CVS commit: pkgsrc/converters/p5-Cpanel-JSON-XS

["Wen Heping" <wen%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wen
Date:           Fri Jul 24 02:58:23 UTC 2026

Modified Files:
        pkgsrc/converters/p5-Cpanel-JSON-XS: Makefile distinfo

Log Message:
Update to 4.43

Upstream changes:
4.43 2026-07-18 (rurban)
        - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
        - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts
          UTF-8 decoding instead of checking SvUTF8 flag, since older Perls
          may store valid UTF-8 hash keys without the flag set.
        - Fix quadmath encode dropping ".0" for large floats (GH #246, reported by Tux).
          The .0 guard condition that suppressed appending for NV values > UV_MAX was
          incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where
          %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31
          to skip only on double/80-bit-ld where %g naturally uses %e for large values.
4.42 2026-06-27 (rurban)
        - Ensure encode with a type spec hashref does not change the hashref argument (GH #240)
        - Fix -e docs: "written" → "read" (GH #239, reported by Ron Savage).
        - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
          Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal
          to false because undef stringifies to "". Added defined() guard.
        - Fix error messages showing overloaded stringification for blessed
          objects (GH #191, reported by karenetheridge). Error messages now
          use ClassName=TYPE(addr) format, bypassing any "" overload.
        - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,
          reported by alpha6). With type_all_string + allow_blessed, blessed
          objects are now encoded as null (not stringified as HASH address).
        - Fix infinite recursion when encode is called from a "" overload
          (GH #128, reported by pbrthemaster). The recursion guard temporarily
          clears convert_blessed and allow_stringify flags on the JSON object
          before calling the overload, preventing re-entrant encode loops.
        - Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
          When new() is called on an existing object (e.g. $json->new->new),
          the class name is now extracted from the object's stash rather than
          using the stringified reference.
        - Change allow_nonref default to true (GH #241, matching JSON::PP and
          JSON::XS 4.0+ and the insecure RFC 7159).
          encode and decode now accept non-reference values by default.
          decode_json() with an explicit 0/1 second argument still works.
          allow_nonref(0) to disable scalars-only for secure JSON.
        - Fix minor t/12_blessed.t typo.
        - Fix GH #112: encode large whole-number NV values without .0 on
          32-bit Perl (values exceeding UV_MAX that Perl stores as float).
        - Fix GH #197: prefer IOK over pNOK when encoding values where
          IV is accurate but NV is imprecise (SvNOK not set).
4.41 2026-05-27 (rurban)
        - Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516) (patch by Paul Johnson)
        - Fix dupkeys_as_arrayref type confusion (CVE-2026-9334) (patch by Paul Johnson)
        - Fix incr_parse single-quote string delimiter (GH #245, reported by
          Paul Johnson)
        - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
          truncated input (GH #244, reported by Paul Johnson)
4.40 2025-09-07 (rurban)
        - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
        - Detect more malformed numbers, with two decimal points.
        - Pin github actions to latest @v via pinact run -u
4.39 2024-12-12 (rurban)
        - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)
        - Fix inconsistent behavior between decoding escaped and unescaped
          surrogates, and escaped non-characters vs non-escaped non-characters.
          Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)
        - Add type_all_string tests (Bernhard Schmalhofer GH #236)
        - Silence UV to char cast warnings  (bulk88 GH #232)
        - Fix MSVC preprocessor errors (bulk88 GH #232)
        - Fix -Wformat warnings on Windows (sisyphus GH #228)
        - Clarify BigInt decoding (GH #226)
4.38 2024-05-27 (rurban)
        - Encode real core booleans as boolean notation (PR #224 leonerd)
        - Minor test fixes by leonerd
        - Fix docs typo (PR #225 karenetheridge)
4.37 2023-07-04 (rurban)
        - Fix NAN/INF for AIX (Tux: AIX-5.3, tested by XSven on AIX-7.3) GH #165
        - Fix empty string result in object stringification (PR #221 jixam)
        - Allow \' in strings when allow_singlequote is enabled (PR #217 warpspin)
4.36 2023-03-02 (rurban)
        - remove the SAVESTACK_POS noop. Merged from JSON-XS-3.02,
          removed there with 4.0. requested to remove with
          L<https://github.com/Perl/perl5/pull/20858>
4.35 2023-02-22 (rurban)
        - fix utf8 object stringification (jixam PR #212)
4.34 2023-02-21 (rurban)
        - fix c89 compilation regression, for loop init on centos. GH #211
4.33 2023-02-21 (rurban)
        - fix a security issue, decoding hash keys without ending :
          (GH #208)
        - check all bare hash keys for utf8 (GH #209)
        - improve overload warnings (Graham Knop PR #205)
        - fix a croak leak (GH #206)


To generate a diff of this commit:
cvs rdiff -u -r1.19 -r1.20 pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile
cvs rdiff -u -r1.11 -r1.12 pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile
diff -u pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile:1.19 pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile:1.20
--- pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile:1.19   Thu Jul 16 19:01:29 2026
+++ pkgsrc/converters/p5-Cpanel-JSON-XS/Makefile        Fri Jul 24 02:58:23 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.19 2026/07/16 19:01:29 wiz Exp $
+# $NetBSD: Makefile,v 1.20 2026/07/24 02:58:23 wen Exp $
 
-DISTNAME=      Cpanel-JSON-XS-4.32
+DISTNAME=      Cpanel-JSON-XS-4.43
 PKGNAME=       p5-${DISTNAME}
-PKGREVISION=   4
 CATEGORIES=    converters textproc perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/R/RU/RURBAN/}
 

Index: pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo
diff -u pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo:1.11 pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo:1.12
--- pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo:1.11   Fri Sep 30 23:41:55 2022
+++ pkgsrc/converters/p5-Cpanel-JSON-XS/distinfo        Fri Jul 24 02:58:23 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.11 2022/09/30 23:41:55 wen Exp $
+$NetBSD: distinfo,v 1.12 2026/07/24 02:58:23 wen Exp $
 
-BLAKE2s (Cpanel-JSON-XS-4.32.tar.gz) = 9dfac6d89c6fb3b046f5a9fcf32ee044afdb62af4db74e115c167f62ceed5e16
-SHA512 (Cpanel-JSON-XS-4.32.tar.gz) = f17809bb12c388e6344ef738abddd471d541e3854ca8775f518a4cda62f129a703bbaf85e4bf2fa960390df060a161f1ff61a3d3a35c269ae1dc4fe9af8389dd
-Size (Cpanel-JSON-XS-4.32.tar.gz) = 256502 bytes
+BLAKE2s (Cpanel-JSON-XS-4.43.tar.gz) = 8f41ef16be92fefedb83adc83c76a58dad64954f38180e9c9be8965e97bcbe00
+SHA512 (Cpanel-JSON-XS-4.43.tar.gz) = 42105fd0ee07fbd77e34572a9035e1e1837ce04e89bcd0191585eefdb2095b07f2c5a4ee0a64c261f63902cb7d25ce05edd11c9e66e14db46d06d28f8898e7ed
+Size (Cpanel-JSON-XS-4.43.tar.gz) = 270227 bytes