SUSE-SU-2026:4926-1

This update for perl-Cpanel-JSON-XS fixes the following issues:

• CVE-2025-40929: integer overflow (bsc#1249331).
• CVE-2026-9334: type confusion via duplicate object keys when dupkeys_as_arrayref is enabled (bsc#1267546).
• CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).
• CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in decode_hv (bsc#1286166).
• CVE-2026-110673: stack exhaustion via nested tagged values under allow_tags in decode_tag (bsc#1286167).
• CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under dupkeys_as_arrayref in decode_hv (bsc#1286168).
• CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under allow_barekey in decode_hv (bsc#1286169).
• CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum (bsc#1286170).
• CVE-2026-110677: array collecting duplicate key values leaked under dupkeys_as_arrayref in decode_hv (bsc#1286173).
• CVE-2026-110678: memory exhaustion by buffering incremental input past max_size in incr_parse (bsc#1286174).
• CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in encode_hv (bsc#1286175).
• CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new ithread (bsc#1286176).
• CVE-2026-110682: input chunking can change the decoded value of top-level numbers in incr_parse (bsc#1286177).
• CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in encode_stringify (bsc#1286179).
• CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in decode_tag (bsc#1286180).
• CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in decode_hv (bsc#1286181).
• CVE-2026-110687: byte-string keys misordered during canonical encoding in utf16_cmp (bsc#1286182).
• CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in incr_parse (bsc#1286183).

Changes for perl-Cpanel-JSON-XS:

• updated to 4.800.0 (4.80)
• Add version markers to all module files. (PR #260 demerphq)
• Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq)
• Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.
• json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242). eg/bench_large.pl: old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53 new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80 4.53 2026-09-28 (rurban)
• Fix C90 violations with arm neon (GH #258 rjbs)
• Added a native arm64 test runner.
• updated to 4.520.0 (4.52) 4.52 2026-09-12 (rurban)
• OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
• Change my maintainer email to reini.urban@gmail.com 4.51 2026-09-11 (rurban)
• Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)
• Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to make xtest when yath is installed.
• Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen). 4.50 2026-09-08 (rurban)
• Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58). Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures.
• Encoder performance improvements suggested in GH #237 (17dec):

• Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000).
• encode_str now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape. Added eg/bench_large.pl with results.

• updated to 4.440.0 (4.44) 4.44 2026-09-02 (rurban)
• Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length.
• updated to 4.430.0 (4.43) 4.43 2026-07-18 (rurban)
• Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
• Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set.
• Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux). The .0 guard condition that suppressed appending for NV values > UV_MAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values.
• updated to 4.420.0 (4.42) 4.42 2026-06-27 (rurban)
• Ensure encode with a type spec hashref does not change the hashref argument (GH #240)
• Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage).
• Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to ''. Added defined() guard.
• Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any '' overload.
• Fix type_all_string overriding allow_blessed/convert_blessed (GH #175, reported by alpha6). With type_all_string + allow_blessed, blessed objects are now encoded as null (not stringified as HASH address).
• Fix infinite recursion when encode is called from a '' overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convert_blessed and allow_stringify flags on the JSON object before calling the overload, preventing re-entrant encode loops.
• Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's stash rather than using the stringified reference.
• Change allow_nonref default to true (GH #241, matching JSON::PP and JSON::XS 4.0+ and the insecure RFC 7159). encode and decode now accept non-reference values by default. decode_json() with an explicit 0/1 second argument still works. allow_nonref(0) to disable scalars-only for secure JSON.
• Fix minor t/12_blessed.t typo.
• Fix GH #112: encode large whole-number NV values without .0 on 32-bit Perl (values exceeding UV_MAX that Perl stores as float).
• Fix GH #197: prefer IOK over pNOK when encoding values where IV is accurate but NV is imprecise (SvNOK not set).
• updated to 4.410.0 (4.41) 4.41 2026-05-27 (rurban)
• Fix incr_parse single-quote string delimiter (GH #245, reported by Paul Johnson)
• Fix a one-byte out-of-bounds heap read reachable via allow_barekey on truncated input (GH #244, reported by Paul Johnson)
• updated to 4.400.0 (4.40) 4.40 2025-09-07 (rurban)
• Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
• Detect more malformed numbers, with two decimal points.
• Pin github actions to latest @v via pinact run -u (bsc#1249331)
• updated to 4.390.0 (4.39) 4.39 2024-12-12 (rurban)
• Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)
• Fix inconsistent behavior between decoding escaped and unescaped surrogates, and escaped non-characters vs non-escaped non-characters. Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)
• Add type_all_string tests (Bernhard Schmalhofer GH #236)
• Silence UV to char cast warnings (bulk88 GH #232)
• Fix MSVC preprocessor errors (bulk88 GH #232)
• Fix -Wformat warnings on Windows (sisyphus GH #228)
• Clarify BigInt decoding (GH #226)