openSUSE-SU-2026:22187-1

This update for perl-Cpanel-JSON-XS fixes the following issues:

Changes in perl-Cpanel-JSON-XS:

• updated to 4.800.0 (4.80)

  • Security fixes, reported by Stig Palmquist (CPANSec):

    • CVE-2026-110672 decode: free the hash key on "Duplicate keys not allowed" and on a missing ':' (leak). bsc#1286166
    • CVE-2026-110673 decode: charge allow_tags "(" nesting against max_depth (stack overflow). bsc#1286167
    • CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168
    • CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted keys (malformed keys). bsc#1286169
    • CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with huge exponents (30MB from 12 bytes). bsc#1286170
    • CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts (leaked every array). bsc#1286173
    • CVE-2026-110678 incr_parse: apply max_size to the buffered text in every context. bsc#1286174
    • CVE-2026-110680 encode: bound the canonical key snapshot for growing tied or shared hashes (overflow). bsc#1286175
    • CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone instead of sharing the parent's pointers. bsc#1286176
    • CVE-2026-110682 incr_parse: reject a top-level number, true, false or null unless allow_nonref was set explicitly, as chunking changes their value. Strings, arrays and objects are unchanged. bsc#1286177
    • CVE-2026-110684 encode: release the temporary references when stringifying overloaded objects (leak). bsc#1286179
    • CVE-2026-110685 decode_tag: free the tag and its arguments when THAW dies (leak). bsc#1286180
    • CVE-2026-110686 decode: keep the filter callbacks alive while they run (use-after-free when a filter removes itself). bsc#1286181
    • CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182
    • CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the decoded text (quadratic CPU). bsc#1286183

  • Add version markers to all module files. (PR #260 demerphq)

  • Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq)

  • Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as "just a hash of keys and types", as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.

  • json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with "no type was specified for hash key '...'" for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242).

  • 4.53 2026-09-28 (rurban)

    • Fix C90 violations with arm neon (GH #258 rjbs)
    • Added a native arm64 test runner.

• updated to 4.520.0 (4.52)

  • 4.52 2026-09-12 (rurban)
    • OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
    • Change my maintainer email to reini.urban@gmail.com
  • 4.51 2026-09-11 (rurban)
    • Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang) https://github.com/cyb70289/utf8, MIT.
    • Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to make xtest when yath is installed.
    • Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen).
  • 4.50 2026-09-08 (rurban)
    • Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58). Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures.
    • Encoder performance improvements suggested in GH #237 (17dec):
      • Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000).
      • encode_str now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape. Added eg/bench_large.pl with results.

• updated to 4.440.0 (4.44)

  • Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length.

• updated to 4.430.0 (4.43)

  • Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
    • Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set.
    • Fix quadmath encode dropping ".0" for large floats (GH #246, reported by Tux). The .0 guard condition that suppressed appending for NV values > UV_MAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values.