Branch: refs/heads/master
Home: https://github.com/perl5-dbi/dbi
Commit: 315c6ce703b8b3cbe9188062d9ec80730293554a
https://github.com/perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a
Author: Robert Rothenberg <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
M MANIFEST
M Makefile.PL
M lib/DBD/DBM.pm
A t/53dbm_module_name.t
Log Message:
-----------
Load serializer class using Module::Load (CVE-2026-78030)
This replaces calls to require with Module::Load, and adds specific
checks that arguments are module names instead of filenames.
Instead of using our own regex matcher, we attempt to use the
Params::Util _CLASS function. The style of trying to import it or adding
our own is based on similar code in DBD::File. (This uses SPDX
annotations to indicate where the code comes from.)
This also adds a suggestion for Params::Util in Makefile.PL.
Note that code of the form
$INC{"$tie_type.pm"} or require "$tie_type.pm"
is redundant, since require checks %INC.
See also the similar vulnerability to the DBI::Profile vulnerability
CVE-2026-14380 in commit b73d5d9901767fc1d16b6661ef08fbed4532e259.
Assisted-By: Claude Opus 5 (1M context) <[email protected]>
Signed-off-by: Robert Rothenberg <[email protected]>
Commit: 247bc9136367d84d1c3024c317812d404172e477
https://github.com/perl5-dbi/dbi/commit/247bc9136367d84d1c3024c317812d404172e477
Author: Robert Rothenberg <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
M MANIFEST
M Makefile.PL
M lib/DBD/DBM.pm
A t/53dbm_module_name.t
Log Message:
-----------
Merge commit from fork
Load serializer class using Module::Load (CVE-2026-78030)
Compare: https://github.com/perl5-dbi/dbi/compare/44c73098d98c...247bc9136367
To unsubscribe from these emails, change your notification settings at
https://github.com/perl5-dbi/dbi/settings/notifications
