CVS commit: pkgsrc/textproc/p5-XML-Parser

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Apr 26 04:41:21 UTC 2026

Modified Files:
        pkgsrc/textproc/p5-XML-Parser: Makefile distinfo

Log Message:
p5-XML-Parser: update to 2.58.

2.58 2026-04-23 (by Todd Rinaldo)

  Fixes:
    - PR #260 Prevent element-name SV leak when Start or End handlers
      die: wrap the call_sv in ENTER/SAVEFREESV/LEAVE so an exception
      thrown from a handler no longer leaks one SV per call. Audited
      all 19 XS callbacks — startElement and endElement were the only
      ones with non-mortal SVs across a call_sv boundary
    - PR #259 Add NULL check for GvIOp in XML_Do_External_Parse to
      prevent a segfault when an ExternEnt handler returns an
      unopened filehandle. GvIOp returns NULL for a glob that has
      never been opened; both call sites previously passed the NULL
      straight to newRV_inc
    - PR #258 Release the parser when an Init or Final handler dies.
      The release() call used to be skipped on exception, leaving a
      circular reference through self_sv so DESTROY never ran and the
      parser leaked permanently
    - PR #257 Free doctype_sysid during normal parser teardown and
      NULL self_sv after release. Every parse of a document with a
      <!DOCTYPE ... SYSTEM "..."> declaration previously leaked the
      system-id string on the non-error path (free_cbv already freed
      it on the error path)
    - PR #255 Use bare return instead of "return undef" in
      ContentModel::children() and expand_ns_prefix(). "return undef"
      in list context produces (undef) — a one-element list — which
      silently broke callers checking @result for emptiness
    - PR #246 Use three-argument open in file_ext_ent_handler so that
      pipe characters and IO-mode prefixes in external-entity SYSTEM
      identifiers can never be interpreted by Perl's two-argument
      open. The existing regex check is now defense-in-depth rather
      than the sole protection
    - PR #242 Add NULL-after-allocation checks with cascading cleanup
      to the three New() calls in LoadEncoding, consistent with the
      pattern established for XML_ParserCreate_MM in PR #204

  Improvements:
    - PR #267 Address CPANTS Kwalitee issues: add =head1 LICENSE to
      Parser.pm, add use warnings to Expat.pm, add provides to
      META_MERGE (using MM->parse_version() to avoid hardcoding), and
      add SECURITY.md and CONTRIBUTING.md
    - PR #265 Fix Doctype handler Internal parameter documentation in
      Parser.pm — the XS code pushes PL_sv_yes/PL_sv_no (a boolean
      indicating whether an internal subset exists), not the subset
      string the POD claimed. Also correct the DoctypeFin parameter
      label from (Parser) to (Expat) and a minor Expat.pm POD typo
    - PR #264 Add use strict and use warnings to Makefile.PL and
      Expat/Makefile.PL, and convert $expat_libpath / $expat_incpath
      from bare globals to lexicals
    - PR #262 Modernize META resources to CPAN Meta spec v2 —
      structured bugtracker and repository entries so MetaCPAN and
      CPAN tooling can extract richer information (separate git URL,
      web URL, and tracker type)
    - PR #256 Add use warnings to Parser.pm and all five Style
      modules. Expat.pm is intentionally excluded and already
      documents why (it uses int() on strings in namespace methods)
    - PR #254 Improve const-correctness in Expat.xs: propagate
      const char * through newUTF8SVpv, newUTF8SVpvn, and
      append_error, and drop 30+ now-unnecessary (char *) casts. No
      functional change — identical generated code
    - PR #251 Add a Codecov coverage badge to README.md alongside the
      existing CI badge
    - PR #250 Document the Codecov coverage integration in CLAUDE.md,
      including the two flags (perl via Devel::Cover, xs via
      gcov/lcov) and a link to the dashboard
    - PR #247 Add a Devel::Cover code-coverage CI job that measures
      both Perl and XS/C coverage (via gcc --coverage + lcov) and
      uploads to Codecov with separate perl/xs flags
    - PR #241 Add a SECURITY section to Parser.pm POD documenting the
      BillionLaughsAttackProtection*, AllocTracker*, and
      ReparseDeferralEnabled options, with cross-references from the
      new() option list

  Maintenance:
    - PR #266 Add 22 tests in t/expat_guards.t covering Expat.pm
      input validation (setHandlers type/arity checks), parse-state
      guards, and reference-exception preservation
    - PR #263 Upgrade cross-platform-actions from v0.32 to v1 in the
      BSD (FreeBSD, OpenBSD, NetBSD) CI jobs
    - PR #261 Add 4 missing test files to MANIFEST via make manifest
      and extend MANIFEST.SKIP with standard exclusions for build
      artifacts (blib/, *.o, *.so, *.bs, *.c, cover_db/, .DS_Store,
      Makefile.old) so future regenerations stay clean
    - PR #253 Add missing use strict and use warnings to 9 test files
      so the whole suite is consistent, and fix an undeclared
      $parser in t/file.t surfaced by the new strictures
    - PR #252 Upgrade actions/checkout from v4 to v6 in the release
      workflow (the testsuite workflow was already upgraded)
    - PR #249 Add t/expat_xs_coverage.t with 26 tests targeting
      previously-uncovered paths in Expat.xs (93% → 95% line
      coverage), focused on skip_until suspend/resume, namespace
      cleanup in finish(), and external-entity edge cases
    - PR #248 Add t/coverage_gaps.t with 31 tests for previously
      uncovered Perl code paths identified via Devel::Cover — Debug
      and Stream style Proc/PI handlers, Expat direct parse methods,
      ContentModel MIXED asString, and security-API argument
      validation. Subroutine coverage reaches 100% across all modules
    - PR #245 Add 16 targeted Stream_Delimiter boundary tests that
      exercise the XS parse_stream delimiter detection logic directly
      with small controlled documents (t/stream.t only exercised it
      against one large sample file)
    - PR #244 Add t/parser_api.t covering the XML::Parser API
      surface: setHandlers return and croak semantics, parsefile Base
      save/restore (including on error), parser reuse, parse return
      values in scalar and list context, Init handler invocation,
      and Pkg defaulting


To generate a diff of this commit:
cvs rdiff -u -r1.65 -r1.66 pkgsrc/textproc/p5-XML-Parser/Makefile
cvs rdiff -u -r1.23 -r1.24 pkgsrc/textproc/p5-XML-Parser/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/p5-XML-Parser/Makefile
diff -u pkgsrc/textproc/p5-XML-Parser/Makefile:1.65 pkgsrc/textproc/p5-XML-Parser/Makefile:1.66
--- pkgsrc/textproc/p5-XML-Parser/Makefile:1.65 Sun Apr 12 05:39:12 2026
+++ pkgsrc/textproc/p5-XML-Parser/Makefile      Sun Apr 26 04:41:20 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.65 2026/04/12 05:39:12 wiz Exp $
+# $NetBSD: Makefile,v 1.66 2026/04/26 04:41:20 wiz Exp $
 
-DISTNAME=      XML-Parser-2.57
+DISTNAME=      XML-Parser-2.58
 PKGNAME=       p5-${DISTNAME}
 CATEGORIES=    textproc perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/T/TO/TODDR/}

Index: pkgsrc/textproc/p5-XML-Parser/distinfo
diff -u pkgsrc/textproc/p5-XML-Parser/distinfo:1.23 pkgsrc/textproc/p5-XML-Parser/distinfo:1.24
--- pkgsrc/textproc/p5-XML-Parser/distinfo:1.23 Sun Apr 12 05:39:12 2026
+++ pkgsrc/textproc/p5-XML-Parser/distinfo      Sun Apr 26 04:41:20 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.23 2026/04/12 05:39:12 wiz Exp $
+$NetBSD: distinfo,v 1.24 2026/04/26 04:41:20 wiz Exp $
 
-BLAKE2s (XML-Parser-2.57.tar.gz) = 317c7a5459dea6c62e05e9c31e5348133c6137957dc51d7afe404bc39f8fa0f6
-SHA512 (XML-Parser-2.57.tar.gz) = 21e2d9ff12ce5dea31d386ee15f14dac91d8697183284b581b6a2c674cb586a8aa04f6480b9e22d497c4db84a691cf133cbbc0e87fe20a7c3d305de2b56bb5a5
-Size (XML-Parser-2.57.tar.gz) = 452146 bytes
+BLAKE2s (XML-Parser-2.58.tar.gz) = f0aa6b08941df536b3e05979de9d36d6bdd358c88c561f3644c4131d7cc8b7b6
+SHA512 (XML-Parser-2.58.tar.gz) = f62b0b1eb131194c40118b609545cc1870252655ebf144c95487469e4b69ac4f3127bca54a06014d8676cb996673a854d87144b63b15f362f909bb8fb18fb69c
+Size (XML-Parser-2.58.tar.gz) = 472296 bytes