editors/xwpe: update to 1.6.6 - #180
Open
vejeta wants to merge 1 commit into
Open
Conversation
netbsd-srcmastr
pushed a commit
that referenced
this pull request
Jul 4, 2026
3.0.0 (2024-09-25) * Add support for PHP-8.1 Enums * merges #173 * fixes #171 * Add support for APCu * merges #162, #93 * Add OPT_ASSOC for roundtrip serialization of map. * merges #58 3.0.1 (2026-06-01) * Fix PHP-8.6v compatibility (see PR #180) * Fix enum support (see gh issue #181, #183 and PR #184) (thanks @cracksalad)
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
1.3.0 (2025-09-23) What's Changed * Set required ruby version to 2.7.0 and up by @risen in NetBSD#169 * Keep using URI RFC2396 parser by @voxik in #192 * Make DEFAULT_LOCATOR Configurable by @heka1024 in NetBSD#179 New Contributors * @risen made their first contribution in NetBSD#169 * @biow0lf made their first contribution in NetBSD#167 * @duffuniverse made their first contribution in NetBSD#180 * @berkos made their first contribution in NetBSD#170 * @elia made their first contribution in #195 * @Earlopain made their first contribution in #188 * @stevenharman made their first contribution in NetBSD#173 * @voxik made their first contribution in #192 * @m-nakamura145 made their first contribution in NetBSD#175 * @heka1024 made their first contribution in NetBSD#179 * @tylerwillingham made their first contribution in #200
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
What's Changed
refactor: analyze only root project directory and clean up progress module by anistark in NetBSD#176
feat: GitHub license cache by anistark in NetBSD#178
chore: cleanup readme, contributing, justfile by anistark in NetBSD#179
feat: add local license checking for Go and Python by anistark in NetBSD#180
fix: add missing env var cleanup to prevent test isolation issues in parallel execution by anistark in NetBSD#182
feat: add .NET support with NuGet integration by anistark in NetBSD#183
feat: add --github-token flag for authenticated GitHub API requests by anistark in NetBSD#184
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
1.10.0 (2025-10-25) * Add support for ARM64 host images and release rake-compiler-dock host images for ARM64 and x86_64. NetBSD#140 * Add new target platform aarch64-mingw-ucrt aka Windows on ARM. NetBSD#152 * Allow easier selection of the ruby run in the container. NetBSD#151 * Install mig which is a Macos specific RPC code generator. NetBSD#155 * Add RCD_IMAGE_VERSION env var to easily set image version or snapshot. NetBSD#163 * Disable rpath in cross compiled C extensions, since it is only valid in the build environment. NetBSD#165 * Drop support for Ruby 2.4, 2.5, and 2.6. NetBSD#153 @ianks @flavorjones * Remove rbenv ruby version 2.5.9 from the build container. NetBSD#153 @ianks @flavorjones * Rename History.md to CHANGELOG.md which is more common. Contributors * @flavorjones * @ianks 1.11.0 / 2025-12-25 * Bump Ruby 4 cross-compilation support to 4.0.0. * Drop support for Ruby 2.7. NetBSD#180 @larskanis * Bump Ruby 3.3 to v3.3.10 (from v3.3.9) @flavorjones * Bump Ruby 3.4 to v3.4.8 (from v3.4.5) @flavorjones * Bump rake-compiler dependency to v1.3.1 (from v1.2.9) @flavorjones * Remove native Ruby 3.4.x from the host environment. NetBSD#178 @larskanis * Optimized images by improving layer sharing. @larskanis CRuby container summary * native rubies: 4.0.0 (default), 3.1.7 * RUBY_CC_VERSION=4.0.0:3.4.8:3.3.10:3.2.9:3.1.7:3.0.7 Contributors * @flavorjones * @larskanis 1.11.1 (2025-12-26) * JRuby 10.0 replaces JRuby 9.4 in the JRuby build container. #185 @flavorjones Contributors * @flavorjones
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
0.3.5
Re-stamp package version correctly, 0.3.4 packaged a failing test
0.3.4
bugfix our center() padding algorithm by @jquast in #188
docfix: accidental double-escapes \t -> \t by @jquast in #187
0.3.3
Add fast path for ASCII printables to width() by @hugovk in #185
Add py.typed file and Typing :: Typed classifier by @hugovk in NetBSD#184
0.3.2
type hinting for full mympy --strict compliance, by @penguinolog NetBSD#183
0.3.1
Add benchmarking using codspeed.io by @jquast in NetBSD#180
improve width() performance by @jquast in NetBSD#181
0.3.0
Major changes since 0.2.14, in order
Migrate from setup.py + setuptools to pyproject.toml + hatchling by @hugovk in NetBSD#156
Small improvements to update-tables.py and wcwidth-browser.py by @jquast in NetBSD#160
New: iter_graphemes() by @jquast in NetBSD#165
New: width() terminal-aware string measurement by @jquast in NetBSD#166
New: ljust(), rjust(), center() justify text by @jquast in NetBSD#168
New: wrap() by @jquast in NetBSD#169
improve wcswidth() performance ~30% by @jquast in NetBSD#171
New ambigous_width=1 argument by @jquast in NetBSD#172
New strip_sequences() and cut() functions by @jquast in NetBSD#173
Width 0 for Default_Ignorable_Code_Point characters by @jquast in NetBSD#174
Bugfix for Prepended_Concatenation_Mark characters by @jquast in NetBSD#176
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
# Changelog ## 1.11.12 (2025-11-20) * Fixes * Properly handle `nil` from Elixir maps when encoding with the builtin `json` Erlang/OTP module; see [NetBSD#184](potatosalad/erlang-jose#184) * Drop required Elixir version back from 1.16 -> 1.13; see [#185](potatosalad/erlang-jose#185) ## 1.11.11 (2025-11-17) * Fixes * EC key decode/encode issues in OTP 28; see [NetBSD#180](potatosalad/erlang-jose#180), [NetBSD#181](potatosalad/erlang-jose#181), [NetBSD#182](potatosalad/erlang-jose#182), [NetBSD#179](potatosalad/erlang-jose#179) * EdDSA key issues with OTP 27.1.3+; see [NetBSD#177](potatosalad/erlang-jose#177) * Notes * This will hopefully be one of the last 1.x releases, next release will be [2.x](https://github.com/potatosalad/erlang-jose/tree/2.x)
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
Version 6.1.2 ============= Code Fixes ---------- * Fix for low-severity CVE-2026-23868 affecting gifponge, giftool, and gifbuild, but not the core library - library clients need not be alarned. Version 6.1.1 ============= This release bumps the major version, but only one entry point - EGifSpew() - has changed signature and behavior (in order to be able to pass out a detailed error code). The internal error codes in the E_GIF_ERR series have changed value so none of them collides with GIF_ERROR. This code has been systematically audited and hardened wuth ChatGPT-5.2. The only library fixes reported by users or found by robot were for some memory leaks that could only triggered by severely malformed GIFs. Other bugs are edge-case failures in the CLI tools. The gif2rbg CLI tool has been moved to the "obsolete" bin, because its only deployment case in 2026 is as a piñata at fuzzer parties. Warning: the CLI tools in the obsolete category will soon be removed from the distribution entirely. The maintainer is tired of fielding junk bugs filed against them by would-be coup-counters who found yet another edge case, and the rest of the world doesn't need noisy CVEs that aren't actually DoS or security issues for giflib clients. Code Fixes ---------- * Fix for CVE-2021-40633. * Fix SF bug NetBSD#165 EGifSpew leaks GifFileOut->SColorMap * Fix SF bug NetBSD#171 ImageMagick required to build giflib on non-Darwin Platforms * Fix SF bug NetBSD#172 Incorrect object files in shared libutil on darwin * Fix SF bug NetBSD#173 installation of manual pages and html documentation * Fix SF bug NetBSD#175 Memory leaks in gifecho.c's main() and in gifalloc.c's GifMakeMapObject * Fix SF bug NetBSD#177 wrong pointer used in giftool getbool * Fix SF bug NetBSD#179 Path Traversal vulnerability * Fix SF bug NetBSD#180: -Wformat-truncation likely pointing out an actual bug * Fix SF bug NetBSD#182 out‐of‐bounds writes in Icon2Gif * Fix SF bug NetBSD#184 uninitialized buffer in DumpScreen2RGB * Fix SF bug #185 integer overflow in gifbg.c * Fix SF bug #186 integer overflow in Icon2Gif * Fix SF bug #187: CVE-2025-31344 * Fix SF bug NetBSD#170 Tests failing on Ubuntu Noble, giftext buffer overflow * Fix SF bug NetBSD#165 EGifSpew leaks GifFileOut->SColorMap * Fix SF bug NetBSD#162 detected memory leaks in GifMakeSavedImage giflib/gifalloc.c * Fix SF bug NetBSD#161 detected memory leaks in EGifOpenFileHandle giflib/egif_lib.c * Fix SF bug NetBSD#142 ABI break public symbol GifQuantizeBuffer Other bugs that duplicate these have breen addressesed by these fixes * SF bug NetBSD#156 EGifSpew leaks SavedImages (and more); won't fix, caller might want to write a GIF, modify the in-memory data, then write again. Tests ----- Test suite now emits TAP (Test Anything Protocol).
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
2.51 2026-03-20 (by Todd Rinaldo)
Fixes:
- PR NetBSD#184 GH NetBSD#182 Fix compile warnings from Fedora gcc: unhandled enum
value in switch and uninitialized variables in parse_stream
- PR #186 GH NetBSD#183 Add explicit case labels for XML_CTYPE_EMPTY and
XML_CTYPE_ANY in generate_model switch to fix -Wswitch on BSD/clang
- PR NetBSD#175 GH NetBSD#174 Add XML_DTD/XML_GE compile-time guards to AllocTracker
and BillionLaughs XS bindings to fix warnings when expat lacks these flags
- PR #187 GH #185 Require proper declaration in AllocTracker feature
detection to prevent implicit function declaration on BSD
Improvements:
- PR #189 GH #188 Add tests for XS functions modified in PR NetBSD#184 covering
XML_ErrorString, XML_GetBase/XML_SetBase, and generate_model
Maintenance:
- PR NetBSD#181 GH NetBSD#180 Add Fedora 43 container job to CI test matrix
- PR NetBSD#178 Add BSD testing (FreeBSD, OpenBSD, NetBSD) to CI
- PR NetBSD#179 Add no-lwp CI job to validate test suite without LWP::UserAgent
- Update MANIFEST
2.49 2026-03-19 (by Todd Rinaldo)
Improvements:
- PR NetBSD#171 Expose expat library version at runtime via expat_version()
and expat_version_info() class methods on XML::Parser::Expat
- PR NetBSD#169 GH NetBSD#168 Expose Expat 2.7.2 AllocTracker security APIs
(AllocTrackerMaximumAmplification, AllocTrackerActivationThreshold)
Maintenance:
- PR NetBSD#170 Clean up build configuration: remove dead CAPI code from
Makefile.PL and Expat/Makefile.PL, add test dependencies to cpanfile
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
# changes (since 1.15.1) 2026-01-20 Martin Pärtel <martin dot partel at gmail dot com> * Merged build fix for MacFUSE (PR NetBSD#180, thanks @slonopotamus!) * Released 1.18.4 2026-01-10 Martin Pärtel <martin dot partel at gmail dot com> * Populate user and group cache eagerly on startup, if the cache is needed (NetBSD#178). 2025-10-08 Martin Pärtel <martin dot partel at gmail dot com> * Fixed --resolve-symlinks with broken symlinks (PR NetBSD#175, thanks @paulwkc!) * Released 1.18.3 2025-08-17 Martin Pärtel <martin dot partel at gmail dot com> * Added `-osubtype=argv[0]` to prevent some systems from auto-unmounting bindfs when the network goes down (PR NetBSD#172, thanks @NishiyamaPedro!) * Released 1.18.2 2025-06-08 Martin Pärtel <martin dot partel at gmail dot com> * Enabled noattrcache by default with fuse-t * Dropped official support for MacFUSE, because Apple makes it too difficult to test without access to a physical Mac. There is best-effort support for fuse-t. * Released 1.18.1 2025-04-10 Martin Pärtel <martin dot partel at gmail dot com> * Merged fix from @jpalus (PR NetBSD#160) to fix compatibility with libfuse 3.17.1 (NetBSD#158, NetBSD#159). Thanks! * Released 1.18.0 2024-04-06 Martin Pärtel <martin dot partel at gmail dot com> * (MacOS) Added `./configure` option `--disable-macos-fs-link` (issue NetBSD#140) * Released 1.17.7 2023-11-19 Martin Pärtel <martin dot partel at gmail dot com> * Enabled -Wextra and fixed many compiler warnings (PR NetBSD#148, thanks @hartwork!) 2023-11-10 Martin Pärtel <martin dot partel at gmail dot com> * Fixed undefined behaviour on platforms where `uid_t` or `gid_t` is signed (issue NetBSD#143, thanks @hartwork!) * Released 1.17.6 2023-11-09 Martin Pärtel <martin dot partel at gmail dot com> * Support negative --{uid,gid}-offset (issue NetBSD#142) * Released 1.17.5 2023-09-22 Martin Pärtel <martin dot partel at gmail dot com> * Support `mount -t bindfs` on MacOS (PR NetBSD#140, thanks @Kentzo) 2023-07-15 Martin Pärtel <martin dot partel at gmail dot com> * MacOS and FreeBSD socket file support (PR NetBSD#132, thanks @slonopotamus) * MacOS fuse-t support (thanks @slonopotamus) * Released 1.17.4 2023-06-03 Martin Pärtel <martin dot partel at gmail dot com> * Added MacOS statfs_x implementation (issue NetBSD#130, thanks @ohayetechnology) * Released 1.17.3 2023-02-08 Martin Pärtel <martin dot partel at gmail dot com> * Released 1.17.2 2023-02-07 Martin Pärtel <martin dot partel at gmail dot com> * Fixed FD leak when using --block-devices-as-files (issue NetBSD#125, thanks @mafanasyev-tri) 2022-10-17 Martin Pärtel <martin dot partel at gmail dot com> * Fixed --resolve-symlinks when mountpoint name starts with source dir name (issue NetBSD#122, thanks @1-eric) * Released 1.17.1 2022-10-06 Martin Pärtel <martin dot partel at gmail dot com> * Basic OpenBSD support. The test suite does not pass yet. 2022-07-12 Martin Pärtel <martin dot partel at gmail dot com> * Reverted change in 1.16.0 that made direct_io the default. it turned out to be more problematic than not having it. (issue NetBSD#117, thanks @DUOLabs333 and @Misterio77) * Released 1.17.0 2022-06-24 Martin Pärtel <martin dot partel at gmail dot com> * Added --map-{passwd,group}-rev (PR NetBSD#113 by @sshilovsky, thanks!) * Fixed build on FreeBSD * Released 1.16.1 2022-06-18 Martin Pärtel <martin dot partel at gmail dot com> * Released 1.16.0 2022-04-03 Martin Pärtel <martin dot partel at gmail dot com> * Added --no-direct-io and enabled FUSE's direct_io by default (issue NetBSD#110, thanks @DUOLabs333)
threader
pushed a commit
to threader/pkgsrc
that referenced
this pull request
Jul 15, 2026
1.45 Apr 23 2026
[Bug Fixes]
- Fix: use syck_base64_free() to fix Windows "Free to wrong pool" crash
in base64 encode/decode buffers; also plugs a memory leak (PR #189)
- Fix: clear type tag on blessed scalar alias early-return so the stale
tag no longer leaks onto the next emitted item (GH #193, PR #194)
- Fix: negative float#base60 values produce wrong results; strip sign
before accumulating and avoid negative zero for portable
stringification (PR #191)
- Fix: prevent memory leaks when Load/LoadJSON croak on parse errors
(PR #192)
[Maintenance]
- Test: add coverage for SortKeys and JSON MaxDepth (PR #188)
- Test: add error handling coverage for LoadFile/DumpFile (PR #190)
- Update README
1.44 Apr 02 2026
[Bug Fixes]
- Fix: positive hex and octal values parsed as 0 with ImplicitTyping
(PR #187)
- Fix: resolve uintptr_t redefinition error on Win64 MinGW
(PR #186)
1.43 Apr 01 2026
[Bug Fixes]
- Fix: prevent resource leaks on croak/early-return paths in Dump
(PR NetBSD#161)
- Fix: prevent output SV leaks on croak in Dump/DumpFile callers
(PR NetBSD#163)
- Fix: Load() in list context returns empty list for empty/undef input;
also applies to LoadBytes and LoadUTF8 (GH NetBSD#164, PR NetBSD#165)
- Fix: DumpCode serializes prototype string instead of code body
(PR NetBSD#168)
- Fix: memory leak in !perl/scalar Load — newRV_inc should be
newRV_noinc (PR NetBSD#170)
- Fix: add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl
(GH NetBSD#175, PR NetBSD#176)
- Fix: add TODO guard for eval_pv leak on Perl < 5.14
(GH NetBSD#179, PR NetBSD#180)
- Fix: negative hex and octal values parsed as 0 with ImplicitTyping
(PR NetBSD#183)
- Fix: negative int#base60 values produce unsigned wraparound (PR #185)
[Improvements]
- Modernize META_MERGE for CPANTS compliance (PR NetBSD#162)
- Fix hash table size handling and remove compile warnings in syck_st
(PR NetBSD#174)
[Maintenance]
- Restore TODO guard for Dump code leak test on Perl < 5.26 (PR NetBSD#167)
- Resolve 2010 TODO in perl_json_postprocess with test coverage
(PR NetBSD#166)
- CI: upgrade actions to resolve Node.js 20 deprecation warnings
(PR NetBSD#177)
1.42 Mar 27 2026
[Bug Fixes]
- Fix: replace strtok() with strpbrk() and fix sign-compare warnings in
perl_syck.h (PR NetBSD#145)
- Fix: terminate plain scalars at document boundaries --- and ... (PR NetBSD#150)
- Fix: skip %TAG and %YAML directives in document header (PR NetBSD#151)
- Fix: plug SV leak when eval_pv croaks on bad perl/code blocks (PR NetBSD#153)
- Fix: allow non-specific tag '!' before block scalars (GH NetBSD#27, PR NetBSD#102)
- Fix: remove spurious %type <nodeId> for indent_open in gram.y
(GH NetBSD#157, PR NetBSD#158)
- Fix: use modern bison %define api.prefix directive (GH NetBSD#159, PR NetBSD#160)
[Improvements]
- Implement YAML merge key (<<) support (PR NetBSD#149)
[Maintenance]
- Remove dead Perl 5.6/5.8 version guards from test files (PR NetBSD#146)
- Add YAML 1.0 spec compliance audit and coverage tests (PR NetBSD#148)
- Add comprehensive round-trip tests for YAML 1.0 spec features (PR NetBSD#152)
- Remove unneeded TODO in t/json-basic.t (PR NetBSD#154)
- Add regex Dump/Load/round-trip tests to perl tag scheme (PR NetBSD#155)
- Do not require a .y file to build YAML::Syck; add brew support for bison
- Don't ship docs/ directory in tarball
1.41 Mar 22 2026
[Bug Fixes]
- Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of
strtod() so that floats like -3.14 are not corrupted by double-precision
rounding artifacts (GH NetBSD#140, PR NetBSD#141)
1.39 Mar 21 2026
[Bug Fixes]
- Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls (GH NetBSD#138, PR NetBSD#139)
1.38 Mar 20 2026
[Bug Fixes]
- Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety (GH NetBSD#125, PR NetBSD#130)
- Fix: anchor tracking for blessed scalar refs in Dump (GH NetBSD#126, PR NetBSD#131)
- Fix: prevent buffer underflow in base60 (sexagesimal) parsing (PR NetBSD#133)
- Fix: guard against NULL type from strtok in tag parsing (PR NetBSD#135)
- Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (PR NetBSD#137)
[Improvements]
- Resolve TODO tests for empty/invalid YAML to match actual behavior (GH NetBSD#127, PR NetBSD#129)
[Maintenance]
- Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (PR NetBSD#129)
- Add comprehensive implicit type resolution test suite (PR NetBSD#137)
- Update MANIFEST to include all unit tests
- Clean up test names to remove unnecessary numbering
1.37 Mar 18 2026
[Features]
- Add LoadBytes, LoadUTF8, DumpBytes, DumpUTF8 functions (GH NetBSD#51)
[Fixes]
- Fix heap buffer overflow in the YAML emitter - CVE-2026-4177 (GH NetBSD#67)
- Fix DumpFile with tied filehandles (IO::String, IO::Scalar) (GH NetBSD#22)
- Fix _is_glob to recognize IO::Handle subclasses (GH NetBSD#23)
- Fix memory leak when dumping filehandles (RT#41199, GH NetBSD#42)
- Fix dumping of tied hashes (GH NetBSD#31)
- Fix dumping strings starting with '...' as unquoted plain scalars (GH NetBSD#34)
- Fix dumping strings with tabs and carriage returns as plain scalars (GH NetBSD#59)
- Fix double-dash YAML parsing (RT#34073, GH NetBSD#35)
- Fix extra newline after empty arrays/hashes in YAML output (GH NetBSD#36)
- Remove trailing whitespace from YAML output lines (GH NetBSD#37, NetBSD#38, NetBSD#39)
- Fix quoting of \r and \t in YAML output instead of emitting raw bytes (GH NetBSD#40)
- Fix growing !!perl/regexp objects in roundtrips (GH NetBSD#43)
- Fix quoted '=' being transformed into 'str' (GH NetBSD#45)
- Fix backslash-space escape in double-quoted YAML strings (GH NetBSD#61)
- Fix flow sequence comma separator not recognized without trailing space (GH NetBSD#60)
- Fix wide character warning in DumpFile (GH NetBSD#28)
- Fix inline arrays without space after comma (GH NetBSD#25)
- Fix: quote strings matching YAML implicit types to prevent roundtrip failures (GH NetBSD#26)
- Fix JSON::Syck::Dump to use JSON-valid \uXXXX escapes in output (GH NetBSD#21)
- Fix JSON::Syck::Load decoding of \/ and \uXXXX escape sequences (GH NetBSD#30)
- Fix: apply JSON postprocessing to JSON::Syck::DumpFile output (GH NetBSD#104)
- Fix: add tied-filehandle fallback to JSON::Syck::DumpFile (GH NetBSD#98)
- Fix: handle JSON escape sequences in SingleQuote mode Load (GH NetBSD#99)
- Fix: restore Perl 5.8 compatibility in test suite (GH NetBSD#121)
- Fix: correct copy-paste error in Makefile.PL clean target (GH NetBSD#101)
- Fix: correct $SortKeys POD default from false to true (GH NetBSD#100)
- Fix: correct POD documentation errors (GH NetBSD#103)
[Maintenance]
- Add C23-compatible function prototypes for GCC 15 compatibility (GH #112)
- Silence macOS compiler warnings (GH NetBSD#92)
- Guard stdint.h include for portability (HP-UX 11.11) (GH NetBSD#33)
- Guard stdint.h include in syck_st.h for portability (GH NetBSD#24)
- Update ppport.h to 3.68
- Add regression tests for magical variable dumping (GH NetBSD#32)
- CI: modernize GitHub Actions workflow (GH NetBSD#123, NetBSD#124)
- CI: add disttest job to validate MANIFEST completeness
1.36 Oct 10 2025
- Address memory corruption leading to 'str' value being set on empty keys
Thanks @timlegge
1.35 Oct 9 2025
- Address parsing error related to string detection on read for empty strings.
netbsd-srcmastr
pushed a commit
that referenced
this pull request
Jul 30, 2026
Upstream changes: 0.41 Apr 24 2026 [Bug Fixes] - PR #181: Skip OpenSSL 3.x-specific tests on LibreSSL. LibreSSL reports version >= 3.0 via Crypt::OpenSSL::Guess's openssl_version() but internally uses the pre-3.x code path (OPENSSL_VERSION_NUMBER < 0x30000000L), causing two CPAN Testers failures on OpenBSD: t/padding.t (use_sslv23_padding is still a valid XS function on LibreSSL because RSA_SSLV23_PADDING exists) and t/pkcs1_sign.t (RSA_verify on pre-3.x/LibreSSL ignores the padding mode, so cross-padding verification succeeds). LibreSSL is now detected by parsing `openssl version` output for the "LibreSSL" string, using find_openssl_exec(find_openssl_prefix()) from Crypt::OpenSSL::Guess to locate the correct binary. The earlier approach of detecting LibreSSL via an undefined patch level was not reliable. 0.39 Apr 23 2026 [Bug Fixes] - PR #171 GH #170: Fix macOS compile warnings. The OLD_CRUFTY_SSL_VERSION macro used defined() inside a #define (undefined behavior when expanded in #if directives); split into #ifdef/#else branches. Also cast SvPV_nolen() result to UNSIGNED_CHAR* to silence the pointer-sign mismatch in _load_rsa_key(). - PR #173: Reject non-RSA keys (EC, DSA, etc.) in _new_public_key_x509_der() on OpenSSL 3.x. d2i_PUBKEY_bio() accepts any key type, unlike pre-3.x d2i_RSA_PUBKEY_bio(); without validation a non-RSA DER key would be stored in the rsaData struct and produce confusing failures later. - PR #177: Check padding compatibility before message length in private_encrypt() and public_decrypt(). Previously, calling these with the default OAEP padding (or PSS) produced a misleading "plaintext too long" error that hid the real issue (OAEP/PSS are fundamentally incompatible with private_encrypt/public_decrypt). The clear "OAEP/PSS padding is not supported" error is now emitted regardless of data size, and the rejection extends to pre-3.x OpenSSL (previously only checked on 3.x inside rsa_crypt()). - PR #178: Validate key size in generate_key() before calling OpenSSL. Reject negative, zero, and sub-512-bit key sizes with a clear croak instead of letting OpenSSL produce cryptic errors or hang. - PR #179 GH #174: Restore the lost configure_requires prereq on Crypt::OpenSSL::Guess in Makefile.PL. - PR #179 GH #175: Fix failing test 'Padding method pkcs1_pss is valid for signing with ripemd160'. [Improvements] - PR #180: Add optional passphrase argument to new_private_key_der(), enabling decryption of encrypted PKCS#8 DER (EncryptedPrivateKeyInfo) private keys. On OpenSSL 3.x the passphrase is passed to the existing OSSL_DECODER_CTX; on pre-3.x a d2i_PKCS8PrivateKey_bio() helper is used. Previously only PEM-encoded keys supported a passphrase. [Maintenance] - PR #172: Fix 'passphase' -> 'passphrase' typo throughout the codebase (RSA.xs internal names, RSA.pm POD for get_private_key_string, and the test variable in t/format.t). The typo dates to the original 0.33 passphrase support. No functional change -- all renames are internal. 0.38 Apr 23 2026 [Bug Fixes] - PR #103 GH #61: Re-enable PKCS#1 v1.5 padding for sign()/verify(). It was incorrectly disabled in 0.35; the Marvin attack only affects decryption, not signatures. - PR #168: Fix croak message to reference use_pkcs1_oaep_padding() (not use_pkcs1_padding()) when non-OAEP padding is used for encrypt/decrypt. - PR #165: Fix OAEP overhead calculation that was hardcoded for SHA-1; correct overhead is now computed per the configured hash algorithm. - PR #141: Reject non-RSA keys (EC, DSA, RSA-PSS) loaded via _load_rsa_key() on OpenSSL 3.x with a clear error instead of a confusing failure later. - PR #118: Fix private_encrypt() and public_decrypt() broken on OpenSSL 3.x with any padding except NO_PADDING; rsa_crypt() now distinguishes encrypt vs. sign paths. - PR #142: Free signature buffer on RSA_sign() failure on pre-3.x. - PR #164 GH #152: Drain OpenSSL error queue after _get_key_parameters() on OpenSSL 3.x so a failed optional-param lookup does not pollute the error queue for subsequent operations. - PR #161 GH #152: Cache is_private_key flag in rsaData struct to avoid a per-call BIGNUM heap allocation on OpenSSL 3.x. - PR #159 GH #155: Check return values of EVP_PKEY_get_bn_param() in _get_key_parameters(); a failed mandatory param (n or e) now croaks instead of silently returning undef. - PR #160 GH #156: Use THROW macro for make_rsa_obj() result in _new_key_from_parameters() to prevent resource leak on a NULL return. - PR #158 GH #154: Extract setup_pss_sign_ctx() helper to deduplicate PSS context setup in sign() and verify(); the two paths could previously diverge silently. - PR #157 GH #153: Eliminate duplicate NID-to-name table in get_message_digest(); fixes whirlpool on OpenSSL 3.x where the old low-level WHIRLPOOL() API path was being used instead of EVP_MD_fetch(). - PR #145: Fix BIO resource leak in extractBioString() error paths. - PR #143: Validate that a private key is present before attempting export in get_private_key_string(). - PR #140: NULL out BIGNUMs after freeing them in _new_key_from_parameters() to prevent a double-free when make_rsa_obj() fails after they are freed. - PR #137: Use BN_clear_free() (instead of BN_free()) for private key BIGNUMs in _get_key_parameters() to scrub sensitive material. - PR #136: Remove static buffer in get_message_digest() that caused thread-safety problems under Perl ithreads. - PR #134: Add Perl-level stub for use_sslv23_padding() on OpenSSL 3.x where the underlying RSA_SSLV23_PADDING constant was removed. - PR #133: Fix PSS MGF1 setup to inspect the correct padding fields (sign_pad/verify_pad) instead of p_rsa->padding, preventing wrong MGF1 hash on auto-promoted PSS operations. - PR #120: Check PEM_write_bio_* return values in key export functions so failures are reported rather than silently ignored. - PR #119: Migrate SHA* digest calls to EVP_Q_digest() on OpenSSL 3.x, replacing deprecated low-level SHA*() functions. - PR #109: Drain the full OpenSSL error queue in croakSsl() and report the last (most specific) error rather than the oldest one. - PR #104: Guard croakSsl() against a NULL error string from ERR_reason_error_string() to prevent a NULL-deref croak. - PR #76: Do not include whrlpool.h when whirlpool support is disabled. - Memory leak fixes across OpenSSL 3.x code paths (PR #75, PR #77, PR #78, PR #79, PR #80, PR #81, PR #83, PR #87, PR #90, PR #99, PR #101, PR #108, PR #112, PR #114, PR #127, PR #128, PR #129, PR #131): plugged leaks in generate_key(), sign(), verify(), rsa_crypt(), check_key(), get_public_key_string(), _new_key_from_parameters(), and _get_key_parameters() across success and error paths. [Improvements] - PR #169: Make Crypt::OpenSSL::Bignum a hard runtime requirement (moved from recommended to required in Makefile.PL and added hard import in RSA.pm); it was already required in practice for get_key_parameters(). - PR #126: new_public_key() now accepts DER-encoded public keys in addition to PEM; format is detected automatically via ASN.1 OID inspection. - PR #124: Add get_private_key_pkcs8_string() to export private keys in PKCS#8 PEM format. - PR #110: Add get_public_key_pkcs1_string() as an alias for get_public_key_string() for API symmetry with the X.509/PKCS#1 naming. - PR #111: Add optional check=>1 parameter to new_key_from_parameters() to validate the constructed key via check_key() before returning it. - PR #135: Add plaintext length pre-validation in rsa_crypt() with a descriptive croak before attempting the OpenSSL operation. - PR #151: Reject invalid (even-numbered) RSA exponents before passing them to OpenSSL, preventing a potential hang during key generation. [Maintenance] - PR #163: Add CONTRIBUTING.md and SECURITY.md to satisfy CPANTS experimental kwalitee metrics. - PR #144: Clean up Makefile.PL metadata: remove dead -DPERL5 and -DOPENSSL_NO_KRB5 defines; derive version dynamically from RSA.pm. - PR #130: Add test coverage for generate_key() with custom public exponents and exponent validation. - PR #121: Add test coverage for private_encrypt() and public_decrypt(). - PR #148: Add PKCS#1 v1.5 signing regression tests (PR #148). - PR #95: Add error-path and edge-case test coverage (t/error.t). - PR #115, PR #116: Add encrypt/decrypt and sign/verify edge-case tests. - PR #85, PR #86, PR #88, PR #91: Improve test assertions — replace bare ok() calls with is()/like() and add descriptive test names throughout. - PR #84: Add macOS CI job covering both system LibreSSL and Homebrew OpenSSL 3.x. - PR #123: Add Valgrind memory-leak detection CI job on Debian bookworm. - PR #73: Fix META URLs, remove duplicate .gitignore entries, fix build_requires; add Debian trixie (OpenSSL 3.4.x) to CI matrix. - PR #72: Bump actions/checkout from v4 to v6. - PR #82: Bump perl-actions/perl-versions from 1 to 2. - PR #70: Add Dependabot for automatic GitHub Actions version updates. - PR #69: Remove Debian buster from CI matrix (EOL). 0.37 Oct 29 2025 - Fix libressl bitwise logic error in RSA.xs 0.36 Oct 29 2025 - Fix old openssl on strawberry does not include whrlpool.h - libressl message digest functions md cannot be NULL - Don't support whirlpool in libressl - Add support for use_pkcs1_pss_padding with fatal error if RSA-PSS is used for encryption operations
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hello!
Juan here: Debian maintainer and upstream of xwpe Borland-style IDE.
In the past weeks I became maintainer of xwpe. The previous maintainer, Dennis Payne, gave the blessing and documented it at the beginning of: https://identicalsoftware.com/xwpe/
The new repository is at: https://codeberg.org/mendezr/xwpe) and the latest release is 1.6.6.
I was looking where could still be the 20 years old version so I decided to send the update to Linux and BSD distros.
The changes that are relevant for NetBSD package definition are:
all nine patches/ are upstreamed (1.6.6 is a normal autotools build)- files/xwpe.desktop and files/xwpe.xpm are now obsolete (upstream nowinstalls its own .desktop, a scalable SVG icon and AppStream metainfo)
new deps for the modern X11 UI + embedded terminal + LSP/DAP modern compiler features: textproc/json-c, devel/libvterm01, graphics/cairo, devel/pango, x11/libXft (libX11, zlib and curses were already there)
I am not looking to take the pkgsrc package over, so I left you as MAINTAINER and I'm just providing the update, but please, let me know if any help is needed in this regard.
Tarball: https://codeberg.org/mendezr/xwpe/releases/download/v1.6.6/xwpe-1.6.6.tar.gz