view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

    claimed in a working column that has stopped moving, and one left untouched in
    the backlog.
  - Coverage gate: refuses to grade a database written by a different
    Devel::Cover install, and says which two disagree, instead of exiting with an
    unexplained status.

4.25  2026-08-09

  - CI: restored a pipeline that had certified nothing for ten days. Three
    GitHub Action pins sat on the node20 line while their version comments
    claimed node24, so every run died at Setup Perl and the suite, the coverage
    gate and both CVE audits never executed (DD-449). The pin comments are now
    resolved against the upstream tag rather than trusted (DD-449), the
    environment export no longer swallows its own failure inside a command
    substitution (DD-483), and two suite files no longer assume tools and
    libraries CI installs elsewhere (DD-485).
  - Security: helper session ids are drawn from the operating system CSPRNG
    instead of a SHA over the pid, the wall-clock second and built-in rand -
    the construction CVE-2026-13577 describes in Dancer2, reimplemented here in
    the code guarding the web interface. Crypt::URandom is now a declared
    dependency floored at 0.55, because CVE-2026-2474 affects earlier releases
    (DD-452).
  - Security: dispositioned CVE-2026-13577 for Dancer2, which has no fixed
    release, behind a guard that fails the audit if any production code ever
    activates a Dancer2 session (DD-451).
  - Security: closed a Zip Slip in dashboard open-file, where a sources jar
    could write attacker-controlled paths anywhere the user can write (DD-498).
  - Security: corrected the CVE gate's subject so it judges the product's
    declared chain rather than the host interpreter (DD-499).
  - Fix: a collector's loop state is written before its pidfile, so a
    concurrent running_loops can no longer delete the pidfile of a healthy loop
    and leave it unstoppable by name while the supervisor forks a duplicate
    (DD-488).
  - Fix: Housekeeper's temp-file cleanup lists its directory instead of
    globbing a pattern built from the path, so a directory whose path contains
    a space stops hiding every real temp file and unlinking unrelated ones
    (DD-502).
  - Test reliability: the coverage gate, the empty-environ probe and several
    collector lifecycle fixtures no longer fail purely because the host is
    CPU-starved, which is the shape of every CI runner (DD-482, DD-486,
    DD-489). Every timeout changed here is backed by a measurement rather than
    by the fact that a larger number passes.

4.24  2026-08-08

  - Security: closed the open-redirect class in the login redirect sanitizer
    and on both HTTPS-enforcement Host-header redirect paths (DD-415, DD-419),
    rather than only the single reported byte.
  - Security: closed three path-traversal classes - saved-page writes outside
    the dashboards root (DD-395), parent-directory traversal in every
    skill-namespaced web route with static-file containment asserted (DD-416),
    and skill installs whose repo name escapes the skills root (DD-426).
  - Security: every page-derived value the web layer places inside an HTML
    attribute is now escaped for attribute context (DD-421), and saved
    bookmark link segments are percent-encoded for URL context (DD-423).
  - Security: state-changing requests are rejected when Origin or Referer is
    foreign, on every web tier (DD-422).
  - Security: the transient-token denial now depends on the token alone, so a
    file value riding along can no longer bypass the 403 (DD-425).
  - Security: release tarballs no longer carry dogfood QA evidence, ticket
    worktrees (DD-414), or the Hermes runtime state root and its credentials
    (DD-432).
  - Feature: first-class self-upgrade - dashboard upgrade and d2 upgrade run
    the canonical platform installer (DD-386).
  - Feature: a real /favicon.ico is served instead of a 404 on every page
    load (DD-407).
  - Collectors: a timed-out command's full process subtree is terminated
    (DD-388); blocked Windows command collectors are interrupted at their
    timeout (DD-389); the atomic writer uses a per-process pending name so
    concurrent workers stop clobbering each other (DD-418); log append and
    rotation share a per-log lock (DD-399) and rotation cuts on entry
    boundaries so a combined lines+days rule cannot orphan an entry body
    (DD-427); collectors keep running when the updates directory is absent
    (DD-398).
  - Runtime: saved-Ajax disconnect cleanup terminates descendant processes
    (DD-396) and gives them a real elapsed SIGTERM grace window (DD-428);
    runtime state readers survive a transient empty state file (DD-411) and
    the web lifecycle no longer acts on incomplete runtime state (DD-412).
  - Windows: the SSL certificate home resolves through PathRegistry so the
    HTTPS server starts (DD-417); every passwd lookup is guarded so
    non-interactive sessions resolve a user and a home (DD-413); PERL5LIB
    generation is cross-platform (DD-397); PowerShell startup caches are
    anchored to the home layer and no longer clobber live PATH state
    (DD-390).
  - Web UI: every generated HTML document carries a lang attribute (DD-405);
    logout and an authorized /login route by trust tier (DD-408); page-editor
    textareas carry programmatic accessible names (DD-409); rendered page
    chrome no longer overflows 320px phone viewports (DD-410).
  - Performance: PathRegistry working-directory lookups no longer fork
    /bin/pwd repeatedly (DD-393).
  - Gates: the POD syntax gate reads the source tree instead of a stale copy
    and the three reds it was hiding are fixed (DD-429); the coverage gate
    grades lib/ instead of the stale build tree (DD-431) and a failed exec in
    the harness process can no longer blind it (DD-428); the Windows
    collector-timeout E2E is proven on a real QEMU Windows guest and made
    repeatable (DD-404).
  - Metadata: MakeMaker license metadata aligned with MIT (DD-400).

4.23  2026-07-29

  - Coverage: every module under lib/ now reaches 100.0 on all four
    Devel::Cover metrics - statement, subroutine, branch, AND condition -
    driven by the new per-module hermetic coverage suites (t/59 through
    t/106) with genuinely-unreachable outcomes annotated inline and dead
    guard operands removed where redundancy caused unreachable branches.
  - CI: all three workflows (test, release-github, release-cpan) enforce the
    all-metric standard through script/check-all-metric-coverage, which
    fails closed on any metric below 100.0 or any malformed report
    (t/107-all-metric-coverage-gate.t).
  - Security: helper host-trust no longer accepts arbitrary Host headers
    that merely resolve to loopback, closing a DNS-rebinding vector; exact
    loopback literals and configured alias hosts remain trusted.
  - Test isolation: the fresh-runtime API assertions in
    t/15-cli-module-coverage.t now chdir into their isolated HOME so a
    dev-runtime layer in the working checkout cannot capture their writes.
  - Installability: the dependency hardening initially raised the Perl floor
    to 5.44, which cpanm rejects on every mainstream perl (perl:latest is
    5.42); the floor is restored to 5.38 (the code's real requirement) while
    CI continues to run on Perl 5.44 and the dependency version pins keep
    the security gate.