Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Plack-Middleware-ReverseProxy
for openSUSE:Factory checked in at 2026-11-03 17:59:42
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Plack-Middleware-ReverseProxy (Old)
and
/work/SRC/openSUSE:Factory/.perl-Plack-Middleware-ReverseProxy.new.1257 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Plack-Middleware-ReverseProxy"
Tue Nov 3 17:59:42 2026 rev:2 rq:1394672 version:0.170.0
Changes:
--------
---
/work/SRC/openSUSE:Factory/perl-Plack-Middleware-ReverseProxy/perl-Plack-Middleware-ReverseProxy.changes
2021-11-20 02:40:33.132500595 +0100
+++
/work/SRC/openSUSE:Factory/.perl-Plack-Middleware-ReverseProxy.new.1257/perl-Plack-Middleware-ReverseProxy.changes
2026-11-03 18:04:39.350235982 +0100
@@ -1,0 +2,12 @@
+Wed Oct 14 10:15:19 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 0.170.0 (0.17)
+ see /usr/share/doc/packages/perl-Plack-Middleware-ReverseProxy/Changes
+
+ 0.17 2026-10-13 14:57:28 PDT
+ - SECURITY: Ignore non-numeric X-Forwarded-Port instead of copying
it verbatim
+ into SERVER_PORT and HTTP_HOST (related to CVE-2026-110335)
+ - Only accept ASCII digits as port numbers in Host, X-Forwarded-Host
and
+ X-Forwarded-Server
+
+-------------------------------------------------------------------
Old:
----
Plack-Middleware-ReverseProxy-0.16.tar.gz
New:
----
Plack-Middleware-ReverseProxy-0.17.tar.gz
README.md
_scmsync.obsinfo
build.specials.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Plack-Middleware-ReverseProxy.spec ++++++
--- /var/tmp/diff_new_pack.CtB5AH/_old 2026-11-03 18:04:41.373321010 +0100
+++ /var/tmp/diff_new_pack.CtB5AH/_new 2026-11-03 18:04:41.376321136 +0100
@@ -1,7 +1,7 @@
#
# spec file for package perl-Plack-Middleware-ReverseProxy
#
-# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -16,28 +16,32 @@
#
+%define cpan_name Plack-Middleware-ReverseProxy
Name: perl-Plack-Middleware-ReverseProxy
-Version: 0.16
+Version: 0.170.0
Release: 0
-%define cpan_name Plack-Middleware-ReverseProxy
-Summary: Supports app to run as a reverse proxy backend
+# 0.17 -> normalize -> 0.170.0
+%define cpan_version 0.17
License: Artistic-1.0 OR GPL-1.0-or-later
-Group: Development/Libraries/Perl
-Url: https://metacpan.org/release/%{cpan_name}
-Source0:
https://cpan.metacpan.org/authors/id/M/MI/MIYAGAWA/%{cpan_name}-%{version}.tar.gz
+Summary: Supports app to run as a reverse proxy backend
+URL: https://metacpan.org/release/%{cpan_name}
+Source0:
https://cpan.metacpan.org/authors/id/M/MI/MIYAGAWA/%{cpan_name}-%{cpan_version}.tar.gz
Source1: cpanspec.yml
+Source100: README.md
BuildArch: noarch
-BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: perl
BuildRequires: perl-macros
-BuildRequires: perl(Plack) >= 0.9988
+BuildRequires: perl(ExtUtils::MakeMaker) >= 6.59
+BuildRequires: perl(Plack) >= 0.998.800
BuildRequires: perl(Plack::Middleware)
BuildRequires: perl(Plack::Request)
BuildRequires: perl(parent)
-Requires: perl(Plack) >= 0.9988
+Requires: perl(Plack) >= 0.998.800
Requires: perl(Plack::Middleware)
Requires: perl(Plack::Request)
Requires: perl(parent)
+Provides: perl(Plack::Middleware::ReverseProxy) = %{version}
+%undefine __perllib_provides
%{perl_requires}
%description
@@ -46,11 +50,11 @@
requests using 'enable_if' directive in your app.psgi.
%prep
-%setup -q -n %{cpan_name}-%{version}
+%autosetup -n %{cpan_name}-%{cpan_version} -p1
%build
perl Makefile.PL INSTALLDIRS=vendor
-make %{?_smp_mflags}
+%make_build
%check
make test
@@ -61,7 +65,6 @@
%perl_gen_filelist
%files -f %{name}.files
-%defattr(-,root,root,755)
%doc Changes README
%license LICENSE
++++++ Plack-Middleware-ReverseProxy-0.16.tar.gz ->
Plack-Middleware-ReverseProxy-0.17.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Plack-Middleware-ReverseProxy-0.16/Changes
new/Plack-Middleware-ReverseProxy-0.17/Changes
--- old/Plack-Middleware-ReverseProxy-0.16/Changes 2019-02-19
17:42:46.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/Changes 2026-10-13
23:57:28.000000000 +0200
@@ -1,5 +1,11 @@
Revision history for Perl extension Plack::Middleware::ReverseProxy
+0.17 2026-10-13 14:57:28 PDT
+ - SECURITY: Ignore non-numeric X-Forwarded-Port instead of copying it
verbatim
+ into SERVER_PORT and HTTP_HOST (related to CVE-2026-110335)
+ - Only accept ASCII digits as port numbers in Host, X-Forwarded-Host
and
+ X-Forwarded-Server
+
0.16 2019-02-19 08:42:44 PST
- Update packaging to use Milla
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Plack-Middleware-ReverseProxy-0.16/LICENSE
new/Plack-Middleware-ReverseProxy-0.17/LICENSE
--- old/Plack-Middleware-ReverseProxy-0.16/LICENSE 2019-02-19
17:42:46.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/LICENSE 2026-10-13
23:57:28.000000000 +0200
@@ -292,21 +292,21 @@
- "Package" refers to the collection of files distributed by the Copyright
Holder, and derivatives of that collection of files created through
- textual modification.
+ textual modification.
- "Standard Version" refers to such a Package if it has not been modified,
or has been modified in accordance with the wishes of the Copyright
- Holder.
+ Holder.
- "Copyright Holder" is whoever is named in the copyright or copyrights for
- the package.
+ the package.
- "You" is you, if you're thinking about copying or distributing this
Package.
- "Reasonable copying fee" is whatever you can justify on the basis of media
cost, duplication charges, time of people involved, and so on. (You will
not be required to justify it to the Copyright Holder, but only to the
- computing community at large as a market that must bear the fee.)
+ computing community at large as a market that must bear the fee.)
- "Freely Available" means that no fee is charged for the item itself, though
there may be fees involved in handling the item. It also means that
recipients of the item may redistribute it under the same conditions they
- received it.
+ received it.
1. You may make and give away verbatim copies of the source form of the
Standard Version of this Package without restriction, provided that you
@@ -373,7 +373,7 @@
9. THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
-MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
The End
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Plack-Middleware-ReverseProxy-0.16/MANIFEST
new/Plack-Middleware-ReverseProxy-0.17/MANIFEST
--- old/Plack-Middleware-ReverseProxy-0.16/MANIFEST 2019-02-19
17:42:46.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/MANIFEST 2026-10-13
23:57:28.000000000 +0200
@@ -1,4 +1,4 @@
-# This file was automatically generated by Dist::Zilla::Plugin::Manifest
v6.012.
+# This file was automatically generated by Dist::Zilla::Plugin::Manifest
v6.025.
Changes
LICENSE
MANIFEST
@@ -11,6 +11,7 @@
lib/Plack/Middleware/ReverseProxy.pm
t/00_compile.t
t/author-pod-syntax.t
+t/forwarded_port.t
t/lib/Plack/Middleware/MangleEnv.pm
t/reverseproxy.t
xt/02_perlcritic.t
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Plack-Middleware-ReverseProxy-0.16/META.json
new/Plack-Middleware-ReverseProxy-0.17/META.json
--- old/Plack-Middleware-ReverseProxy-0.16/META.json 2019-02-19
17:42:46.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/META.json 2026-10-13
23:57:28.000000000 +0200
@@ -4,7 +4,7 @@
"Tatsuhiko Miyagawa"
],
"dynamic_config" : 0,
- "generated_by" : "Dist::Milla version v1.0.20, Dist::Zilla version 6.012,
CPAN::Meta::Converter version 2.143240",
+ "generated_by" : "Dist::Milla version v1.0.22, Dist::Zilla version 6.025,
CPAN::Meta::Converter version 2.150013",
"license" : [
"perl_5"
],
@@ -37,7 +37,7 @@
},
"develop" : {
"requires" : {
- "Dist::Milla" : "v1.0.20",
+ "Dist::Milla" : "v1.0.22",
"Test::Pod" : "1.41"
}
},
@@ -63,7 +63,7 @@
"web" : "https://github.com/lopnor/Plack-Middleware-ReverseProxy";
}
},
- "version" : "0.16",
+ "version" : "0.17",
"x_contributors" : [
"danjou <[email protected]>",
"Florian Ragwitz <[email protected]>",
@@ -75,8 +75,9 @@
"Tatsuhiko Miyagawa <[email protected]>",
"Tokuhiro Matsuno <[email protected]>"
],
- "x_generated_by_perl" : "v5.20.1",
- "x_serialization_backend" : "Cpanel::JSON::XS version 4.08",
+ "x_generated_by_perl" : "v5.34.1",
+ "x_serialization_backend" : "Cpanel::JSON::XS version 4.27",
+ "x_spdx_expression" : "Artistic-1.0-Perl OR GPL-1.0-or-later",
"x_static_install" : 0
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Plack-Middleware-ReverseProxy-0.16/META.yml
new/Plack-Middleware-ReverseProxy-0.17/META.yml
--- old/Plack-Middleware-ReverseProxy-0.16/META.yml 2019-02-19
17:42:46.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/META.yml 2026-10-13
23:57:28.000000000 +0200
@@ -8,7 +8,7 @@
configure_requires:
ExtUtils::MakeMaker: '0'
dynamic_config: 0
-generated_by: 'Dist::Milla version v1.0.20, Dist::Zilla version 6.012,
CPAN::Meta::Converter version 2.143240'
+generated_by: 'Dist::Milla version v1.0.22, Dist::Zilla version 6.025,
CPAN::Meta::Converter version 2.150013'
license: perl
meta-spec:
url: http://module-build.sourceforge.net/META-spec-v1.4.html
@@ -32,7 +32,7 @@
bugtracker: https://github.com/lopnor/Plack-Middleware-ReverseProxy/issues
homepage: https://github.com/lopnor/Plack-Middleware-ReverseProxy
repository: https://github.com/lopnor/Plack-Middleware-ReverseProxy.git
-version: '0.16'
+version: '0.17'
x_contributors:
- 'danjou <[email protected]>'
- 'Florian Ragwitz <[email protected]>'
@@ -43,6 +43,7 @@
- 'Nobuo Danjou <[email protected]>'
- 'Tatsuhiko Miyagawa <[email protected]>'
- 'Tokuhiro Matsuno <[email protected]>'
-x_generated_by_perl: v5.20.1
-x_serialization_backend: 'YAML::Tiny version 1.73'
+x_generated_by_perl: v5.34.1
+x_serialization_backend: 'YAML::Tiny version 1.76'
+x_spdx_expression: 'Artistic-1.0-Perl OR GPL-1.0-or-later'
x_static_install: 0
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Plack-Middleware-ReverseProxy-0.16/Makefile.PL
new/Plack-Middleware-ReverseProxy-0.17/Makefile.PL
--- old/Plack-Middleware-ReverseProxy-0.16/Makefile.PL 2019-02-19
17:42:46.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/Makefile.PL 2026-10-13
23:57:28.000000000 +0200
@@ -1,4 +1,4 @@
-# This file was automatically generated by Dist::Zilla::Plugin::MakeMaker
v6.012.
+# This file was automatically generated by Dist::Zilla::Plugin::MakeMaker
v6.025.
use strict;
use warnings;
@@ -26,7 +26,7 @@
"Plack::Request" => 0,
"parent" => 0
},
- "VERSION" => "0.16",
+ "VERSION" => "0.17",
"test" => {
"TESTS" => "t/*.t"
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Plack-Middleware-ReverseProxy-0.16/lib/Plack/Middleware/ReverseProxy.pm
new/Plack-Middleware-ReverseProxy-0.17/lib/Plack/Middleware/ReverseProxy.pm
--- old/Plack-Middleware-ReverseProxy-0.16/lib/Plack/Middleware/ReverseProxy.pm
2019-02-19 17:42:46.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/lib/Plack/Middleware/ReverseProxy.pm
2026-10-13 23:57:28.000000000 +0200
@@ -4,7 +4,7 @@
use warnings;
use 5.008_001;
use parent qw(Plack::Middleware);
-our $VERSION = '0.16';
+our $VERSION = '0.17';
sub call {
my $self = shift;
@@ -31,7 +31,7 @@
# in apache1 ServerName example.com:443
if ( $env->{HTTP_X_FORWARDED_SERVER} ) {
my ( $host, ) = $env->{HTTP_X_FORWARDED_SERVER} =~ /([^,\s]+)$/;
- if ( $host =~ /^(.+):(\d+)$/ ) {
+ if ( $host =~ /^(.+):([0-9]+)$/ ) {
# $host = $1;
$env->{SERVER_PORT} = $2;
$env->{'psgi.url_scheme'} = 'https' if $env->{SERVER_PORT} ==
443;
@@ -40,12 +40,12 @@
}
my ( $host, ) = $env->{HTTP_X_FORWARDED_HOST} =~ /([^,\s]+)$/;
- if ( $host =~ /^(.+):(\d+)$/ ) {
+ if ( $host =~ /^(.+):([0-9]+)$/ ) {
# $host = $1;
$env->{SERVER_PORT} = $2;
- } elsif ( $env->{HTTP_X_FORWARDED_PORT} ) {
+ } elsif ( $env->{HTTP_X_FORWARDED_PORT} &&
$env->{HTTP_X_FORWARDED_PORT} =~ /^([0-9]+)\z/ ) {
# in apache2 httpd.conf (RequestHeader set X-Forwarded-Port 8443)
- $env->{SERVER_PORT} = $env->{HTTP_X_FORWARDED_PORT};
+ $env->{SERVER_PORT} = $1;
$host .= ":$env->{SERVER_PORT}";
$env->{'psgi.url_scheme'} = 'https'
if $env->{SERVER_PORT} == 443;
@@ -56,7 +56,7 @@
} elsif ( $env->{HTTP_HOST} ) {
my $host = $env->{HTTP_HOST};
- if ($host =~ /^(.+):(\d+)$/ ) {
+ if ($host =~ /^(.+):([0-9]+)$/ ) {
# $env->{HTTP_HOST} = $1;
$env->{SERVER_PORT} = $2;
} elsif ($host =~ /^(.+)$/ ) {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Plack-Middleware-ReverseProxy-0.16/t/forwarded_port.t
new/Plack-Middleware-ReverseProxy-0.17/t/forwarded_port.t
--- old/Plack-Middleware-ReverseProxy-0.16/t/forwarded_port.t 1970-01-01
01:00:00.000000000 +0100
+++ new/Plack-Middleware-ReverseProxy-0.17/t/forwarded_port.t 2026-10-13
23:57:28.000000000 +0200
@@ -0,0 +1,43 @@
+use strict;
+use warnings;
+use Test::More;
+use Plack::Middleware::ReverseProxy;
+
+my $env;
+my $app = Plack::Middleware::ReverseProxy->wrap(sub { $env = shift; [ 200, [],
[] ] });
+
+sub run_with_port {
+ my $port = shift;
+ $app->({
+ 'psgi.url_scheme' => 'http',
+ HTTP_HOST => '127.0.0.1:5000',
+ SERVER_PORT => 5000,
+ HTTP_X_FORWARDED_HOST => 'example.com',
+ HTTP_X_FORWARDED_PORT => $port,
+ });
+}
+
+run_with_port('8080');
+is $env->{SERVER_PORT}, 8080, 'numeric X-Forwarded-Port is used';
+is $env->{HTTP_HOST}, 'example.com:8080';
+
+for my $port ('(', '.*.*.*1', '80abc', "80\n", '80; rm', 'example.com',
+ "\x{0663}", "\x{FF18}\x{FF10}") { # non-ASCII digits
+ run_with_port($port);
+ (my $name = $port) =~ s/([^\x20-\x7e])/sprintf '\\x{%X}', ord $1/ge;
+ is $env->{SERVER_PORT}, 80, "non-numeric X-Forwarded-Port '$name' is
ignored";
+ is $env->{HTTP_HOST}, 'example.com', "non-numeric X-Forwarded-Port '$name'
is not added to Host";
+}
+
+# non-ASCII digits in the port part of Host headers are not a port
+for my $header (qw(HTTP_HOST HTTP_X_FORWARDED_HOST)) {
+ $app->({
+ 'psgi.url_scheme' => 'http',
+ HTTP_HOST => '127.0.0.1',
+ SERVER_PORT => 5000,
+ $header => "example.com:\x{0663}",
+ });
+ is $env->{SERVER_PORT}, 80, "non-ASCII digits in $header port are ignored";
+}
+
+done_testing;
++++++ README.md ++++++
## Build Results
Current state of perl in openSUSE:Factory is
The current state of perl in the devel project build (devel:languages:perl)
++++++ _scmsync.obsinfo ++++++
mtime: 1791972919
commit: ff94b81fdc6dff9ebf37aae464c091b6356875dd00ed6bcff213d4bddaa5e9dd
url: https://src.opensuse.org/perl/perl-Plack-Middleware-ReverseProxy
revision: ff94b81fdc6dff9ebf37aae464c091b6356875dd00ed6bcff213d4bddaa5e9dd
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-10-14 12:15:19.000000000 +0200
@@ -0,0 +1 @@
+.osc
