| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: perl-YAML-Syck | Distribution: Fedora Project |
| Version: 1.47 | Vendor: Fedora Project |
| Release: 1.fc45 | Build date: Tue Jul 14 11:28:05 2026 |
| Group: Unspecified | Build host: buildvm-ppc64le-15.rdu3.fedoraproject.org |
| Size: 279004 | Source RPM: perl-YAML-Syck-1.47-1.fc45.src.rpm |
| Packager: Fedora Project | |
| Url: https://metacpan.org/release/YAML-Syck | |
| Summary: Fast, lightweight YAML loader and dumper | |
This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around.
GPL-2.0-or-later AND MIT
* Tue Jul 14 2026 Paul Howarth <paul@city-fan.org> - 1.47-1
- Update to 1.47
Security:
- Fix four libsyck memory-safety CVEs reachable from the default
YAML::Syck::Load() path on untrusted input with no special flags (GH#213)
- CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder
caused by signed-char indexing of the decode table on !!binary input
- CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared
between the node and the anchors table
- CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer
newline scan during block-scalar parsing (incomplete-fix follow-on
to CVE-2025-11683)
- CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an
anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input
- Harden syck_base64dec() to bounds-check each read so it cannot run past a
non-NUL-terminated input buffer (defense-in-depth for callers passing raw
buffers; GH#213)
Bug Fixes:
- Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply
nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512,
matching Dump (GH#204)
- Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in
Dump so they roundtrip with ImplicitTyping instead of reloading as plain
strings (GH#201)
Maintenance:
- CI: add an AddressSanitizer job that builds the XS with
-fsanitize=address and runs the suite plus the CVE trigger inputs to catch
libsyck memory-safety defects; de-pin the libasan version so it tracks the
runner's GCC (GH#213)
* Mon May 25 2026 Paul Howarth <paul@city-fan.org> - 1.46-1
- Update to 1.46
Bug Fixes:
- Preserve string nature of numeric-looking values in Dump; pure strings (POK
only, no IOK/NOK) are now quoted to maintain roundtrip fidelity
(GH#199, GH#200)
- Accept trailing commas in flow sequences and mappings ([a, b,] and
{a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH#195, GH#196)
Maintenance:
- CI: upgrade install-with-cpm to v2 for compatibility with Perl versions
prior to 5.24 in perldocker containers (GH#197, GH#198)
- Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries,
exclude .claude/ from distribution
* Mon Apr 27 2026 Paul Howarth <paul@city-fan.org> - 1.45-1
- Update to 1.45
Bug Fixes:
- Fix: Use syck_base64_free() to fix Windows "Free to wrong pool" crash in
base64 encode/decode buffers; also plugs a memory leak (GH#189)
- Fix: Clear type tag on blessed scalar alias early-return so the stale tag
no longer leaks onto the next emitted item (GH#193, GH#194, rhbz#2459200)
- Fix: Negative float#base60 values produce wrong results; strip sign before
accumulating and avoid negative zero for portable stringification (GH#191)
- Fix: Prevent memory leaks when Load/LoadJSON croak on parse errors (GH#192)
Maintenance:
- Test: Add coverage for SortKeys and JSON MaxDepth (GH#188)
- Test: Add error handling coverage for LoadFile/DumpFile (GH#190)
- Update README
* Fri Apr 03 2026 Paul Howarth <paul@city-fan.org> - 1.44-1
- Update to 1.44
Bug Fixes:
- Fix: Positive hex and octal values parsed as 0 with ImplicitTyping (GH#187)
- Fix: Resolve uintptr_t redefinition error on Win64 MinGW (GH#186)
* Thu Apr 02 2026 Paul Howarth <paul@city-fan.org> - 1.43-1
- Update to 1.43
Bug Fixes:
- Fix: Prevent resource leaks on croak/early-return paths in Dump (GH#161)
- Fix: Prevent output SV leaks on croak in Dump/DumpFile callers (GH#163)
- Fix: Load() in list context returns empty list for empty/undef input; also
applies to LoadBytes and LoadUTF8 (GH#164, GH#165)
- Fix: DumpCode serializes prototype string instead of code body (GH#168)
- Fix: Memory leak in !perl/scalar Load - newRV_inc should be newRV_noinc
(GH#170)
- Fix: Add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl
(GH#175, GH#176)
- Fix: Add TODO guard for eval_pv leak on Perl < 5.14 (GH#179, GH#180)
- Fix: Negative hex and octal values parsed as 0 with ImplicitTyping (GH#183)
- Fix: Negative int#base60 values produce unsigned wraparound (GH#185)
Improvements:
- Modernize META_MERGE for CPANTS compliance (GH#162)
- Fix hash table size handling and remove compile warnings in syck_st (GH#174)
Maintenance:
- Restore TODO guard for Dump code leak test on Perl < 5.26 (GH#167)
- Resolve 2010 TODO in perl_json_postprocess with test coverage (GH#166)
- CI: Upgrade actions to resolve Node.js 20 deprecation warnings (GH#177)
* Fri Mar 27 2026 Paul Howarth <paul@city-fan.org> - 1.42-1
- Update to 1.42
Bug Fixes:
- Fix: Replace strtok() with strpbrk() and fix sign-compare warnings in
perl_syck.h (GH#145)
- Fix: Terminate plain scalars at document boundaries --- and ... (GH#150)
- Fix: Skip %TAG and %YAML directives in document header (GH#151)
- Fix: Plug SV leak when eval_pv croaks on bad perl/code blocks (GH#153)
- Fix: Allow non-specific tag '!' before block scalars (GH#27, GH#102)
- Fix: Remove spurious %type <nodeId> for indent_open in gram.y
(GH#157, GH#158)
- Fix: Use modern bison %define api.prefix directive (GH#159, GH#160)
Improvements:
- Implement YAML merge key (<<) support (GH#149)
Maintenance:
- Remove dead Perl 5.6/5.8 version guards from test files (GH#146)
- Add YAML 1.0 spec compliance audit and coverage tests (GH#148)
- Add comprehensive round-trip tests for YAML 1.0 spec features (GH#152)
- Remove unneeded TODO in t/json-basic.t (GH#154)
- Add regex Dump/Load/round-trip tests to perl tag scheme (GH#155)
- Do not require a .y file to build YAML::Syck; add brew support for bison
- Don't ship docs/ directory in tarball
* Mon Mar 23 2026 Paul Howarth <paul@city-fan.org> - 1.41-1
- Update to 1.41
Bug Fixes:
- Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of
strtod() so that floats like -3.14 are not corrupted by double-precision
rounding artifacts (GH#140, GH#141)
* Sun Mar 22 2026 Paul Howarth <paul@city-fan.org> - 1.39-1
- Update to 1.39
Bug Fixes:
- Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety
(GH#125, GH#130)
- Fix: anchor tracking for blessed scalar refs in Dump (GH#126, GH#131)
- Fix: prevent buffer underflow in base60 (sexagesimal) parsing (GH#133)
- Fix: guard against NULL type from strtok in tag parsing (GH#135)
- Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (GH#137)
- Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls
(GH#138, GH#139)
Improvements:
- Resolve TODO tests for empty/invalid YAML to match actual behaviour
(GH#127, GH#129)
Maintenance:
- Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (GH#129)
- Add comprehensive implicit type resolution test suite (GH#137)
- Update MANIFEST to include all unit tests
- Clean up test names to remove unnecessary numbering
* Thu Mar 19 2026 Paul Howarth <paul@city-fan.org> - 1.37-1
- Update to 1.37
Features:
- Add LoadBytes, LoadUTF8, DumpBytes, DumpUTF8 functions (GH#51)
Fixes:
- Fix heap buffer overflow in the YAML emitter - CVE-2026-4177 (GH#67)
- Fix DumpFile with tied filehandles (IO::String, IO::Scalar) (GH#22)
- Fix _is_glob to recognize IO::Handle subclasses (GH#23)
- Fix memory leak when dumping filehandles (CPAN RT#41199, GH#42)
- Fix dumping of tied hashes (GH#31)
- Fix dumping strings starting with '...' as unquoted plain scalars (GH#34)
- Fix dumping strings with tabs and carriage returns as plain scalars (GH#59)
- Fix double-dash YAML parsing (RT#34073, GH#35)
- Fix extra newline after empty arrays/hashes in YAML output (GH#36)
- Remove trailing whitespace from YAML output lines (GH#37, GH#38, GH#39)
- Fix quoting of \r and \t in YAML output instead of emitting raw bytes
(GH#40)
- Fix growing !!perl/regexp objects in round-trips (GH#43)
- Fix quoted '=' being transformed into 'str' (GH#45)
- Fix backslash-space escape in double-quoted YAML strings (GH#61)
- Fix flow sequence comma separator not recognized without trailing space
(GH#60)
- Fix wide character warning in DumpFile (GH#28)
- Fix inline arrays without space after comma (GH#25)
- Fix: quote strings matching YAML implicit types to prevent round-trip
failures (GH#26)
- Fix JSON::Syck::Dump to use JSON-valid \uXXXX escapes in output (GH#21)
- Fix JSON::Syck::Load decoding of \/ and \uXXXX escape sequences (GH#30)
- Fix: apply JSON postprocessing to JSON::Syck::DumpFile output (GH#104)
- Fix: add tied-filehandle fallback to JSON::Syck::DumpFile (GH#98)
- Fix: handle JSON escape sequences in SingleQuote mode Load (GH#99)
- Fix: restore Perl 5.8 compatibility in test suite (GH#121)
- Fix: correct copy-paste error in Makefile.PL clean target (GH#101)
- Fix: correct $SortKeys POD default from false to true (GH#100)
- Fix: correct POD documentation errors (GH#103)
Maintenance:
- Add C23-compatible function prototypes for GCC 15 compatibility (GH#112)
- Silence macOS compiler warnings (GH#92)
- Guard stdint.h include for portability (HP-UX 11.11) (GH#33)
- Guard stdint.h include in syck_st.h for portability (GH#24)
- Update ppport.h to 3.68
- Add regression tests for magical variable dumping (GH#32)
- CI: modernize GitHub Actions workflow (GH#123, GH#124)
- CI: add disttest job to validate MANIFEST completeness
- Use %{make_build} and %{make_install}
- Drop workaround for C23 incompatibility
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.36-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Sat Oct 11 2025 Paul Howarth <paul@city-fan.org> - 1.36-1
- Update to 1.36
- Address memory corruption leading to 'str' value being set on empty keys
* Fri Oct 10 2025 Paul Howarth <paul@city-fan.org> - 1.35-1
- Update to 1.35
- Address parsing error related to string detection on read for empty strings
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.34-18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Mon Jul 07 2025 Jitka Plesnikova <jplesnik@redhat.com> - 1.34-17
- Perl 5.42 rebuild
* Sat Jan 18 2025 Paul Howarth <paul@city-fan.org> - 1.34-16
- Build using -std=gnu17 since ancient code does not compile with -std=c23
* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.34-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.34-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
/usr/lib/.build-id /usr/lib/.build-id/70 /usr/lib/.build-id/70/a7728be02d14a798ebf397f3b42b16aa5a2831 /usr/lib64/perl5/vendor_perl/JSON /usr/lib64/perl5/vendor_perl/JSON/Syck.pm /usr/lib64/perl5/vendor_perl/YAML /usr/lib64/perl5/vendor_perl/YAML/Dumper /usr/lib64/perl5/vendor_perl/YAML/Dumper/Syck.pm /usr/lib64/perl5/vendor_perl/YAML/Loader /usr/lib64/perl5/vendor_perl/YAML/Loader/Syck.pm /usr/lib64/perl5/vendor_perl/YAML/Syck.pm /usr/lib64/perl5/vendor_perl/auto/YAML /usr/lib64/perl5/vendor_perl/auto/YAML/Syck /usr/lib64/perl5/vendor_perl/auto/YAML/Syck/Syck.so /usr/share/doc/perl-YAML-Syck /usr/share/doc/perl-YAML-Syck/COMPATIBILITY /usr/share/doc/perl-YAML-Syck/Changes /usr/share/doc/perl-YAML-Syck/README.md /usr/share/licenses/perl-YAML-Syck /usr/share/licenses/perl-YAML-Syck/COPYING /usr/share/man/man3/JSON::Syck.3pm.gz /usr/share/man/man3/YAML::Syck.3pm.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Jul 17 00:07:37 2026