[Midnightbsd-cvs] [MidnightBSD/mports] 3a7ea5: lang/perl5.40: update to 5.40.5 (security)

[Lucas Holt]

  Branch: refs/heads/lang/perl5.40
  Home:   https://github.com/MidnightBSD/mports
  Commit: 3a7ea5f6014f44fc833899c00a4bcbf53b983113
      https://github.com/MidnightBSD/mports/commit/3a7ea5f6014f44fc833899c00a4bcbf53b983113
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-16 (Sun, 16 Aug 2026)

  Changed paths:
    M Mk/extensions/perl5.mk
    M lang/perl5.40/distinfo
    M lang/perl5.40/pkg-plist
    M lang/perl5.40/version.mk

  Log Message:
  -----------
  lang/perl5.40: update to 5.40.5 (security)

Fixes three CVEs in the regex engine and pack/unpack:

  CVE-2026-8376  - buffer overflow in Perl_study_chunk
  CVE-2026-57432 - buffer overflow in S_measure_struct
  CVE-2026-13221 - regex trie 16-bit field overflow

pkg-plist gains IO/Compress.pm, IO::Compress.3 and the perl5405delta
pod/man pages.

Mk/extensions/perl5.mk carries a second copy of the version in
_DEFAULT_PERL_VERSION.  It is dead on 4.x -- lang/perl5.40/version.mk is
included two lines later and assigns PERL_VERSION unconditionally -- but
sync it so the two do not silently diverge.

No PORTREVISION bump for dependent ports: libperl's SONAME is
libperl.so.5.40 (branch only), so a patch level bump is ABI neutral.

AI-Assisted-by: Claude Opus 5 (1M context) <noreply at anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply at anthropic.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications