Changes for version 0.03 - 2026-09-04
- SECURITY: CVE-2026-85491. Remove the dispatch route memo added in 0.01. It was keyed on the request path alone, on the premise that which action a path resolves to is a pure function of that path.
- t/61-dispatch-method.t is the regression, and six method-varying requests are now in the t/20-parity.t table.
- The memos that remain resolve through get_action and get_containers, which are lookups in the action and container tables and consult no request state. Audited, and documented in Dispatch.pm.
- Costs about 2us a request on a one segment path and 4us on two.
Modules
freeze a Catalyst application at setup and make it 4x faster
XS accessors for the context hot set
constant accessors for class data that stopped changing
two things built per request that need not be
memoise the action lookups that stopped changing
plain eval in place of Try::Tiny on the request path
the encoding decision, decided once per content type
replace a subroutine and keep the original
make the application class and its components immutable
leaner bodies for the two costly default middlewares
install the composed body of a wrapped method directly
the request preparation path
Provides
in lib/Catalyst/Seal/Middleware.pm