Paul's Blog Entries for August 2026
Monday 3rd August 2026
Local Packages
Updated curl (8.21.0) to enable zstd compression support in full config from Fedora 45 onwards
Tuesday 4th August 2026
Fedora Project
Updated perl-DateTime-Format-XSD to 0.5 in Rawhide:
DateTime::Format::ISO8601 minimum version update to 0.19 for nanoseconds fix
- Added a SECURITY Policy
- Minor packaging updates
Updated proftpd (1.3.9c) in Rawhide and EPEL-10 to update mod_procfs to 0.3:
Block access to sysfs as well as procfs filesystems
Local Packages
Updated perl-Module-CoreList to 5.20260803:
- Updated for v5.40.5
- Updated for v5.42.3
- Updated for v5.45.2
Updated proftpd (1.3.9c) as per the Fedora version
Wednesday 5th August 2026
Fedora Project
Updated perl-Sereal-Decoder, perl-Sereal-Encoder and perl-Sereal to 5.010 in Rawhide:
Reset the pending frozen-object state (thaw_av and ref_thawhash) at the start of every decode (Sereal GH#316)
Thursday 6th August 2026
Local Packages
Updated curl (8.21.0) to add multi_wakeup_internal for threaded resolving (Bug #2509107)
Friday 7th August 2026
Fedora Project
Updated perltidy to 20260808 in Rawhide (see CHANGES.md for details)
Local Packages
Updated perl-Perl-Tidy to 20260808 as per the Fedora perltidy package
Monday 10th August 2026
Local Packages
Updated perl-Symbol-Util (0.0203) to use LANG=C.UTF-8 for the pod spelling test to address dictionary issues in recent Fedora releases
Tuesday 11th August 2026
Fedora Project
Updated perl-Business-ISBN-Data to 20260811.001 in Rawhide:
- Data update for 2026-08-11
Updated perl-Crypt-DES to 2.09 in Rawhide:
- New maintainer (TIMLEGGE)
Fix failure to build on newer GCC with implicit-function-declaration (CPAN RT#133363, CPAN RT#133412)
- Add Security Policy (DES is insecure)
- Add a Security Considerations section to the pod
- Minor packaging updates
- Clarify module recommendations
Add a Changes file
Move new Module::Whatever to Module::Whatever->new() in pod and tests
Updated perl-Module-Metadata to 1.000040 in Rawhide:
Update taint support detection in a test to handle an upcoming change in perl 5.45.2 (GH#41)
Local Packages
Updated perl-Module-Metadata to 1.000040 as per the Fedora version
Thursday 13th August 2026
Updated perl-Business-ISBN-Data to 20260812.001 in Rawhide:
- Data update for 2026-08-12
Local Packages
- Branched the development repository for Fedora 45
Saturday 15th August 2026
Fedora Project
Sunday 16th August 2026
Fedora Project
Updated perl-GD to 2.91 in Rawhide:
Add JXL, UHDR support for new libgd-2.4.0 (from git)
JXL: newFromJxl/newFromJxlData readers, jxl() writer (lossless/distance/effort), magic-byte autodetection in new()
UHDR: New GD::UHDR class (newFromFile/newFromData, width/height/hasGainMap, resize/crop/rotate/mirror, file/write, getSdr)
Work around libgd 2.4.0 gd.h no longer declaring gdImageBoundsSafe()
IMAGEQUANT: trueColorToPaletteSetMethod/SetQuality and the GD_QUANT_* constants for the libimagequant-backed quantizer
Guard for installations without libimagequant
Fix imagequant feature autodetection in Makefile.PL (libimagequant surfaces in gdlib.pc's Libs.private, not Requires.private)
Embed rpath (Linux) and fix stale blib/lib/GD/Image.pm so 'make test' reliably exercises the just-configured libgd; fix GD_LIQ detection from the deprecated gdlib-config script
Add Affine transformations (GH#21): GD::Image affine matrix builders (affineIdentity/Scale/Rotate/ShearHorizontal/ShearVertical/Translate/Concat/Invert/Flip/Expansion/Rectilinear/Equal/ApplyToPoint) and transformAffineGetImage/transformAffineCopy/transformAffineBoundingBox, wrapping gdAffine*/gdTransformAffine* (libgd >= 2.1.0); fix GD_AFFINE_* constant visibility (same enum/#ifdef issue as GD_QUANT_*)
Add more previously-unbound libgd methods (libgd >= 2.1.0 unless noted): paletteToTrueColor, crop, cropAuto, cropThreshold, colorReplace, colorReplaceArray, colorReplaceThreshold, convolution, resolution; cloneImage, getTrueColorPixel, perceptualDiff (libgd >= 2.4.0); clone() now uses the native gdImageClone() when available, fixing truecolor-ness loss on the old new()+copy() fallback; fix GD_CROP_* constant visibility (same enum/#ifdef issue as GD_QUANT_*)
Animated WebP support (libgd >= 2.4.0): new GD::WebpAnimWriter (new/addImage/finish, wrapping gdWebpWriteOpenPtr/AddImage/PtrFinish) and GD::WebpAnimReader (newFromData/info/nextImage, wrapping gdWebpReadOpenCtx/GetInfo/NextImage) classes
Animated/multi-image JXL support (libgd >= 2.4.0): new GD::JxlAnimWriter (new/addImage/finish, wrapping gdJxlWriteOpenPtr/AddImage/PtrFinish) and GD::JxlAnimReader (newFromData/info/nextImage, wrapping gdJxlReadOpenCtx/GetInfo/NextImage) classes, mirroring GD::WebpAnimReader/Writer
Multi-page TIFF support (libgd >= 2.4.0): new GD::TiffMultiWriter (new/addImage/finish, wrapping gdTiffWriteOpenPtr/AddImage/PtrFinish) and GD::TiffMultiReader (newFromData/info/nextImage, wrapping gdTiffReadOpenCtx/GetInfo/NextImage) classes, mirroring GD::WebpAnimReader/Writer (pages have no per-page delay; nextImage() returns a page-info hashref instead); also adds the GD_TIFF_* writer option constants (colorspace, compression, resolution unit, alpha type)
Per-format header introspection (libgd >= 2.4.0): new GD::Image->pngInfoData/jpegInfoData/gifInfoData/bmpInfoData/avifInfoData/heifInfoData class methods, wrapping gd{Png,Jpeg,Gif,Bmp,Avif,Heif}GetInfoCtx; each reads just the container facts (dimensions, bit depth, and similar) from an in-memory buffer without fully decoding the image
Fixed a longstanding bug in the in-memory gdIOCtx used by every newFrom*Data()/*InfoData() method: its getC() callback never advanced the read position, so any decoder reading a buffer byte-by-byte (as the new bmpInfoData()'s BMP header parser does) would spin re-reading the first byte forever; PNG, JPEG, GIF, WebP, TIFF, JXL, AVIF and HEIF decoding were unaffected because they read through the bulk getBuf() callback instead, which was already correct
Worked around inconsistent success/failure return conventions across libgd's new Get*InfoCtx functions: gdPngGetInfoCtx, gdJpegGetInfoCtx, gdAvifGetInfoCtx and gdHeifGetInfoCtx all return 0 on success despite two of their own header comments claiming the opposite, while gdGifGetInfoCtx and gdBmpGetInfoCtx return 1 on success as documented
t/affine.t: Compare affineInvert(scale(2,3))'s result with an epsilon (1e-6) instead of exact is_deeply, since -Duselongdouble perls compute the division in extended precision, giving a last-few-ULP-different 1/3 than a plain double (GH#68)
Local Packages
Updated perl-DBI to 1.652:
DBI now requires perl-5.12, driven by CVE's
Fix test for perl configured without threads (caught by perl-5.45.1)
Small doc fix (GH#155)
Add suggested dependency (GH#145)
Force placeholder limit on :# and :p# too (CVE-2026-73194)
Limit statements to 292 Mb in preparse (CVE-2026-73193)
Add a security policy (GH#174)
Add dbm_updatable_key attribute to DBD::DBM to configure how keys are updated
Fix missing import in DBI::DBD::SqlEngine
Fix !Caller2 caller loss when $^P is set (GH#184)
I had to add a patch to fix build on i686 (GH#189)
Monday 17th August 2026
Local Packages
Updated curl in the development repo to new upstream release candidate 8.22.0~rc1
Tuesday 18th August 2026
Fedora Project
Updated proftpd to 1.3.9d in F-43, F-44, F-45, Rawhide, EPEL-10.2 and EPEL-10:
SSH channel open request from authenticated client with max packet size of zero lead to infinite loop (GH#2242)
Aborted/failed data transfers incorrectly clear any "EPSV ALL" state (GH#2255)
Possible use-after-free issue via FTP STAT command using -C option; note that the -C option is now silently ignored for FTP STAT commands (GH#2265)
Passive FTP data transfers do not honour AllowForeignAddress policy properly (GH#2272)
Empty password fields should be rejected by the mod_sql_passwd module (GH#2275)
Empty password fields should be rejected by the mod_auth_file module (GH#2279)
.ftpaccess file policy bypass possible in certain configurations (GH#2282)
Local Packages
Updated proftpd to 1.3.9d as per the Fedora version
Updated proftpd (release candidate) to 1.3.10rc4:
SSH channel open request from authenticated client with max packet size of zero lead to infinite loop (GH#2242)
Aborted/failed data transfers incorrectly clear any "EPSV ALL" state (GH#2255)
Cross-filesystem RNTO fallback follows source and destination symlinks unexpectedly (GH#2256)
Add mod_procfs to the list of modules compiled in by default (GH#2261)
Possible use-after-free issue via FTP STAT command using -C option; note that the -C option is now silently ignored for FTP STAT commands (GH#2265)
Passive FTP data transfers do not honour AllowForeignAddress policy properly (GH#2272)
Empty password fields should be rejected by the mod_sql_passwd module (GH#2275)
Empty password fields should be rejected by the mod_auth_file module (GH#2279)
.ftpaccess file policy bypass possible in certain configurations (GH#2282)
Wednesday 19th August 2026
Local Packages
Updated java-1.8.0-oracle to Java SE 8 update 503
Thursday 20th August 2026
Local Packages
Updated curl (rc) to new upstream release candidate 8.22.0~rc2
Friday 21st August 2026
Fedora Project
Updated perl-MCE to 1.903 in F-45 and Rawhide:
- Check that the MCE Model is imported in the namespace before use
Updated perl-Variable-Magic to 0.65 in F-45 and Rawhide:
The 'delete' callback for hashes will now correctly be fired in void context; VMG_COMPAT_HASH_DELETE_NOUVAR_VOID is now always set to false (this is a [good] side effect of the following fix)
Fix test failures under perl v5.45.2 (CPAN RT#180372)
CONTRIBUTING: AI contributions are not welcomed
Local Packages
Updated perl-MCE to 1.903 as per the Fedora version
Updated perl-Module-CoreList to 5.20260820:
- Updated for v5.45.2
Updated perl-Variable-Magic to 0.65 as per the Fedora version
Saturday 22nd August 2026
Fedora Project
Updated perl-MCE to 1.904 in F-24 and Rawhide:
- Update FSF address in license file
Local Packages
Updated perl-MCE to 1.904 as per the Fedora version
Sunday 23rd August 2026
Fedora Project
Updated perl-MCE-Shared to 1.894 in F-45 and Rawhide:
- Update FSF address in license file
Local Packages
Updated perl-MCE-Shared to 1.894 as per the Fedora version
Monday 24th August 2026
Fedora Project
Updated proftpd (1.3.9d) in F-43, F-44, F-45, Rawhide, EPEL-10.2, EPEL-10.3 and EPEL-10 to fix regression in mod_sql's SQLNamedQuery (Bug #4515, GH#2293)
Local Packages
Updated proftpd (1.3.9d and 1.3.10rc4) as per the Fedora version
Tuesday 25th August 2026
Fedora Project
Branched and built perl-Archive-Peek (0.37) in EPEL-10.2, EPEL-10.3 and EPEL-10
Updated perl-CPAN-Requirements-Dynamic to current release (0.003) in EPEL-10.2, EPEL-10.3 and EPEL-10
Updated perl-ExtUtils-Helpers to current release (0.028) in EPEL-10.2, EPEL-10.3 and EPEL-10
Updated perltidy to 20260826 in F-45, Rawhide and EPEL-10 (see CHANGES.md for details)
Updated perl-Test-Simple to 1.302224 in F-45 and Rawhide:
Fix a typo in an earlier Changes entry (GH#1083)
Update the author address to exodist7@gmail.com; mail to the old cpan.org address is no longer delivered
Ship AI_AND_LLM_POLICY.md, the contributor policy for AI and LLM generated code, covering human review, bot accounts in tickets and pull requests, and noting AI use
Stop shipping perltidyrc and repository-only markdown files
Ship the xt/ author and release tests so they run during release testing
Ship three test files that an unanchored MANIFEST.SKIP pattern had silently excluded from the distribution
Fix POD typos in Test2::API, Test2::Handle, Test2::V1, Test2::API::InterceptResult::Event, and Test2::Manual::Testing::Introduction
Quote the file name in the #line directive Test2::Handle generates, so tests pass when the build directory path contains spaces (GH#1088)
Fix further POD typos in Test2::V1 (GH#1054)
Derive the tested perl versions from the perl-versions action so CI keeps up to date (GH#1085)
Reject end() in an array, bag, or hash builder that uses all_items, all_keys, or all_values but specifies no items or fields; such a check can only match an empty structure (GH#1086)
Enforce end() in a bag that also uses all_items; extra items were ignored - this includes the implicit end() inside is(), so such bags now warn or fail where they silently passed (GH#1086)
Document that Test2::Plugin::BailOnFail and Test2::Plugin::DieOnFail cannot act on a failure inside a forked subtest until the owning process merges it (GH#1081)
Use Test2::V0 instead of the deprecated Test2::Bundle::Extended in the Test2::Tools::AsyncSubtest and Test2::Tools::Spec examples (GH#1079)
Fail a Test::More subtest whose code dies, reporting the exception inside it, instead of reporting the subtest as passing; the exception still propagates (GH#1075)
Return the number of assertions made from done_testing() in Test2::Tools::Basic and Test2::Tools::Tiny, so a test file ending in it is true to do() (GH#1073)
Allow the subtest tests to pass with Perl core's more accurate line-number reporting (GH#1090)
Local Packages
Updated perl-Net-IDN-Encode to 2.502:
Use uvchr_to_utf8_flags instead of uvuni_to_utf8_flags, which is removed in perl 5.38.0 (GH#11)
- Update the maintainer information
- Update the copyright year
Add contributors to ACKNOWLEDGMENTS in the README
Stop signing releases with Module::Signature
Updated perl-Perl-Tidy to 20260826 as per the Fedora perltidy package
Updated perl-Test-Simple to 1.302224 as per the Fedora version
Wednesday 26th August 2026
Local Packages
Updated curl (rc) to new upstream release candidate 8.22.0~rc3 in the development repo
Updated perl-DateTime-Locale to 1.46:
- Rebuilt all locale data with the data from CLDR 48.2.0
Tuesday 27th August 2026
Fedora Project
Updated perl-MIME-tools to 5.518 in F-45 and Rawhide:
Add tests for encoded "boundary=XXX" parameters and set the ambiguous-parse flag if any are found
MIME::tools chooses to decode encoded boundary parameters, whilst MUA behaviours differ; Claws-Mail decodes them while Thunderbird does not
Don't ignore invalid whitespace after "boundary=XXX" parameter
Ignore comments between tokens; a header parameter can be written foo(comment)=bar and it's the same as foo=bar
Local Packages
Updated perl-MIME-tools to 5.518 as per the Fedora version
Friday 28th August 2026
Fedora Project
Updated perl-Compress-Raw-Bzip2 to 2.224 in Rawhide:
- Remove 5.6-specific code and make 5.8 the minimum version supported
Remove call to UpDowngrade in Makefile.PL
Updated perl-Compress-Raw-Lzma to 2.224 in Rawhide:
- Remove 5.6-specific code and make 5.8 the minimum version supported
Remove call to UpDowngrade in Makefile.PL
Updated perl-Compress-Raw-Zlib to 2.224 in Rawhide:
- Remove 5.6-specific code and make 5.8 the minimum version supported
Remove call to UpDowngrade in Makefile.PL
Fix typos in Changes file
Updated perl-IO-Compress to 2.224 in Rawhide:
- Remove 5.6-specific code and make 5.8 the minimum version supported
- Remove dead backwards compatibility code
- Remove redundant version checks
- Fix test skip message with threaded perl 5.6
- Remove broken version check
Simplify $needBinmode logic
Fix ExtUtils::MakeMaker version check
- More instances needed fixed
Make tests pass with spaces in $^X (GH#82)
Missing comma in file anyunc.pl (GH#81)
Update zipdetails to version 4.009
Set GlobMapper.pm to version 1.002 (GH#80)
Local Packages
Updated perl-Compress-Raw-Bzip2 to 2.224 as per the Fedora version
Updated perl-Compress-Raw-Lzma to 2.224 as per the Fedora version
Updated perl-Compress-Raw-Zlib to 2.224 as per the Fedora version
Updated perl-IO-Compress to 2.224 as per the Fedora version
Saturday 29th August 2026
Fedora Project
Updated perl-Business-ISBN-Data to 20260827.001 in F-45 and Rawhide:
- Data update for 2026-08-27
Updated perl-IO-Compress-Lzma to 2.224 in Rawhide:
Put "use private::MakeUtil;" back into Makefile.PL
- Remove 5.6-specific code and make 5.8 the minimum version supported
Equivalent fix for https://github.com/pmqs/IO-Compress/pull/82
- Fix spelling typo
Local Packages
Updated perl-IO-Compress-Lzma to 2.224 as per the Fedora version
Monday 31st August 2026
Fedora Project
Updated perl-CPAN-Meta to 2.150014 in F-45 and Rawhide:
- Minor documentation fixes
Updated perl-DateTime to 1.67 in F-45 and Rawhide:
Documented that the 'truncate' method can throw a fatal error if the truncation produces a datetime that doesn't exist in the local time zone, which can happen when truncating to a day (or more) in a time zone with a DST transition at midnight (GH#155)
Documented that 'rfc3339' does not include nanoseconds (GH#150)
Fixed docs for 'strftime' to remove the bit that said it returned the same values as the POSIX 'strftime'; this hasn't been the case for a long time (GH#148)
Updated perl-Finance-Quote to 1.71 in F-43, F-44, F-45, Rawhide, EPEL-9, EPEL-10.2, EPEL-10.3 and EPEL-10:
NZX.pm: Fixed JSON mapping (GH#586)
IndiaMutual.pm: Update AMFI NAV file parsing to 8-column format with Plan and Option fields (GH#584)
Removed MorningstarCH.pm (GH#582)
Removed MorningstarUK.pm (GH#579)
IndiaMutual.pm: Add support for SIF quotes from AMFI (GH#580)
FTfunds.pm: Added useragent, cloned from BVB.pm (GH#577)
Local Packages
Updated perl-CPAN-Meta to 2.150014 as per the Fedora version
Updated perl-DateTime to 1.67 as per the Fedora version
Previous Month: July 2026
Next Month: September 2026