Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-DBI for openSUSE:Factory checked in at 2026-10-20 12:57:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-DBI (Old) and /work/SRC/openSUSE:Factory/.perl-DBI.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-DBI" Tue Oct 20 12:57:06 2026 rev:63 rq:1386345 version:1.656.0 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-DBI/perl-DBI.changes 2026-10-02 23:03:00.987470857 +0200 +++ /work/SRC/openSUSE:Factory/.perl-DBI.new.3698736/perl-DBI.changes 2026-10-20 12:57:08.547775284 +0200 @@ -1,0 +2,17 @@ +Mon Oct 19 10:47:51 UTC 2026 - Tina Müller <[email protected]> + +- updated to 1.656.0 (1.656) + see /usr/share/doc/packages/perl-DBI/ChangeLog + + 1.656 - 2026-10-17, H.Merijn Brand & Robert Rothenberg + * Re-add conflicts to cpanfile. (WIP) + * Remove lock file on end of scope + * Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) + * Memory corruption via selectrow_array + SQLite UDF (issue#98) + * Fix errstr when dbm_updatable_key attribute for DBD::DBM is set to 2 (croak) on Perl versions < v5.13.2. + * Fix emit warnings when dbm_updatable_key attribute for DBD::DBM is set to 1 (carp) + * Fix lock file not removed when DBD::DBM check for bad serializer class fails. (CVE-2026-111879) + * *** WARNING: Next release will require perl-5.14 *** + - Main reason: Exception handling + +------------------------------------------------------------------- @@ -12 +29 @@ - * Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815) (reported by Raj) + * Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815) (reported by Raj) bsc#1283055 @@ -14 +31 @@ - * Fix FetchHashKeyName on IV/NV (CVE-2026-88816) (reported by Raj) + * Fix FetchHashKeyName on IV/NV (CVE-2026-88816) (reported by Raj) bsc#1283056 @@ -32 +49 @@ - * Fix arbitrary module and file loading via dbm_type/dbm_mldbm (CVE-2026-78030) + * Fix arbitrary module and file loading via dbm_type/dbm_mldbm (CVE-2026-78030) bsc#1281704 Old: ---- DBI-1.655.tgz New: ---- DBI-1.656.tgz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-DBI.spec ++++++ --- /var/tmp/diff_new_pack.qIUNEq/_old 2026-10-20 12:57:10.263847143 +0200 +++ /var/tmp/diff_new_pack.qIUNEq/_new 2026-10-20 12:57:10.265847227 +0200 @@ -18,10 +18,10 @@ %define cpan_name DBI Name: perl-DBI -Version: 1.655.0 +Version: 1.656.0 Release: 0 -# 1.655 -> normalize -> 1.655.0 -%define cpan_version 1.655 +# 1.656 -> normalize -> 1.656.0 +%define cpan_version 1.656 License: Artistic-1.0 OR GPL-1.0-or-later Summary: Database independent interface for Perl URL: https://metacpan.org/release/%{cpan_name} @@ -37,9 +37,9 @@ BuildRequires: perl(Test::Simple) >= 0.96 Requires: perl(Module::Load) >= 0.22 Provides: perl(Bundle::DBI) = 12.8.696 -Provides: perl(DBD::DBM) = 0.80.0 +Provides: perl(DBD::DBM) = %{version} Provides: perl(DBD::ExampleP) = 12.14.311 -Provides: perl(DBD::File) = 0.450.0 +Provides: perl(DBD::File) = %{version} Provides: perl(DBD::Gofer) = 0.15.327 Provides: perl(DBD::Gofer::Policy::Base) = 0.10.88 Provides: perl(DBD::Gofer::Policy::classic) = 0.10.88 @@ -61,7 +61,7 @@ Provides: perl(DBI::Const::GetInfoType) = 2.8.697 Provides: perl(DBI::DBD) = 12.15.129 Provides: perl(DBI::DBD::Metadata) = 2.14.214 -Provides: perl(DBI::DBD::SqlEngine) = 0.60.0 +Provides: perl(DBI::DBD::SqlEngine) = %{version} Provides: perl(DBI::Gofer::Execute) = 0.14.283 Provides: perl(DBI::Gofer::Request) = 0.12.537 Provides: perl(DBI::Gofer::Response) = 0.11.566 ++++++ DBI-1.655.tgz -> DBI-1.656.tgz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/ChangeLog new/DBI-1.656/ChangeLog --- old/DBI-1.655/ChangeLog 2026-09-30 10:54:32.000000000 +0200 +++ new/DBI-1.656/ChangeLog 2026-10-17 14:46:46.000000000 +0200 @@ -1,3 +1,14 @@ +1.656 - 2026-10-17, H.Merijn Brand & Robert Rothenberg + * Re-add conflicts to cpanfile. (WIP) + * Remove lock file on end of scope + * Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) + * Memory corruption via selectrow_array + SQLite UDF (issue#98) + * Fix errstr when dbm_updatable_key attribute for DBD::DBM is set to 2 (croak) on Perl versions < v5.13.2. + * Fix emit warnings when dbm_updatable_key attribute for DBD::DBM is set to 1 (carp) + * Fix lock file not removed when DBD::DBM check for bad serializer class fails. (CVE-2026-111879) + * *** WARNING: Next release will require perl-5.14 *** + - Main reason: Exception handling + 1.655 - 2026-09-30, H.Merijn Brand & Robert Rothenberg * Fix for C89 (Paul Howarth, PR#197) * Ignore invalid handles consistently (detected by Raj) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/DBI.pm new/DBI-1.656/DBI.pm --- old/DBI-1.655/DBI.pm 2026-09-25 15:13:27.000000000 +0200 +++ new/DBI-1.656/DBI.pm 2026-10-09 15:57:31.000000000 +0200 @@ -16,7 +16,7 @@ our ($XS_VERSION, $VERSION); BEGIN { -$VERSION = "1.655"; # ==> ALSO update the version in the pod text below! +$VERSION = "1.656"; # ==> ALSO update the version in the pod text below! $XS_VERSION = $VERSION; $VERSION =~ tr/_//d; } @@ -148,7 +148,7 @@ =head2 NOTES -This is the DBI specification that corresponds to DBI version 1.655 +This is the DBI specification that corresponds to DBI version 1.656 (see L<DBI::Changes> for details). The DBI is evolving at a steady pace, so it's good to check that @@ -7487,7 +7487,7 @@ Using DBI with perl threads is not yet recommended for production environments. For more information see -L<https://www.perlmonks.org/index.pl?node_id=288022> +https://www.perlmonks.org/index.pl?node_id=288022 =head2 Signal Handling and Canceling Operations diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/DBI.xs new/DBI-1.656/DBI.xs --- old/DBI-1.655/DBI.xs 2026-09-28 14:48:27.000000000 +0200 +++ new/DBI-1.656/DBI.xs 2026-10-12 10:08:01.000000000 +0200 @@ -1080,7 +1080,7 @@ if (!what) return NULL; if (!hv_fetchs((HV*)ohv,"_NO_DESTRUCT_WARN",0)) - sv_dump(orv); + sv_dump(orv); croak("%s handle %s is not a DBI handle (has no magic)", what, neatsvpv(orv,0)); } @@ -2353,10 +2353,10 @@ i = AvFILL(name_av)+1; /* limit for safe iteration over array */ } - if (DBIc_TRACE_LEVEL(imp_sth) >= 10 || (num_fields_mismatch && DBIc_WARN(imp_xxh))) { - PerlIO_printf(DBIc_LOGPIO(imp_sth)," FETCH $h->{%s} from $h->{NAME} with $h->{NUM_OF_FIELDS} = %d" - " and %ld entries in $h->{NAME}%s\n", - neatsvpv(keysv,0), DBIc_NUM_FIELDS(imp_sth), AvFILL(name_av)+1, + if (DBIc_TRACE_LEVEL(imp_sth) >= 10 || (num_fields_mismatch && DBIc_WARN(imp_xxh))) { + PerlIO_printf(DBIc_LOGPIO(imp_sth)," FETCH $h->{%s} from $h->{NAME} with $h->{NUM_OF_FIELDS} = %d" + " and %ld entries in $h->{NAME}%s\n", + neatsvpv(keysv,0), DBIc_NUM_FIELDS(imp_sth), AvFILL(name_av)+1, (num_fields_mismatch) ? " (possible bug in driver)" : ""); } @@ -3004,7 +3004,13 @@ dbh_outer_hv = DBIc_MY_H(imp_dbh); if (SvTYPE(dbh_outer_hv) != SVt_PVHV) return &PL_sv_undef; /* presumably global destruction - bail */ - dbh_inner_hv = (HV*)SvRV(dbih_inner(aTHX_ (SV*)dbh_outer_hv, "profile")); + { /* dbih_inner() returns the inner handle as an RV, except when it was + * given a raw inner HV (DBIc_MY_H() is set to the inner HV while the + * outer handle is being destroyed): then it returns that HV itself, + * and SvRV() on it would return its bucket array (HvARRAY). */ + SV *irv = dbih_inner(aTHX_ (SV*)dbh_outer_hv, "profile"); + dbh_inner_hv = (HV*)(SvROK (irv) ? SvRV (irv) : irv); + } if (SvTYPE(dbh_inner_hv) != SVt_PVHV) return &PL_sv_undef; /* presumably global destruction - bail */ } @@ -3412,8 +3418,8 @@ for(i=1; i < items; ++i) { if (SvTAINTED(ST(i))) { SV *taint_msg = sv_2mortal(newSVpvf( - "parameter %d of %s->%s method call", - i, SvPV_nolen(h), meth_name)); + "parameter %d of %s->%s method call", + i, SvPV_nolen(h), meth_name)); PL_tainted = 1; /* needed for TAINT_PROPER to work */ TAINT_PROPER(SvPV_nolen(taint_msg)); /* die's */ } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/Driver.xst new/DBI-1.656/Driver.xst --- old/DBI-1.655/Driver.xst 2026-09-28 13:55:30.000000000 +0200 +++ new/DBI-1.656/Driver.xst 2026-10-15 15:30:17.000000000 +0200 @@ -241,8 +241,10 @@ if ( dbd_st_execute(sth, imp_sth) <= -2 ) { /* -2 == error */ if (is_selectrow_array) { XSRETURN_EMPTY; } else { XSRETURN_UNDEF; } } + SPAGAIN; SP -= items; /* because stack might have been realloc'd */ /* --- fetchrow_arrayref --- */ row_av = dbd_st_fetch(sth, imp_sth); + SPAGAIN; SP -= items; /* because stack might have been realloc'd */ if (!row_av) { if (GIMME_V == G_SCALAR) PUSHs(&PL_sv_undef); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/META.json new/DBI-1.656/META.json --- old/DBI-1.655/META.json 2026-09-30 12:46:14.000000000 +0200 +++ new/DBI-1.656/META.json 2026-10-18 13:19:48.000000000 +0200 @@ -1,254 +1,263 @@ { - "meta-spec" : { - "version" : 2, - "url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec"; - }, - "generated_by" : "Author", + "release_status" : "stable", "dynamic_config" : 1, + "resources" : { + "x_IRC" : "irc://irc.perl.org/#dbi", + "bugtracker" : { + "web" : "https://github.com/perl5-dbi/dbi/issues"; + }, + "repository" : { + "url" : "https://github.com/perl5-dbi/dbi";, + "type" : "git", + "web" : "https://github.com/perl5-dbi/dbi"; + }, + "license" : [ + "http://dev.perl.org/licenses/"; + ] + }, "provides" : { + "DBD::Gofer::Policy::classic" : { + "file" : "lib/DBD/Gofer/Policy/classic.pm", + "version" : "0.010088" + }, + "DBD::Gofer::Transport::pipeone" : { + "file" : "lib/DBD/Gofer/Transport/pipeone.pm", + "version" : "0.010088" + }, "DBI::Gofer::Serializer::Storable" : { - "version" : "0.015586", - "file" : "lib/DBI/Gofer/Serializer/Storable.pm" + "file" : "lib/DBI/Gofer/Serializer/Storable.pm", + "version" : "0.015586" }, - "DBD::ExampleP" : { - "file" : "lib/DBD/ExampleP.pm", - "version" : "12.014311" + "DBD::Gofer::Policy::Base" : { + "file" : "lib/DBD/Gofer/Policy/Base.pm", + "version" : "0.010088" }, - "DBI::Gofer::Transport::pipeone" : { - "file" : "lib/DBI/Gofer/Transport/pipeone.pm", - "version" : "0.012537" + "DBD::ExampleP" : { + "version" : "12.014311", + "file" : "lib/DBD/ExampleP.pm" }, - "DBI::Const::GetInfoType" : { - "file" : "lib/DBI/Const/GetInfoType.pm", - "version" : "2.008697" + "DBD::Gofer::Policy::pedantic" : { + "file" : "lib/DBD/Gofer/Policy/pedantic.pm", + "version" : "0.010088" }, "DBI::ProfileDumper" : { "version" : "2.015325", "file" : "lib/DBI/ProfileDumper.pm" }, - "DBD::Sponge" : { - "file" : "lib/DBD/Sponge.pm", - "version" : "12.010003" - }, - "DBI::Const::GetInfo::ANSI" : { - "version" : "2.008697", - "file" : "lib/DBI/Const/GetInfo/ANSI.pm" - }, - "DBI::Gofer::Request" : { - "file" : "lib/DBI/Gofer/Request.pm", - "version" : "0.012537" - }, - "DBI::Gofer::Response" : { - "version" : "0.011566", - "file" : "lib/DBI/Gofer/Response.pm" - }, - "DBD::DBM" : { - "file" : "lib/DBD/DBM.pm", - "version" : "0.08" - }, - "DBI::ProxyServer" : { - "file" : "lib/DBI/ProxyServer.pm", - "version" : "0.3005" + "DBI::Profile" : { + "version" : "2.015065", + "file" : "lib/DBI/Profile.pm" }, - "DBI::DBD::Metadata" : { - "version" : "2.014214", - "file" : "lib/DBI/DBD/Metadata.pm" + "DBD::Gofer::Transport::Base" : { + "file" : "lib/DBD/Gofer/Transport/Base.pm", + "version" : "0.014121" }, "DBI::ProfileSubs" : { "file" : "lib/DBI/ProfileSubs.pm", "version" : "0.009396" }, - "DBI::ProfileData" : { - "version" : "2.010008", - "file" : "lib/DBI/ProfileData.pm" + "DBI::Gofer::Serializer::Base" : { + "file" : "lib/DBI/Gofer/Serializer/Base.pm", + "version" : "0.009950" + }, + "DBI::DBD::SqlEngine" : { + "file" : "lib/DBI/DBD/SqlEngine.pm", + "version" : "1.656" }, "DBI::ProfileDumper::Apache" : { "file" : "lib/DBI/ProfileDumper/Apache.pm", "version" : "2.014121" }, - "DBD::Gofer" : { - "version" : "0.015327", - "file" : "lib/DBD/Gofer.pm" + "DBD::Gofer::Transport::corostream" : { + "file" : "lib/DBD/Gofer/Transport/corostream.pm", + "version" : "2.165300" }, - "DBI::Util::CacheMemory" : { - "file" : "lib/DBI/Util/CacheMemory.pm", - "version" : "0.010315" + "DBD::Gofer::Transport::null" : { + "file" : "lib/DBD/Gofer/Transport/null.pm", + "version" : "0.010088" + }, + "DBI::Gofer::Transport::Base" : { + "file" : "lib/DBI/Gofer/Transport/Base.pm", + "version" : "0.012537" + }, + "DBD::Gofer::Policy::rush" : { + "version" : "0.010088", + "file" : "lib/DBD/Gofer/Policy/rush.pm" + }, + "DBI::Gofer::Transport::stream" : { + "version" : "0.012537", + "file" : "lib/DBI/Gofer/Transport/stream.pm" + }, + "DBI::Gofer::Serializer::DataDumper" : { + "file" : "lib/DBI/Gofer/Serializer/DataDumper.pm", + "version" : "0.009950" + }, + "DBD::DBM" : { + "file" : "lib/DBD/DBM.pm", + "version" : "1.656" }, "DBD::Proxy" : { "version" : "0.2004", "file" : "lib/DBD/Proxy.pm" }, - "DBD::File" : { - "version" : "0.45", - "file" : "lib/DBD/File.pm" + "DBI::PurePerl" : { + "version" : "2.014286", + "file" : "lib/DBI/PurePerl.pm" + }, + "DBI::SQL::Nano" : { + "file" : "lib/DBI/SQL/Nano.pm", + "version" : "1.015544" + }, + "DBI::Const::GetInfoReturn" : { + "version" : "2.008697", + "file" : "lib/DBI/Const/GetInfoReturn.pm" + }, + "DBI::Gofer::Response" : { + "file" : "lib/DBI/Gofer/Response.pm", + "version" : "0.011566" }, "DBD::NullP" : { "file" : "lib/DBD/NullP.pm", "version" : "12.014715" }, - "Bundle::DBI" : { - "version" : "12.008696", - "file" : "lib/Bundle/DBI.pm" + "DBI::ProxyServer" : { + "file" : "lib/DBI/ProxyServer.pm", + "version" : "0.3005" }, - "DBD::Gofer::Transport::Base" : { - "file" : "lib/DBD/Gofer/Transport/Base.pm", - "version" : "0.014121" + "DBD::File" : { + "version" : "1.656", + "file" : "lib/DBD/File.pm" }, - "DBI::Const::GetInfoReturn" : { - "file" : "lib/DBI/Const/GetInfoReturn.pm", - "version" : "2.008697" + "DBI::Util::CacheMemory" : { + "version" : "0.010315", + "file" : "lib/DBI/Util/CacheMemory.pm" }, - "DBI::PurePerl" : { - "version" : "2.014286", - "file" : "lib/DBI/PurePerl.pm" + "DBD::Gofer::Transport::stream" : { + "file" : "lib/DBD/Gofer/Transport/stream.pm", + "version" : "0.014599" + }, + "DBI::DBD" : { + "version" : "12.015129", + "file" : "lib/DBI/DBD.pm" + }, + "DBI" : { + "file" : "DBI.pm", + "version" : "1.656" }, "DBI::Gofer::Execute" : { "version" : "0.014283", "file" : "lib/DBI/Gofer/Execute.pm" }, - "DBD::Gofer::Transport::null" : { - "version" : "0.010088", - "file" : "lib/DBD/Gofer/Transport/null.pm" - }, - "DBD::Mem" : { - "file" : "lib/DBD/Mem.pm", - "version" : "0.001" - }, - "DBD::Gofer::Policy::classic" : { - "version" : "0.010088", - "file" : "lib/DBD/Gofer/Policy/classic.pm" - }, - "DBI::SQL::Nano" : { - "file" : "lib/DBI/SQL/Nano.pm", - "version" : "1.015544" - }, - "DBI::Gofer::Transport::Base" : { + "DBI::Gofer::Transport::pipeone" : { "version" : "0.012537", - "file" : "lib/DBI/Gofer/Transport/Base.pm" + "file" : "lib/DBI/Gofer/Transport/pipeone.pm" }, - "DBD::Gofer::Transport::stream" : { - "version" : "0.014599", - "file" : "lib/DBD/Gofer/Transport/stream.pm" + "DBD::Gofer" : { + "file" : "lib/DBD/Gofer.pm", + "version" : "0.015327" }, - "DBD::Gofer::Transport::pipeone" : { - "version" : "0.010088", - "file" : "lib/DBD/Gofer/Transport/pipeone.pm" + "DBI::ProfileData" : { + "version" : "2.010008", + "file" : "lib/DBI/ProfileData.pm" }, - "DBI::Gofer::Serializer::Base" : { - "file" : "lib/DBI/Gofer/Serializer/Base.pm", - "version" : "0.009950" + "DBD::Mem" : { + "version" : "0.001", + "file" : "lib/DBD/Mem.pm" }, - "DBI::DBD::SqlEngine" : { - "file" : "lib/DBI/DBD/SqlEngine.pm", - "version" : "0.06" + "DBI::DBD::Metadata" : { + "file" : "lib/DBI/DBD/Metadata.pm", + "version" : "2.014214" }, - "DBD::Gofer::Policy::Base" : { - "file" : "lib/DBD/Gofer/Policy/Base.pm", - "version" : "0.010088" + "Bundle::DBI" : { + "file" : "lib/Bundle/DBI.pm", + "version" : "12.008696" }, - "DBD::Gofer::Transport::corostream" : { - "file" : "lib/DBD/Gofer/Transport/corostream.pm", - "version" : "2.165300" + "DBI::Const::GetInfoType" : { + "version" : "2.008697", + "file" : "lib/DBI/Const/GetInfoType.pm" }, - "DBI::Profile" : { - "file" : "lib/DBI/Profile.pm", - "version" : "2.015065" + "DBI::Const::GetInfo::ANSI" : { + "version" : "2.008697", + "file" : "lib/DBI/Const/GetInfo/ANSI.pm" }, - "DBD::Gofer::Policy::pedantic" : { - "file" : "lib/DBD/Gofer/Policy/pedantic.pm", - "version" : "0.010088" + "DBD::Sponge" : { + "file" : "lib/DBD/Sponge.pm", + "version" : "12.010003" }, - "DBD::Gofer::Policy::rush" : { - "version" : "0.010088", - "file" : "lib/DBD/Gofer/Policy/rush.pm" + "DBI::Gofer::Request" : { + "file" : "lib/DBI/Gofer/Request.pm", + "version" : "0.012537" }, "DBI::Const::GetInfo::ODBC" : { "file" : "lib/DBI/Const/GetInfo/ODBC.pm", "version" : "2.011374" - }, - "DBI::DBD" : { - "file" : "lib/DBI/DBD.pm", - "version" : "12.015129" - }, - "DBI::Gofer::Serializer::DataDumper" : { - "file" : "lib/DBI/Gofer/Serializer/DataDumper.pm", - "version" : "0.009950" - }, - "DBI" : { - "version" : "1.655", - "file" : "DBI.pm" - }, - "DBI::Gofer::Transport::stream" : { - "version" : "0.012537", - "file" : "lib/DBI/Gofer/Transport/stream.pm" } }, - "abstract" : "Database independent interface for Perl", + "generated_by" : "Author", "license" : [ "perl_5" ], - "author" : [ - "DBI team ([email protected])" - ], - "release_status" : "stable", - "version" : "1.655", "prereqs" : { + "build" : { + "requires" : { + "perl" : "5.008001" + } + }, "runtime" : { + "conflicts" : { + "DBD::AnyData" : "<= 0.110", + "DBD::RAM" : "<= 0.072", + "DBD::Amazon" : "<= 0.10", + "SQL::Statement" : "<= 1.33", + "DBD::Google" : "<= 0.51", + "DBD::PO" : "<= 2.10", + "DBD::CSV" : "<= 0.36" + }, + "recommends" : { + "Encode" : "3.24" + }, "suggests" : { + "Module::Load" : "0.36", + "RPC::PlClient" : "0.2020", "SQL::Statement" : "1.414", + "Clone" : "0.50", "Net::Daemon" : "0.52", - "DB_File" : "0", "Params::Util" : "1.102", "MLDBM" : "0", - "Module::Load" : "0.36", - "RPC::PlServer" : "0.2020", - "Clone" : "0.50", - "RPC::PlClient" : "0.2020" - }, - "recommends" : { - "Encode" : "3.24" + "DB_File" : "0", + "RPC::PlServer" : "0.2020" }, "requires" : { - "Module::Load" : "0.22", + "XSLoader" : "0", "perl" : "5.012000", - "XSLoader" : "0" + "Module::Load" : "0.22" } }, - "test" : { + "configure" : { "requires" : { - "Test::More" : "0.96" + "ExtUtils::MakeMaker" : "6.48" }, "recommends" : { - "Test::More" : "1.302225" - } - }, - "configure" : { - "recommends" : { "ExtUtils::MakeMaker" : "7.78" - }, - "requires" : { - "ExtUtils::MakeMaker" : "6.48" } }, - "build" : { + "test" : { "requires" : { - "perl" : "5.008001" + "Test::More" : "0.96" + }, + "recommends" : { + "Test::More" : "1.302225" } } }, "name" : "DBI", - "resources" : { - "bugtracker" : { - "web" : "https://github.com/perl5-dbi/dbi/issues"; - }, - "x_IRC" : "irc://irc.perl.org/#dbi", - "license" : [ - "http://dev.perl.org/licenses/"; - ], - "repository" : { - "type" : "git", - "web" : "https://github.com/perl5-dbi/dbi";, - "url" : "https://github.com/perl5-dbi/dbi"; - } - } + "abstract" : "Database independent interface for Perl", + "meta-spec" : { + "version" : 2, + "url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec"; + }, + "version" : "1.656", + "author" : [ + "DBI team ([email protected])" + ] } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/META.yml new/DBI-1.656/META.yml --- old/DBI-1.655/META.yml 2026-09-30 12:46:14.000000000 +0200 +++ new/DBI-1.656/META.yml 2026-10-18 13:19:48.000000000 +0200 @@ -6,6 +6,14 @@ perl: '5.008001' configure_requires: ExtUtils::MakeMaker: '6.48' +conflicts: + DBD::Amazon: <= 0.10 + DBD::AnyData: <= 0.110 + DBD::CSV: <= 0.36 + DBD::Google: <= 0.51 + DBD::PO: <= 2.10 + DBD::RAM: <= 0.072 + SQL::Statement: <= 1.33 dynamic_config: 1 generated_by: Author, CPAN::Meta::Converter version 2.150015 license: perl @@ -19,13 +27,13 @@ version: '12.008696' DBD::DBM: file: lib/DBD/DBM.pm - version: '0.08' + version: '1.656' DBD::ExampleP: file: lib/DBD/ExampleP.pm version: '12.014311' DBD::File: file: lib/DBD/File.pm - version: '0.45' + version: '1.656' DBD::Gofer: file: lib/DBD/Gofer.pm version: '0.015327' @@ -70,7 +78,7 @@ version: '12.010003' DBI: file: DBI.pm - version: '1.655' + version: '1.656' DBI::Const::GetInfo::ANSI: file: lib/DBI/Const/GetInfo/ANSI.pm version: '2.008697' @@ -91,7 +99,7 @@ version: '2.014214' DBI::DBD::SqlEngine: file: lib/DBI/DBD/SqlEngine.pm - version: '0.06' + version: '1.656' DBI::Gofer::Execute: file: lib/DBI/Gofer/Execute.pm version: '0.014283' @@ -159,4 +167,4 @@ bugtracker: https://github.com/perl5-dbi/dbi/issues license: http://dev.perl.org/licenses/ repository: https://github.com/perl5-dbi/dbi -version: '1.655' +version: '1.656' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/cpanfile new/DBI-1.656/cpanfile --- old/DBI-1.655/cpanfile 2026-09-30 12:46:13.000000000 +0200 +++ new/DBI-1.656/cpanfile 2026-10-18 13:19:47.000000000 +0200 @@ -13,6 +13,14 @@ suggests "RPC::PlServer" => "0.2020"; suggests "SQL::Statement" => "1.414"; +conflicts "DBD::Amazon" => "<= 0.10"; +conflicts "DBD::AnyData" => "<= 0.110"; +conflicts "DBD::CSV" => "<= 0.36"; +conflicts "DBD::Google" => "<= 0.51"; +conflicts "DBD::PO" => "<= 2.10"; +conflicts "DBD::RAM" => "<= 0.072"; +conflicts "SQL::Statement" => "<= 1.33"; + on "configure" => sub { requires "ExtUtils::MakeMaker" => "6.48"; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/dbixs_rev.h new/DBI-1.656/dbixs_rev.h --- old/DBI-1.655/dbixs_rev.h 2026-09-30 12:46:08.000000000 +0200 +++ new/DBI-1.656/dbixs_rev.h 2026-10-18 13:19:42.000000000 +0200 @@ -1,4 +1,4 @@ -/* Wed Sep 30 12:46:08 2026 */ +/* Sun Oct 18 13:19:42 2026 */ #define DBIXS_RELEASE 1 -#define DBIXS_VERSION 655 -#define DBIXS_REVISION 1845 +#define DBIXS_VERSION 656 +#define DBIXS_REVISION 1871 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/lib/DBD/DBM.pm new/DBI-1.656/lib/DBD/DBM.pm --- old/DBI-1.655/lib/DBD/DBM.pm 2026-09-02 15:13:40.000000000 +0200 +++ new/DBI-1.656/lib/DBD/DBM.pm 2026-10-17 14:40:29.000000000 +0200 @@ -25,7 +25,7 @@ ################# use base qw( DBD::File ); our ($drh,$methods_already_installed); -our $VERSION = '0.08'; +our $VERSION = '1.656'; our $ATTRIBUTION = 'DBD::DBM by Jens Rehsack'; # no need to have driver() unless you need private methods @@ -372,6 +372,17 @@ sub open_data { my ( $className, $meta, $attrs, $flags ) = @_; + + # Validate dbm_mldbm BEFORE SUPER::open_data creates and flock()s the + # lock file. A croak after that point leaves $meta->{lockfh} holding an + # exclusive lock for as long as the table meta data lives, and the next + # open of the same table in this process blocks on it forever. + if ( $meta->{dbm_mldbm} and not $flags->{dropMode} ) + { + DBD::DBM::_CLASS( $meta->{dbm_mldbm} ) + or croak "Invalid dbm_mldbm '$meta->{dbm_mldbm}': expected a module name"; + } + $className->SUPER::open_data( $meta, $attrs, $flags ); unless ( $flags->{dropMode} ) @@ -412,15 +423,20 @@ { $MLDBM::UseDB = $meta->{dbm_usedb}; $MLDBM::Serializer = $meta->{dbm_mldbm}; - DBD::DBM::_CLASS($MLDBM::Serializer) - or croak "Invalid dbm_mldbm '${MLDBM::Serializer}': expected a module name"; } $meta->{hash} = {}; my $tie_class = $meta->{dbm_tietype}; eval { tie %{ $meta->{hash} }, $tie_class, @tie_args }; - $@ and croak "Cannot tie(\%h $tie_class @tie_args): $@"; - -f $meta->{f_fqfn} or croak( "No such file: '" . $meta->{f_fqfn} . "'" ); + if ( $@ or not -f $meta->{f_fqfn} ) + { + # Release the lock SUPER::open_data took, or it outlives this + # failure (see above). + my $err = $@ ? "Cannot tie(\%h $tie_class @tie_args): $@" + : "No such file: '" . $meta->{f_fqfn} . "'"; + $className->_release_lock($meta); + croak $err; + } } unless ( $flags->{createMode} ) @@ -596,7 +612,10 @@ return unless ( defined $key ); if ( my $mode = $meta->{dbm_updatable_key} ) { - my $method = $mode == 1 ? \&carp : \&croak; + my $method = $mode == 1 ? \&carp : sub { + warn $_[0] if $] < 5.013002; + croak $_[0]; + }; my $exists; eval { $exists = $key ne $newkey && exists( $meta->{hash}->{$newkey} ); }; $exists and $method->("Row with PK '$newkey' already exists"); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/lib/DBD/File.pm new/DBI-1.656/lib/DBD/File.pm --- old/DBI-1.655/lib/DBD/File.pm 2026-09-02 15:13:20.000000000 +0200 +++ new/DBI-1.656/lib/DBD/File.pm 2026-10-17 14:42:24.000000000 +0200 @@ -35,7 +35,7 @@ use base qw( DBI::DBD::SqlEngine ); use Carp; -our $VERSION = "0.45"; +our $VERSION = "1.656"; our $drh = undef; # holds driver handle(s) once initialized @@ -483,7 +483,7 @@ my $locking = eval { my $fh; my $nulldevice = File::Spec->devnull (); - open $fh, ">", $nulldevice or croak "Can't open $nulldevice: $!"; + open $fh, ">", $nulldevice or croak "Can't open $nulldevice: $!"; flock $fh, 0; close $fh; 1; @@ -916,18 +916,24 @@ sub drop ($) { my ($self, $data) = @_; my $meta = $self->{meta}; - # We have to close the file before unlinking it: Some OS'es will - # refuse the unlink otherwise. - $meta->{fh} and $meta->{fh}->close (); - $meta->{lockfh} and $meta->{lockfh}->close (); - undef $meta->{fh}; - undef $meta->{lockfh}; + $self->_release_lock($meta); $meta->{f_fqfn} and unlink $meta->{f_fqfn}; # XXX ==> sql_data_source $meta->{f_fqln} and unlink $meta->{f_fqln}; # XXX ==> sql_data_source delete $data->{Database}{sql_meta}{$self->{table}}; return 1; } # drop +sub _release_lock { + my ($self, $meta) = @_; + # We have to close the file before unlinking it: Some OS'es will + # refuse the unlink otherwise. + $meta->{fh} and $meta->{fh}->close (); + $meta->{lockfh} and eval { flock $meta->{lockfh}, 0 }; + $meta->{lockfh} and $meta->{lockfh}->close (); + undef $meta->{fh}; + undef $meta->{lockfh}; + } # _release_lock + sub seek ($$$$) { my ($self, $data, $pos, $whence) = @_; my $meta = $self->{meta}; @@ -953,10 +959,7 @@ sub DESTROY { my $self = shift; my $meta = $self->{meta}; - $meta->{fh} and $meta->{fh}->close (); - $meta->{lockfh} and $meta->{lockfh}->close (); - undef $meta->{fh}; - undef $meta->{lockfh}; + $self->_release_lock($meta); $self->SUPER::DESTROY(); } # DESTROY diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/lib/DBI/Changes.pm new/DBI-1.656/lib/DBI/Changes.pm --- old/DBI-1.655/lib/DBI/Changes.pm 2026-09-30 10:54:42.000000000 +0200 +++ new/DBI-1.656/lib/DBI/Changes.pm 2026-10-17 14:47:28.000000000 +0200 @@ -12,6 +12,45 @@ =encoding UTF-8 +=head2 Changes in DBI 1.656 - 17 Oct 2026 + +=over 2 + +=item * + +Re-add conflicts to cpanfile. (WIP) + +=item * + +Remove lock file on end of scope + +=item * + +Prevent dbi_profile crash (CVE-2026-108518) (Henrik Teichmann) + +=item * + +Memory corruption via selectrow_array + SQLite UDF (issue#98) + +=item * + +Fix errstr when dbm_updatable_key attribute for DBD::DBM is set to 2 (croak) on Perl versions < v5.13.2. + +=item * + +Fix emit warnings when dbm_updatable_key attribute for DBD::DBM is set to 1 (carp) + +=item * + +Fix lock file not removed when DBD::DBM check for bad serializer class fails. (CVE-2026-111879) + +=item * + +*** WARNING: Next release will require perl-5.14 *** +- Main reason: Exception handling + +=back + =head2 Changes in DBI 1.655 - 30 Sep 2026 =over 2 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/lib/DBI/DBD/SqlEngine.pm new/DBI-1.656/lib/DBI/DBD/SqlEngine.pm --- old/DBI-1.655/lib/DBI/DBD/SqlEngine.pm 2026-09-02 15:08:21.000000000 +0200 +++ new/DBI-1.656/lib/DBI/DBD/SqlEngine.pm 2026-10-16 16:10:08.000000000 +0200 @@ -34,7 +34,7 @@ use Carp; our %methods_installed; -our $VERSION = "0.06"; +our $VERSION = "1.656"; our $drh = undef; # holds driver handle(s) once initialized @@ -1272,6 +1272,8 @@ return; } + warn $_ for @err; + if ( $stmt->{NUM_OF_FIELDS} ) { # is a SELECT statement $sth->STORE( Active => 1 ); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/lib/DBI/PurePerl.pm new/DBI-1.656/lib/DBI/PurePerl.pm --- old/DBI-1.655/lib/DBI/PurePerl.pm 2026-07-14 13:27:03.000000000 +0200 +++ new/DBI-1.656/lib/DBI/PurePerl.pm 2026-10-15 15:45:56.000000000 +0200 @@ -778,7 +778,7 @@ sub _err_hash { return 1 unless defined $_[0]->{err}; - return "$_[0]->{err} $_[0]->{errstr}" + return join " " => $_[0]->{err}, $_[0]->{errstr} // "?"; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/t/40profile.t new/DBI-1.656/t/40profile.t --- old/DBI-1.655/t/40profile.t 2026-07-22 14:22:24.000000000 +0200 +++ new/DBI-1.656/t/40profile.t 2026-10-09 15:56:56.000000000 +0200 @@ -489,6 +489,20 @@ }; +# The DESTROY of a database handle must be profiled when the Path has {attr} elements. +# While the outer handle is being destroyed DBIc_MY_H() holds the raw inner HV; dbi_profile() used to +# call SvRV() on the (raw HV) result of dbih_inner() and so used the hash's bucket array as an HV. +{ + my $prof = DBI::Profile->new(Path => [ '{Username}', '!MethodName' ]); + my $dbh = DBI->connect("dbi:ExampleP:", 'usrnam', '', { RaiseError => 1, Profile => $prof }); + $dbh->ping; + undef $dbh; # DESTROY of the database handle + my $node = $prof->{Data}{usrnam}; + ok $node && $node->{DESTROY}, 'DESTROY of a database handle is profiled with a {Username} path element'; + is $node && $node->{DESTROY} ? $node->{DESTROY}[0] : undef, 1, 'exactly one DESTROY call profiled'; + $prof->{Data} = undef; # no report at exit +} + done_testing; exit 0; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/t/50dbm_simple.t new/DBI-1.656/t/50dbm_simple.t --- old/DBI-1.655/t/50dbm_simple.t 2026-08-15 10:50:43.000000000 +0200 +++ new/DBI-1.656/t/50dbm_simple.t 2026-10-16 16:10:08.000000000 +0200 @@ -317,14 +317,19 @@ $sth->{PrintError} = 0; + my @warn; + + local $SIG{__WARN__} = sub { push @warn, @_ }; my $n = $sth->execute(); if ( $mode == 2 ) { ok( !$n, 'execute failed' ); - like $sth->errstr, qr/^Row with PK '1' already exists/, 'execpted error'; + like $sth->errstr, qr/^Row with PK '1' already exists/, 'expected error'; } else { - # TODO: trap warnings to test when $mode == 1 + if ( $mode == 1) { + like $warn[0], qr/^Row with PK '1' already exists/, 'expected warning'; + } is( $n, 1, 'execute' ) or diag( $sth->errstr || 'unknown error' ); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/t/53dbm_module_name.t new/DBI-1.656/t/53dbm_module_name.t --- old/DBI-1.655/t/53dbm_module_name.t 2026-08-28 09:56:50.000000000 +0200 +++ new/DBI-1.656/t/53dbm_module_name.t 2026-10-17 14:40:29.000000000 +0200 @@ -20,6 +20,7 @@ use File::Spec; use File::Temp qw(tempdir); use Test::More; +use Fcntl qw(:flock); my $dir = tempdir( CLEANUP => 1 ); my $dbdir = File::Spec->catdir( $dir, 'db' ); @@ -46,6 +47,7 @@ eval { $dbh->do("CREATE TABLE t_reject (id INT, v CHAR(8))"); 1 }; ok( !$::DBM_PLANT_LOADED, "a path-shaped dbm_type does not load the file it names" ); + eval { $dbh->do( "DROP TABLE t_reject" ); 1 }; $dbh->disconnect; } @@ -62,6 +64,7 @@ eval { $dbh->do("CREATE TABLE t_reject_pm (id INT, v CHAR(8))"); 1 }; ok( !$::DBM_PLANT_LOADED, "a dbm_type naming a .pm file directly does not load it" ); + eval { $dbh->do( "DROP TABLE t_reject_pm" ); 1 }; $dbh->disconnect; } @@ -69,10 +72,11 @@ { my $dbh = DBI->connect( "dbi:DBM:f_dir=$dbdir;dbm_type=SDBM_File", undef, undef, { RaiseError => 1, PrintError => 0 } ); - $dbh->do("CREATE TABLE t_ok (id INT, v CHAR(8))"); - $dbh->do("INSERT INTO t_ok VALUES (1, 'hello')"); + ok( $dbh->do("CREATE TABLE t_ok (id INT, v CHAR(8))"), "CREATE" ); + ok( $dbh->do("INSERT INTO t_ok VALUES (1, 'hello')"), "INSERT" ); my ($v) = $dbh->selectrow_array("SELECT v FROM t_ok WHERE id = 1"); is( $v, 'hello', "dbm_type=SDBM_File still round-trips a row" ); + ok( $dbh->do("DROP TABLE t_ok"), "DROP" ); $dbh->disconnect; } @@ -101,6 +105,21 @@ }; ok( !$::DBM_PLANT_LOADED, "a dbm_mldbm that traverses out of MLDBM::Serializer:: does not load the file it names" ); + + # The rejection must happen before the table's lock file is created and + # flock()ed. Otherwise the lock outlives the failed CREATE and every + # later open of the table in this process blocks on it: the DROP below + # hung under DBI_AUTOPROXY=dbi:Gofer:transport=null, where the dbh that + # serves the DROP is not the one holding the stale lock. + my $lck = File::Spec->catfile( $dbdir, "t_ser.lck" ); + my $free = 1; + if ( -f $lck and open( my $lfh, "<", $lck ) ) + { + $free = flock( $lfh, LOCK_EX | LOCK_NB ) ? 1 : 0; + close($lfh); + } + ok( $free, "a rejected dbm_mldbm does not leave the table's lock file locked" ); + eval { $dbh->do( "DROP TABLE t_ser" ); 1 }; $dbh->disconnect; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/DBI-1.655/t/70callbacks.t new/DBI-1.656/t/70callbacks.t --- old/DBI-1.655/t/70callbacks.t 2025-01-17 10:49:51.000000000 +0100 +++ new/DBI-1.656/t/70callbacks.t 2026-10-15 16:17:33.000000000 +0200 @@ -254,8 +254,7 @@ # with plain assignment to $_ $_ = LeakDetect->new; -if ($] >= 5.008002) { - is $LeakDetect::count, 1, "[plain] live object count is 1 after new()"; +{ is $LeakDetect::count, 1, "[plain] live object count is 1 after new()"; my $obj = $_; $dbh->ping; is $_, $obj, '[plain] $_ still holds an object reference after the callback'; @@ -265,8 +264,7 @@ is $LeakDetect::count, 0, "[plain] live object count is 0 after all object references are gone"; # with localized $_ -if ($] >= 5.008002) { - local $_ = LeakDetect->new; +{ local $_ = LeakDetect->new; is $LeakDetect::count, 1, "[local] live object count is 1 after new()"; my $obj = $_; $dbh->ping; @@ -279,7 +277,6 @@ for (LeakDetect->new) { is $LeakDetect::count, 1, "[foreach] live object count is 1 after new()"; my $obj = $_; - $] >= 5.008002 or next; $dbh->ping; is $_, $obj, '[foreach] $_ still holds an object reference after the callback'; } ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.qIUNEq/_old 2026-10-20 12:57:10.522857989 +0200 +++ /var/tmp/diff_new_pack.qIUNEq/_new 2026-10-20 12:57:10.528858240 +0200 @@ -1,7 +1,7 @@ -mtime: 1790872044 -commit: a313f90fd85df4c4fe2843c09105f7aac204913fdfc6806e1f071657c9f71c5c +mtime: 1792423280 +commit: faa61b2a16a843fe172b702296497e2f60a368456dbbd1d173b38776572045d3 url: https://src.opensuse.org/perl/perl-DBI -revision: a313f90fd85df4c4fe2843c09105f7aac204913fdfc6806e1f071657c9f71c5c +revision: faa61b2a16a843fe172b702296497e2f60a368456dbbd1d173b38776572045d3 trackingbranch: main projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-19 17:21:20.000000000 +0200 @@ -0,0 +1 @@ +.osc
