Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Net-IDN-Encode for
openSUSE:Factory checked in at 2026-11-06 19:43:54
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Net-IDN-Encode (Old)
and /work/SRC/openSUSE:Factory/.perl-Net-IDN-Encode.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Net-IDN-Encode"
Fri Nov 6 19:43:54 2026 rev:16 rq:1395153 version:2.600.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Net-IDN-Encode/perl-Net-IDN-Encode.changes
2026-09-08 17:01:37.736776352 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Net-IDN-Encode.new.3759290/perl-Net-IDN-Encode.changes
2026-11-06 19:49:50.004722134 +0100
@@ -1,0 +2,82 @@
+Fri Oct 30 11:28:09 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 2.600.0 (2.600)
+ see /usr/share/doc/packages/perl-Net-IDN-Encode/Changes
+
+ 2.600 2026-10-29
+ - stable release of the changes in 2.590 and 2.591
+ - fix CVE-2026-74766, a heap use-after-free in the XS decode_punycode
+ - fix CVE-2026-74765, an integer overflow and out-of-bounds read in
the
+ XS encode_punycode
+ - fix CVE-2026-87078, memory leaks when the XS functions reject input
+ - fix CVE-2026-87079, quadratic decoding of large labels
+ - fix CVE-2026-87080, the pure-Perl decoder accepting a truncated
label
+ - fix CVE-2026-87081, quadratic encoding of overlong labels in
to_ascii
+ - fix CVE-2026-87082, the XS encode_punycode looping for ever on
+ malformed UTF-8 input
+
+ 2.591 2026-10-06 (TRIAL RELEASE)
+ - fix the XS encode_punycode error message on perl 5.12.5
+ - fix warnings from Net::IDN::UTS46 on perl 5.14 and 5.16
+ - fix test failures on perl 5.12 and older, and on Windows
+ - add a GitHub Actions workflow
+
+ 2.590 2026-09-17 (TRIAL RELEASE)
+ - fix CVE-2026-74766, a heap use-after-free in the XS decode_punycode
+ on attacker-supplied punycode
+ - fix CVE-2026-74765, an integer overflow and out-of-bounds read in
the
+ XS encode_punycode
+ - fix CVE-2026-87078, memory leaks when the XS functions reject input
+ - fix CVE-2026-87079, the quadratic cost of decoding large labels in
+ the XS backend, and in the pure-Perl backend when the input has the
+ UTF-8 flag set
+ - fix CVE-2026-87080, the pure-Perl decoder treating a truncated
label
+ as complete and adding an extra character to the result
+ - fix CVE-2026-87081, the quadratic cost of encoding an overlong
label
+ in to_ascii:
+ * to_ascii now rejects a label too long for DNS before encoding
+ it
+ - fix CVE-2026-87082, the XS encode_punycode looping for ever on
+ malformed UTF-8 input:
+ * both punycode backends now reject malformed UTF-8
+ * a truncated sequence in a UTF-8 flagged string had made the XS
+ loop for ever and crashed the pure-Perl backend
+ - reject surrogates and code points above U+10FFFF, which are not
+ Unicode scalar values:
+ * the punycode encoder and decoder reject them in both backends
+ * Net::IDN::UTS46 rejects them in a label even when
+ AllowUnassigned is set
+ - add the RFC 3492 overflow checks to both punycode backends, so they
+ reject the same inputs:
+ * the counters are perl UV integers bounded at the RFC limit of
+ 0xFFFFFFFF
+ * on such input the XS had returned a corrupt label or crashed
+ - fix the XS reading past the end of a stringified reference argument
+ - fix the XS decode_punycode crashing on an undef argument:
+ * both backends now warn once about the undefined value and
+ return the empty string
+ - stop the XS encode_punycode altering its argument:
+ * it had upgraded the scalar to UTF-8 in place, so a byte string
+ came back flagged and an undef came back defined
+ - stringify an overloaded object argument once in the pure-Perl
+ backend, so a stringification that changes between calls cannot
crash
+ perl
+ - speed up the XS encoder by decoding its input once rather than once
+ per round
+ - report a decoded code point above U+10FFFF from uts46_to_unicode as
+ an invalid punycode sequence [P4] rather than a disallowed
character
+ [V6]
+ - make the XS and pure-Perl backends behave the same:
+ * both reject any argument count other than one with a usage
message,
+ where pure Perl had ignored extra arguments
+ * both report a non-basic character after the delimiter as a
non-base
+ character, where pure Perl had said invalid digit
+ * both report the caller's location in error messages
+ * both accept U+FFFF and report a surrogate as an invalid code
point
+ on every perl version, where the XS on perl 5.10 to 5.12 had
+ rejected either as "malformed UTF-8"
+ - load the XS on perl 5.8, where the version check had failed and the
+ module silently used pure Perl
+ - recommend Test::LeakTrace for the test phase
+
+-------------------------------------------------------------------
Old:
----
Net-IDN-Encode-2.502.tar.gz
New:
----
Net-IDN-Encode-2.600.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Net-IDN-Encode.spec ++++++
--- /var/tmp/diff_new_pack.vczoy4/_old 2026-11-06 19:49:51.370779363 +0100
+++ /var/tmp/diff_new_pack.vczoy4/_new 2026-11-06 19:49:51.379779740 +0100
@@ -18,14 +18,14 @@
%define cpan_name Net-IDN-Encode
Name: perl-Net-IDN-Encode
-Version: 2.502.0
+Version: 2.600.0
Release: 0
-# 2.502 -> normalize -> 2.502.0
-%define cpan_version 2.502
+# 2.600 -> normalize -> 2.600.0
+%define cpan_version 2.600
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: Internationalizing Domain Names in Applications (UTS #46)
URL: https://metacpan.org/release/%{cpan_name}
-Source0:
https://cpan.metacpan.org/authors/id/R/RR/RRWO/%{cpan_name}-%{cpan_version}.tar.gz
+Source0:
https://cpan.metacpan.org/authors/id/P/PJ/PJCJ/%{cpan_name}-%{cpan_version}.tar.gz
Source1: cpanspec.yml
Source100: README.md
BuildRequires: perl
++++++ Net-IDN-Encode-2.502.tar.gz -> Net-IDN-Encode-2.600.tar.gz ++++++
++++ 1878 lines of diff (skipped)
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.vczoy4/_old 2026-11-06 19:49:51.805797587 +0100
+++ /var/tmp/diff_new_pack.vczoy4/_new 2026-11-06 19:49:51.814797964 +0100
@@ -1,6 +1,6 @@
-mtime: 1788638374
-commit: 2f1fc9026527f72eb0d97053c4b66c753da3d5df5ed1e30ac43b3e1d31959338
+mtime: 1793359690
+commit: 48154f2a41a4f97ca2a9577bfd4c4562e5f990167ca252cab148661382b21f10
url: https://src.opensuse.org/perl/perl-Net-IDN-Encode
-revision: 2f1fc9026527f72eb0d97053c4b66c753da3d5df5ed1e30ac43b3e1d31959338
+revision: 48154f2a41a4f97ca2a9577bfd4c4562e5f990167ca252cab148661382b21f10
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-10-30 12:28:10.000000000 +0100
@@ -0,0 +1 @@
+.osc
