Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-HTTP-Body for openSUSE:Factory checked in at 2026-10-29 16:06:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-HTTP-Body (Old) and /work/SRC/openSUSE:Factory/.perl-HTTP-Body.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-HTTP-Body" Thu Oct 29 16:06:37 2026 rev:17 rq:1393478 version:1.240.0 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-HTTP-Body/perl-HTTP-Body.changes 2024-05-15 21:26:48.966068480 +0200 +++ /work/SRC/openSUSE:Factory/.perl-HTTP-Body.new.1255/perl-HTTP-Body.changes 2026-10-29 16:10:28.294456721 +0100 @@ -1,0 +2,46 @@ +Tue Oct 27 10:37:06 UTC 2026 - Tina Müller <[email protected]> + +- updated to 1.240.0 (1.24) + see /usr/share/doc/packages/perl-HTTP-Body/Changes + + 1.24 2026-10-26 18:28:01+01:00 Europe/Berlin + - SECURITY, CVE-2026-116131: urlencoded bodies are limited to + $HTTP::Body::UrlEncoded::max_params fields and multipart bodies to + $HTTP::Body::MultiPart::max_parts parts (1000 each); reported and + patched by CPANSec. bsc#1288644 + - SECURITY, CVE-2026-116132: the temporary file of an upload that is + still incomplete at DESTROY-time is now always deleted; reported and + patched by CPANSec (also fixes RT#84004) bsc#1288645 + - SECURITY, CVE-2026-116133: a multipart body without a boundary or with + a malformed delimiter line no longer takes quadratic time; a malformed + delimiter line now croaks, and padding or an epilogue after the close + delimiter is accepted; reported and patched by CPANSec. bsc#1288646 + - SECURITY, CVE-2026-116134: a multipart part's header block is limited + to $HTTP::Body::MultiPart::max_header_size bytes (32768) and + $HTTP::Body::MultiPart::max_header_lines lines (100); reported and + patched by CPANSec. bsc#1288647 + - SECURITY, CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in + urlencoded bodies are decoded instead of being dropped; reported and + patched by CPANSec. bsc#1288648 + - SECURITY, CVE-2026-116285: the chunk size line of a chunked body is + matched in linear instead of quadratic time bsc#1288649 + - SECURITY, CVE-2026-116531: a chunked body is now framed independently + of where the reads feeding add() fall; a read that split a chunk could + leave the parser never reaching 'done', hanging a server that reads + until done bsc#1288650 + - INCOMPATIBLE: add() now croaks when one of the new limits is exceeded. + Raise the variable, or set it to 0 to disable that limit, if your + forms need more. See NOTES in HTTP::Body. + - RT#105021: temp-file write errors in MultiPart and OctetStream now + croak instead of silently truncating the stored body + - RT#123615: a NUL byte in a multipart filename is stripped so it cannot + truncate a path handed on downstream + - Moved repository from Shadowcat git to GitHub (libwww-perl/HTTP-Body) + - Updated all metadata resources to point to GitHub + - Fixed prerequisites: moved Digest::MD5 to test deps, changed HTTP::Headers to HTTP::Message + - Added README.md for GitHub + - Updated support section in documentation + - Moved the POD, POD coverage and Perl::Critic tests to xt/release, so + they run on every release instead of being skipped + +------------------------------------------------------------------- @@ -45 +90,0 @@ - Old: ---- HTTP-Body-1.23.tar.gz New: ---- HTTP-Body-1.24.tar.gz README.md _scmsync.obsinfo build.specials.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-HTTP-Body.spec ++++++ --- /var/tmp/diff_new_pack.OLXh25/_old 2026-10-29 16:10:29.011486792 +0100 +++ /var/tmp/diff_new_pack.OLXh25/_new 2026-10-29 16:10:29.013486876 +0100 @@ -1,7 +1,7 @@ # # spec file for package perl-HTTP-Body # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,23 +18,24 @@ %define cpan_name HTTP-Body Name: perl-HTTP-Body -Version: 1.230.0 +Version: 1.240.0 Release: 0 -# 1.23 -> normalize -> 1.230.0 -%define cpan_version 1.23 +# 1.24 -> normalize -> 1.240.0 +%define cpan_version 1.24 License: Artistic-1.0 OR GPL-1.0-or-later Summary: HTTP Body Parser URL: https://metacpan.org/release/%{cpan_name} Source0: https://cpan.metacpan.org/authors/id/G/GE/GETTY/%{cpan_name}-%{cpan_version}.tar.gz +Source100: README.md BuildArch: noarch BuildRequires: perl BuildRequires: perl-macros -BuildRequires: perl(HTTP::Headers) +BuildRequires: perl(HTTP::Message) BuildRequires: perl(HTTP::Request::Common) BuildRequires: perl(IO::File) >= 1.14 BuildRequires: perl(Test::Deep) BuildRequires: perl(Test::More) >= 0.86 -Requires: perl(HTTP::Headers) +Requires: perl(HTTP::Message) Requires: perl(IO::File) >= 1.14 Provides: perl(HTTP::Body) = %{version} Provides: perl(HTTP::Body::MultiPart) = %{version} @@ -55,7 +56,7 @@ It is currently used by Catalyst, Dancer, Maypole, Web::Simple and Jedi. %prep -%autosetup -n %{cpan_name}-%{cpan_version} +%autosetup -n %{cpan_name}-%{cpan_version} -p1 %build perl Makefile.PL INSTALLDIRS=vendor @@ -70,6 +71,6 @@ %perl_gen_filelist %files -f %{name}.files -%doc Changes README +%doc Changes README README.md %license LICENSE ++++++ HTTP-Body-1.23.tar.gz -> HTTP-Body-1.24.tar.gz ++++++ ++++ 1701 lines of diff (skipped) ++++++ README.md ++++++ ## Build Results Current state of perl in openSUSE:Factory is  The current state of perl in the devel project build (devel:languages:perl)  ++++++ _scmsync.obsinfo ++++++ mtime: 1793220534 commit: 25896feeebed535d080544261f74f7f90a945129e2ec54260afdb6b45b9a870e url: https://src.opensuse.org/perl/perl-HTTP-Body revision: 25896feeebed535d080544261f74f7f90a945129e2ec54260afdb6b45b9a870e projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-28 21:48:54.000000000 +0100 @@ -0,0 +1 @@ +.osc
