Skip to content

Update perl to 5.42.2 - #312

Merged
twitchyliquid64 merged 2 commits into
mainfrom
update-perl-5.42.2
Jul 1, 2026
Merged

Update perl to 5.42.2#312
twitchyliquid64 merged 2 commits into
mainfrom
update-perl-5.42.2

Conversation

@gominimal-pkgmgr-mgr

Copy link
Copy Markdown
Contributor

Update perl 5.42.05.42.2

Source: github:Perl/perl5:tag
Release: https://github.com/Perl/perl5/releases/tag/v5.42.2
Changelog: Perl/perl5@v5.42.0...v5.42.2
Released: 92 days ago (2026-03-29)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 5.42.2 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 1 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.
  • 1 still affecting — the new version matches the advisory's range, the fix hasn't been published, OR the advisory lacks structured range data so partition defaulted to still-affecting (the conservative pick). Rows marked ⚠ unverified are the latter case.

Vulnerabilities fixed (1)

This update clears 1 vulnerabilities affecting 5.42.0:

CVE / GHSA CPE Severity Fixed in
CVE-2026-4176 (perl, perl) CRITICAL 5.40.4, 5.42.2, 5.43.9
Advisory summaries
  • CVE-2026-4176 — Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.

Compress::Raw::Zlib is included in the Perl … (Published 2026-03-29)

Warning

1 known vulnerabilities still affect 5.42.2 after this update.

CVE / GHSA CPE Severity Fixed in
CVE-2026-8376 (perl, perl) CRITICAL via range: <= 5.43.10
Advisory summaries
  • CVE-2026-8376 — Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl_study_chunk in regcomp_study.c checked the size of th… (Published 2026-05-26)

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ perl 5.42.0 5.42.2
~ perl-upstream 5.42.0 5.42.2

Changes

Old New
Version 5.42.0 5.42.2
SHA256 73cf6cc1ea2b2b1c... 0a585eeb9e363c0f...
Size 14.4 MB 14.5 MB
Source gs://minimal-staging-archives/perl-5.42.0.tar.xz gs://minimal-staging-archives/perl-5.42.2.tar.xz
  • License: GPL-1.0-only (source: tarball)

Quality suggestions

  • Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

Created by pkgmgr

@twitchyliquid64
twitchyliquid64 added this pull request to the merge queue Jul 1, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Jul 1, 2026
@twitchyliquid64
twitchyliquid64 added this pull request to the merge queue Jul 1, 2026
Merged via the queue into main with commit 412909b Jul 1, 2026
4 checks passed
@twitchyliquid64
twitchyliquid64 deleted the update-perl-5.42.2 branch July 1, 2026 02:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants