ignore their test failures, install anyway, and then upgrade to the latest versions from the #CPAN)

#perl #32bit #RidiculousComputing #ComputationalPerversions

I have released a new version of App::CpanDak, my sub-class of App::cpanminus / cpanm with "some sort of distroprefs"

You could already apply patches, skip tests, and set environment variables, to any distribution you installed; now you can augment version specifications.

Some::Fancy::Library has released a new version 1.3.4 that doesn't install cleanly? add a Some-Fancy-Library.options.yml with:

---
add_version_spec: "!= 1.3.4"