/ 
perl-5.45.4
⭐ Starred 2013 / perldelta

NAME

perldelta - what is new for perl v5.45.4

DESCRIPTION

This document describes differences between the 5.45.3 release and the 5.45.4 release.

If you are upgrading from an earlier release such as 5.45.2, first read perl5453delta, which describes differences between 5.45.2 and 5.45.3.

Security

CVE-2026-107401 Regex engine incorrectly skipped UTF8 characters

A regular expression performing a greedy match of a UTF8 character could have incorrectly failed if the first attempt at a match was unsuccessful. Instead of skipping over all consecutive instances of that character associated with the first attempt, all consecutive characters that had the same first byte were skipped.

[GH #24916]

Performance Enhancements

  • Changes have been made to the "super-linear cache", which is used to avoid excessive backtracking in some regexes which include quantifiers on variable-length sub-patterns, such as (a|bc)* and (ab+){2,}. This change may reduce the amount of backtracking that takes place, and may reduce the amount of temporary memory used for the cache.

  • substr() now updates the UTF-8 position cache correctly, avoiding repeated scans when accessing the same part of a string. [GH #24531]

Modules and Pragmata

Updated Modules and Pragmata

Diagnostics

The following additions or changes have been made to diagnostic output, including warnings and fatal error messages. For the complete list of diagnostic messages, see perldiag.

New Diagnostics

New Warnings

Two warnings in malloc.c which were not previously documented have been added to perldiag.

Unaligned "next" pointer in the free chain 0x% at 0x%
Unaligned pointer in the free chain 0x%

Platform Support

Platform-Specific Notes

VMS

The Perl_seed function will now use the native entropy source sys$get_entropy when available (OpenVMS 9.2 and later).

Internal Changes

  • Locale thread-safety is now enabled by default for the next few v5.45 development releases.

    This feature, introduced with default-off in v5.45.3, is never turned on for builds that don't have threads, and on platforms where perl believes that the locale handling is natively thread-safe.

    Otherwise, the feature is on by default during a portion of the remaining 5.45 development cycle, so as to test it in the field, but the intention is to make it opt-in for the official 5.46 release. To turn it off, pass this to Configure:

    -Accflags=-DNO_EMULATE_THREAD_SAFE_LOCALES

    See "Multi-threaded operation" in perllocale.

  • The inline function Perl_newSV_type now only handles the SV types most commonly seen at runtime. Perl_newSV_type_generic has been added as a non-inline function that can handle all SV types. This change reduces binary bloating and increases the chances of Perl_newSV_type being successfully inlined.

  • When a shifted array is unshifted, Perl_av_extend_guts used to perform a (key *maxp - 10)> check and always reallocate. That check dates from Perl 3.0 and the rationale for it seems to have been lost to time. (It may have been to encourage array growth, but the general levers for doing so have changed significantly over time.)

    Always reallocating when it is not strictly necessary could cause Perl applications that repeatedly perform a mixture of shift/push operations (or similar) to suffer from unnecessary allocator thrashing. Perl_av_extend_guts will now only reallocate if the array really is out of space and must be extended.

Selected Bug Fixes

  • The regular expression optimizer no longer rejects valid matches when a positive lookahead can match an empty string. For example, /\A(?=a*)[0-9]a\z/ now matches "0a".

    [GH #24943]

  • General regular expression repeats clear captures in their bodies when matching zero repetitions, as optimized repeats do. Adding a no-op (?{}) code block no longer changes whether a backreference to a skipped optional group matches.

    [GH #8267] [GH #18865]

  • Negative lookahead and lookbehind assertions restore capture buffers after evaluating their bodies. Captures from failed assertion attempts no longer appear in a successful match or affect later backreferences and conditions.

    [GH #14387] [GH #24946]

  • The regular expression optimizer no longer uses the fixed-width repeat optimization for a body containing captures inside nested quantifiers. This prevents failed or backtracked iterations from leaving incorrect capture values. For example, "aa" =~ /(?:(aa){2})*/ now leaves $1 undefined.

    [GH #24945]

  • Line number information is stored rather than discarded when an anonymous subroutine is encountered during compilation. This should improve the accuracy of line numbers emitted by diagnostic messages and `caller()` for code following an anonymous subroutine declaration.

    Note that (i) this change could break any tests that hardcode the less-accurate line numbers (ii) further improvements to line number accuracy may follow within this development cycle.

    [GH #24396]

  • Regular expression compilation could have mistaken the width of a quantified subpattern (e.g. b{2}) when a potentially infinite qualifier (e.g. +) occurred earlier in the pattern. This could lead to viable match candidates at the start of the target string being missed.

    [GH #24915]

  • Following an unsuccessful earlier non-greedy match, a regular expression intended to perform a separate greedy match could have instead performed a non-greedy match because of skipped flag clearance.

    [GH #24926]

  • An anchored regular expressions starting with a repeating character could have incorrectly skipped later instances of that character if the match contained a (*SKIP) and was initially unsuccessful.

  • A anchored regular expression needing zero (or more) characters for a successful match could have failed because the search space was incorrectly truncated.

    [GH #24944]

  • A regular expression performing a case insensitive match with Unicode rules could fail to match correctly when the ability of folding characters to both decrease minlen and increase maxlen at the same time was not taken into account.

  • The offset of a \K is no longer narrowed on rollback at an offset >2GiB.

  • In some cases warnings that occurred while using unpack on an invalid UTF-8 marked string would result in an invalid free. [GH #24913]

  • Builds with PERL_NO_COW could crash when modifying or freeing boolean values. This has been fixed. [GH #19987]

  • goto within a defer block should now work more consistently. [GH #19240]

Acknowledgements

Perl 5.45.4 represents approximately 4 weeks of development since Perl 5.45.3 and contains approximately 12,000 lines of changes across 210 files from 27 authors.

Excluding auto-generated files, documentation and release tools, there were approximately 5,600 lines of changes to 120 .pm, .t, .c and .h files.

Perl continues to flourish into its fourth decade thanks to a vibrant community of users and developers. The following people are known to have contributed the improvements that became Perl 5.45.4:

Alin Iacob, Andreas König, Andrew Hewus Fresh, Brad Smith, Branislav Zahradník, Chris 'BinGOs' Williams, Craig A. Berry, Cyncrovee, Dan Book, Darafei Praliaskouski, David Mitchell, Eric Herman, Frank, GlobalTechStrategics, James E Keenan, Karl Williamson, Leon Timmermans, Lukas Mai, Paul Evans, Paul Marquess, Philippe Bruhat (BooK), Richard Leach, Sevan Janiyan, TAKAI Kousuke, Tigranuhy Grigoryan, Tony Cook, Yves Orton.

The list above is almost certainly incomplete as it is automatically generated from version control history. In particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker.

Many of the changes included in this version originated in the CPAN modules included in Perl's core. We're grateful to the entire CPAN community for helping Perl to flourish.

For a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.

Reporting Bugs

If you find what you think is a bug, you might check the perl bug database at https://github.com/Perl/perl5/issues. There may also be information at https://www.perl.org/, the Perl Home Page.

If you believe you have an unreported bug, please open an issue at https://github.com/Perl/perl5/issues. Be sure to trim your bug down to a tiny but sufficient test case.

If the bug you are reporting has security implications which make it inappropriate to send to a public issue tracker, then see "SECURITY VULNERABILITY CONTACT INFORMATION" in perlsec for details of how to report the issue.

Give Thanks

If you wish to thank the Perl 5 Porters for the work we had done in Perl 5, you can do so by running the perlthanks program:

perlthanks

This will send an email to the Perl 5 Porters list with your show of thanks.

SEE ALSO

The Changes file for an explanation of how to view exhaustive details on what changed.

The INSTALL file for how to build Perl.

The README file for general stuff.

The Artistic and Copying files for copyright information.