perl5260delta - what is new for perl v5.26.0
This document describes the differences between the 5.24.0 release and the 5.26.0 release.
This release includes three updates with widespread effects:
"." no longer in @INC
For security reasons, the current directory (".") is no longer included by default at the end of the module search path (@INC). This may have widespread implications for the building, testing and installing of modules, and for the execution of scripts. See the section "Removal of the current directory (".") from @INC" for the full details.
do may now warn
do now gives a deprecation warning when it fails to load a file which it would have loaded had "." been in @INC.
"{" should be escaped
See "Unescaped literal "{" characters in regular expression patterns are no longer permissible".
Using the lexical_subs feature introduced in v5.18 no longer emits a warning. Existing code that disables the experimental::lexical_subs warning category that the feature previously used will continue to work. The lexical_subs feature has no effect; all Perl code can use lexical subroutines, regardless of what feature declarations are in scope.
This adds a new modifier "~" to here-docs that tells the parser that it should look for /^\s*$DELIM\n/ as the closing delimiter.
These syntaxes are all supported:
<<~EOF; <<~\EOF; <<~'EOF'; <<~"EOF"; <<~`EOF`; <<~ 'EOF'; <<~ "EOF"; <<~ `EOF`;
The "~" modifier will strip, from each line in the here-doc, the same whitespace that appears before the delimiter.
Newlines will be copied as-is, and lines that don't include the proper beginning whitespace will cause perl to croak.
For example:
if (1) {
print <<~EOF;
Hello there
EOF
}
prints "Hello there\n" with no leading whitespace.
/xx
Specifying two "x" characters to modify a regular expression pattern does everything that a single one does, but additionally TAB and SPACE characters within a bracketed character class are generally ignored and can be added to improve readability, like /[ ^ A-Z d-f p-x ]/xx
@{^CAPTURE}, %{^CAPTURE}, and %{^CAPTURE_ALL}
@{^CAPTURE} exposes the capture buffers of the last match as an array. So $1 is ${^CAPTURE}[0]. This is a more efficient equivalent to code like substr($matched_string,$-[0],$+[0]-$-[0]), and you don't have to keep track of the $matched_string either. This variable has no single character equivalent. Note that, like the other regex magic variables, the contents of this variable is dynamic; if you wish to store it beyond the lifetime of the match you must copy it to another array.
%{^CAPTURE} is equivalent to %+ (i.e., named captures). Other than being more self-documenting there is no difference between the two forms.
%{^CAPTURE_ALL} is equivalent to %- (i.e., all named captures). Other than being more self-documenting there is no difference between the two forms.
As an experimental feature, Perl now allows the referencing operator to come after my(), state(), our(), or local(). This syntax must be enabled with use feature 'declared_refs'. It is experimental, and will warn by default unless no warnings 'experimental::refaliasing' is in effect. It is intended mainly for use in assignments to references. For example:
use experimental 'refaliasing', 'declared_refs'; my \$a = \$b;
See "Assigning to References" in perlref for more details.
A list of changes is at http://www.unicode.org/versions/Unicode9.0.0/. Modules that are shipped with core Perl but not maintained by p5p do not necessarily support Unicode 9.0. Unicode::Normalize does work on 9.0.
\p{script} uses the improved Script_Extensions property
Unicode 6.0 introduced an improved form of the Script (sc) property, and called it Script_Extensions (scx). Perl now uses this improved version when a property is specified as just \p{script}. This should make programs more accurate when determining if a character is used in a given script, but there is a slight chance of breakage for programs that very specifically needed the old behavior. The meaning of compound forms, like \p{sc=script} are unchanged. See "Scripts" in perlunicode.
Some platforms natively do a reasonable job of collating and sorting in UTF-8 locales. Perl now works with those. For portability and full control, Unicode::Collate is still recommended, but now you may not need to do anything special to get good-enough results, depending on your application. See "Category LC_COLLATE: Collation: Text Comparisons and Sorting" in perllocale.
NUL characters
In locales that have multi-level character weights, NULs are now ignored at the higher priority ones. There are still some gotchas in some strings, though. See "Collation of strings containing embedded NUL characters" in perllocale.
CORE subroutines for hash and array functions callable via reference
The hash and array functions in the CORE namespace (keys, each, values, push, pop, shift, unshift and splice) can now be called with ampersand syntax (&CORE::keys(\%hash) and via reference (my $k = \&CORE::keys; $k->(\%hash)). Previously they could only be used when inlined.
We have switched to a hybrid hash function to better balance performance for short and long keys.
For short keys, 16 bytes and under, we use an optimised variant of One At A Time Hard, and for longer keys we use Siphash 1-3. For very long keys this is a big improvement in performance. For shorter keys there is a modest improvement.
".") from @INC
The perl binary includes a default set of paths in @INC. Historically it has also included the current directory (".") as the final entry, unless run with taint mode enabled (perl -T). While convenient, this has security implications: for example, where a script attempts to load an optional module when its current directory is untrusted (such as /tmp), it could load and execute code from under that directory.
Starting with v5.26, "." is always removed by default, not just under tainting. This has major implications for installing modules and executing scripts.
The following new features have been added to help ameliorate these issues.
There is a new Configure option, default_inc_excludes_dot (enabled by default) which builds a perl executable without "."; unsetting this option using -U reverts perl to the old behaviour. This may fix your path issues but will reintroduce all the security concerns, so don't build a perl executable like this unless you're really confident that such issues are not a concern in your environment.
PERL_USE_UNSAFE_INC
There is a new environment variable recognised by the perl interpreter. If this variable has the value 1 when the perl interpreter starts up, then "." will be automatically appended to @INC (except under tainting).
This allows you restore the old perl interpreter behaviour on a case-by-case basis. But note that this is intended to be a temporary crutch, and this feature will likely be removed in some future perl version. It is currently set by the cpan utility and Test::Harness to ease installation of CPAN modules which have not been updated to handle the lack of dot. Once again, don't use this unless you are sure that this will not reintroduce any security concerns.
do.
While it is well-known that use and require use @INC to search for the file to load, many people don't realise that do "file" also searches @INC if the file is a relative path. With the removal of ".", a simple do "file.pl" will fail to read in and execute file.pl from the current directory. Since this is commonly expected behaviour, a new deprecation warning is now issued whenever do fails to load a file which it otherwise would have found if a dot had been in @INC.
Here are some things script and module authors may need to do to make their software work in the new regime.
If the issue is within your own code (rather than within included modules), then you have two main options. Firstly, if you are confident that your script will only be run within a trusted directory (under which you expect to find trusted files and modules), then add "." back into the path; e.g.:
BEGIN {
my $dir = "/some/trusted/directory";
chdir $dir or die "Can't chdir to $dir: $!\n";
# safe now
push @INC, '.';
}
use "Foo::Bar"; # may load /some/trusted/directory/Foo/Bar.pm
do "config.pl"; # may load /some/trusted/directory/config.pl
On the other hand, if your script is intended to be run from within untrusted directories (such as /tmp), then your script suddenly failing to load files may be indicative of a security issue. You most likely want to replace any relative paths with full paths; for example,
do "foo_config.pl"
might become
do "$ENV{HOME}/foo_config.pl"
If you are absolutely certain that you want your script to load and execute a file from the current directory, then use a ./ prefix; for example:
do "./foo_config.pl"
If you install a CPAN module using an automatic tool like cpan, then this tool will itself set the PERL_USE_UNSAFE_INC environment variable while building and testing the module, which may be sufficient to install a distribution which hasn't been updated to be dot-aware. If you want to install such a module manually, then you'll need to replace the traditional invocation:
perl Makefile.PL && make && make test && make install
with something like
(export PERL_USE_UNSAFE_INC=1; \ perl Makefile.PL && make && make test && make install)
Note that this only helps build and install an unfixed module. It's possible for the tests to pass (since they were run under PERL_USE_UNSAFE_INC=1), but for the module itself to fail to perform correctly in production. In this case, you may have to temporarily modify your script until a fixed version of the module is released. For example:
use Foo::Bar;
{
local @INC = (@INC, '.');
# assuming read_config() needs '.' in @INC
$config = Foo::Bar->read_config();
}
This is only rarely expected to be necessary. Again, if doing this, assess the resultant risks first.
If you maintain a CPAN distribution, it may need updating to run in a dotless environment. Although cpan and other such tools will currently set the PERL_USE_UNSAFE_INC during module build, this is a temporary workaround for the set of modules which rely on "." being in @INC for installation and testing, and this may mask deeper issues. It could result in a module which passes tests and installs, but which fails at run time.
During build, test, and install, it will normally be the case that any perl processes will be executing directly within the root directory of the untarred distribution, or a known subdirectory of that, such as t/. It may well be that Makefile.PL or t/foo.t will attempt to include local modules and configuration files using their direct relative filenames, which will now fail.
However, as described above, automatic tools like cpan will (for now) set the PERL_USE_UNSAFE_INC environment variable, which introduces dot during a build.
This makes it likely that your existing build and test code will work, but this may mask issues with your code which only manifest when used after install. It is prudent to try and run your build process with that variable explicitly disabled:
(export PERL_USE_UNSAFE_INC=0; \ perl Makefile.PL && make && make test && make install)
This is more likely to show up any potential problems with your module's build process, or even with the module itself. Fixing such issues will ensure both that your module can again be installed manually, and that it will still build once the PERL_USE_UNSAFE_INC crutch goes away.
When fixing issues in tests due to the removal of dot from @INC, reinsertion of dot into @INC should be performed with caution, for this too may suppress real errors in your runtime code. You are encouraged wherever possible to apply the aforementioned approaches with explicit absolute/relative paths, or to relocate your needed files into a subdirectory and insert that subdirectory into @INC instead.
If your runtime code has problems under the dotless @INC, then the comments above on how to fix for script authors will mostly apply here too. Bear in mind though that it is considered bad form for a module to globally add a dot to @INC, since it introduces both a security risk and hides issues of accidentally requiring dot in @INC, as explained above.
On Unix systems, Perl treats any relative paths in the PATH environment variable as tainted when starting a new process. Previously, it was allowing a backslash to escape a colon (unlike the OS), consequently allowing relative paths to be considered safe if the PATH was set to something like /\:.. The check has been fixed to treat "." as tainted in that example.
-Di switch is now required for PerlIO debugging output
This is used for debugging of code within PerlIO to avoid recursive calls. Previously this output would be sent to the file specified by the PERLIO_DEBUG environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet.
If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by PERLIO_DEBUG even when the -T switch had been supplied.
Perl now requires the -Di switch to be present before it will produce PerlIO debugging output. By default this is written to stderr, but can optionally be redirected to a file by setting the PERLIO_DEBUG environment variable.
If perl is running setuid or the -T switch was supplied, PERLIO_DEBUG is ignored and the debugging output is sent to stderr as for any other -D switch.
"{" characters in regular expression patterns are no longer permissible
You have to now say something like "\{" or "[{]" to specify to match a LEFT CURLY BRACKET; otherwise, it is a fatal pattern compilation error. This change will allow future extensions to the language.
These have been deprecated since v5.16, with a deprecation message raised for some uses starting in v5.22. Unfortunately, the code added to raise the message was buggy and failed to warn in some cases where it should have. Therefore, enforcement of this ban for these cases is deferred until Perl 5.30, but the code has been fixed to raise a default-on deprecation message for them in the meantime.
Some uses of literal "{" occur in contexts where we do not foresee the meaning ever being anything but the literal, such as the very first character in the pattern, or after a "|" meaning alternation. Thus
qr/{fee|{fie/
matches either of the strings {fee or {fie. To avoid forcing unnecessary code changes, these uses do not need to be escaped, and no warning is raised about them, and there are no current plans to change this.
But it is always correct to escape "{", and the simple rule to remember is to always do so.
See Unescaped left brace in regex is illegal here.
scalar(%hash) return signature changed
The value returned for scalar(%hash) will no longer show information about the buckets allocated in the hash. It will simply return the count of used keys. It is thus equivalent to 0+keys(%hash).
A form of backward compatibility is provided via Hash::Util::bucket_ratio() which provides the same behavior as scalar(%hash) provided in Perl 5.24 and earlier.
keys returned from an lvalue subroutine
keys returned from an lvalue subroutine can no longer be assigned to in list context.
sub foo : lvalue { keys(%INC) }
(foo) = 3; # death
sub bar : lvalue { keys(@_) }
(bar) = 3; # also an error
This makes the lvalue sub case consistent with (keys %hash) = ... and (keys @_) = ..., which are also errors. [GH #15339]
${^ENCODING} facility has been removed
The special behaviour associated with assigning a value to this variable has been removed. As a consequence, the encoding pragma's default mode is no longer supported. If you still need to write your source code in encodings other than UTF-8, use a source filter such as Filter::Encoding on CPAN or encoding's Filter option.
POSIX::tmpnam() has been removed
The fundamentally unsafe tmpnam() interface was deprecated in Perl 5.22 and has now been removed. In its place, you can use, for example, the File::Temp interfaces.
Formerly, require ::Foo::Bar would try to read /Foo/Bar.pm. Now any bareword require which starts with a double colon dies instead.
A variable name may no longer contain a literal control character under any circumstances. These previously were allowed in single-character names on ASCII platforms, but have been deprecated there since Perl 5.20. This affects things like $\cT, where \cT is a literal control (such as a NAK or NEGATIVE ACKNOWLEDGE character) in the source code.
NBSP is no longer permissible in \N{...}The name of a character may no longer contain non-breaking spaces. It has been deprecated to do so since Perl 5.22.
For Perl to eventually allow string delimiters to be Unicode grapheme clusters (which look like a single character, but may be a sequence of several ones), we have to stop allowing a single character delimiter that isn't a grapheme by itself. These are unlikely to exist in actual code, as they would typically display as attached to the character in front of them.
\cX that maps to a printable is no longer deprecated
This means we have no plans to remove this feature. It still raises a warning, but only if syntax warnings are enabled. The feature was originally intended to be a way to express non-printable characters that don't have a mnemonic (\t and \n are mnemonics for two non-printable characters, but most non-printables don't have a mnemonic.) But the feature can be used to specify a few printable characters, though those are more clearly expressed as the printable itself. See http://www.nntp.perl.org/group/perl.perl5.porters/2017/02/msg242944.html.
if (!%h) { ... }
This was already special-cased, but some cases were missed (such as grep %$_, @AoH), and even the ones which weren't have been improved.
We use a different hash function for short and long keys. This should improve performance and security, especially for long keys.
Reading from a file line-by-line with readline() or <> should now typically be faster due to a better implementation of the code that searches for the next newline character.
$ref1 = $ref2 has been optimized in some cases.(..., @a) = (...);, it's likely to be considerably faster, especially if it involves emptying the array/hash. For example, this code runs about a third faster compared to Perl 5.24.0:
my @a;
for my $i (1..10_000_000) {
@a = (1,2,3);
@a = ();
}
split builtin is now slightly faster in many cases: in particular for the two specially-handled formsmy @a = split ...; local @a = split ...;
my ($a, $b, @c) = @_.use strict "subs" would still apply to bareword constants. That has now been accomplished a different way, so barewords, like other constants, now gain the performance benefits of constant folding.This also means that void-context warnings on constant expressions of barewords now report the folded constant operand, rather than the operation; this matches the behaviour for non-bareword constants.
The deprecation message for the :unique and :locked attributes now mention that they will disappear in Perl 5.28.
Its output is now more descriptive for op_private flags.
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
The XS implementation now supports Deparse.
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
This module's default mode is no longer supported. It now dies when imported, unless the Filter option is being used.
This module is no longer supported. It emits a warning to that effect and then does nothing.
It now documents that using %! automatically loads Errno for you.
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
It now Issues a deprecation message for File::Glob::glob().
It no longer treats no MyFilter immediately following use MyFilter as end-of-file. [GH #11853]
Internal 599-series errors now include the redirect history.
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
IPv6 addresses and AF_INET6 sockets are now supported, along with several other enhancements.
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
Its compilation speed has been improved slightly.
It now ignores /dev/tty on non-Unix systems. [GH #12244]
This remedies several defects in making its symbols exportable. [GH #15260]
The POSIX::tmpnam() interface has been removed, see "POSIX::tmpnam() has been removed".
The following deprecated functions have been removed:
POSIX::isalnum POSIX::isalpha POSIX::iscntrl POSIX::isdigit POSIX::isgraph POSIX::islower POSIX::isprint POSIX::ispunct POSIX::isspace POSIX::isupper POSIX::isxdigit POSIX::tolower POSIX::toupper
Trying to import POSIX subs that have no real implementations (like POSIX::atend()) now fails at import time, instead of waiting until runtime.
This adds support for the new /xx regular expression pattern modifier, and a change to the use re 'strict're 'strict'"}" and "]" in regular expression patterns (outside bracketed character classes) that are taken literally. This brings them more in line with the ")" character which is always a metacharacter unless escaped. Being a metacharacter only sometimes, depending on an action at a distance, can lead to silently having the pattern mean something quite different than was intended, which the re 'strict'
Fixes [GH #15714].
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
Added the down_timed method.
It now builds on systems with C++11 compilers (such as G++ 6 and Clang++ 3.9).
Now uses clockid_t.
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
Fixed a security hole in which binary files could be loaded from a path outside of @INC.
It now uses 3-arg open() instead of 2-arg open(). [GH #15721]
This file documents all upcoming deprecations, and some of the deprecations which already have been removed. The purpose of this documentation is two-fold: document what will disappear, and by which version, and serve as a guide for people dealing with code which has features that no longer work after an upgrade of their perl.
We have attempted to update the documentation to reflect the changes listed in this document. If you find any we have missed, send email to perlbug@perl.org.
Additionally, all references to Usenet have been removed, and the following selected changes have been made:
defined() on aggregates that should have been deleted earlier, when the feature was removed.eval(), and evalbytes().seek(), tell() and sysseek() emphasizing that positions are in bytes and not characters. [GH #15438]sort() concerning the variables $a and $b.split() noted that certain pattern modifiers are legal, and added a caution about its use in Perls before v5.11.study(), noting that it is now a no-op.vec() doesn't work well when the string contains characters whose code points are above 255.Size_t and SSize_tcBOOL to cast an expression to boolean.TRUE and FALSE are available to express boolean values.@ISA.Moo more.\w)./x modifier and forget that this means that "#" has to be escaped.use re 'strict' can catch some of these.@ISA. It was documented in other places, but not in perlvar.'$', '@' or '%'
(A) You've accidentally run your script through bash or another shell instead of Perl. Check the #! line, or manually feed your script into Perl yourself. The #! line at the top of your file could look like:
#!/usr/bin/perl
(A) You've accidentally run your script through zsh or another shell instead of Perl. Check the #! line, or manually feed your script into Perl yourself. The #! line at the top of your file could look like:
#!/usr/bin/perl
(F) To declare references to variables, as in my \%x, you must first enable the feature:
no warnings "experimental::declared_refs"; use feature "declared_refs";
See "Declaring a reference to a variable".
Using the empty pattern (which re-executes the last successfully-matched pattern) inside a code block in another regex, as in /(?{ s!!new! })/, has always previously yielded a segfault. It now produces this error.
'#' not allowed immediately following a sigil in a subroutine signature Unescaped left braces are now illegal in some contexts in regular expression patterns. In other contexts, they are still just deprecated; they will be illegal in Perl 5.30.
(F) The parser found a line starting with <<<<<<<, >>>>>>>, or =======. These may be left by a version control system to mark conflicts after a failed merge operation.
BASEOP
(S experimental::declared_refs) This warning is emitted if you use a reference constructor on the right-hand side of my(), state(), our(), or local(). Simply suppress the warning if you want to use the feature, but know that in doing so you are taking the risk of using an experimental feature which may change or be removed in a future Perl version:
no warnings "experimental::declared_refs"; use feature "declared_refs"; $fooref = my \$foo;
See "Declaring a reference to a variable".
Since "." is now removed from @INC by default, do will now trigger a warning recommending to fix the do statement.
File::Glob::glob() will disappear in perl 5.30. Use File::Glob::bsd_glob() instead. See "Deprecations"
require fails, we now do not provide @INC when the require is for a file instead of a module.@INC is not scanned for a require call, we no longer display @INC to avoid confusion.This existing warning has had the and will disappear text added in this release.
This existing warning has had the and will disappear text added in this release.
This warning has been removed, as the deprecated functions have been removed from POSIX.
This existing warning has had the this will not be allowed text added in this release.
my() in false conditional. This will be a fatal error in Perl 5.30 This existing warning has had the this will be a fatal error text added in this release.
dump() better written as CORE::dump(). dump() will no longer be available in Perl 5.30 This existing warning has had the no longer be available text added in this release.
This message is now followed by more helpful text. [GH #15291]
This warning was been removed, as lexical subs are no longer experimental.
This deprecation warning has been removed, since /xx now has a new meaning.
:utf8 handles. This will be a fatal error in Perl 5.30 .
where "%s" is one of sysread, recv, syswrite, or send.
This existing warning has had the this will be a fatal error text added in this release.
This warning is now enabled by default, as all deprecated category warnings should be.
$* is no longer supported. Its use will be fatal in Perl 5.30 This existing warning has had the its use will be fatal text added in this release.
$# is no longer supported. Its use will be fatal in Perl 5.30 This existing warning has had the its use will be fatal text added in this release.
Details as to the exact problem have been added at the end of this message
This warning used to warn about require, even if it was actually do which being executed. It now gets the operation name right.
This warning has been removed as the behavior is now an error.
This warning now includes the name of the offending subroutine.
This existing warning has had the this will be a fatal error text added in this release.
This existing warning has had the this will be a fatal error text added in this release.
panic: pp_split, pm=%p, s=%p
These panic errors have been removed.
This warning has been changed to the fatal Malformed UTF-8 string in "%s"
$/ to a reference to %s as a form of slurp is deprecated, treating as undef. This will be fatal in Perl 5.28 This existing warning has had the this will be fatal text added in this release.
${^ENCODING} is no longer supported. Its use will be fatal in Perl 5.28
This warning used to be: "Setting ${^ENCODING} is deprecated".
The special action of the variable ${^ENCODING} was formerly used to implement the encoding pragma. As of Perl 5.26, rather than being deprecated, assigning to this variable now has no effect except to issue the warning.
This warning now includes the name of the offending subroutine.
This warning now includes the name of the offending subroutine.
<-- HERE in m/%s/ This existing warning has had the here (and will be fatal...) text added in this release.
This existing warning has had the its use will be fatal text added in this release.
This existing warning has had the its use will be fatal text added in this release.
This existing warning has had the this will be fatal text added in this release.
This existing warning has had the its use will be fatal text added in this release.
AUTOLOAD for non-method %s() is deprecated. This will be fatal in Perl 5.28 This existing warning has had the this will be fatal text added in this release.
This existing warning has had the this will be a fatal error text added in this release.
\w.-Ddefault_inc_excludes_dot has added, and enabled by default.dtrace build process has further changes [GH #15718]:-xnolibs is available, use that so a dtrace perl can be built within a FreeBSD jail.dtrace -G also modifies these objects.dtrace -G fails to build it. A default build on Solaris generates probes from the unused inline functions, while they don't on FreeBSD, which causes dtrace -G to fail.PERL_HASH_SEED and PERL_PERTURB_KEYS environment variables by configuring perl with -Accflags=NO_PERL_HASH_ENV.PERL_HASH_SEED_DEBUG environment variable by configuring perl with -Accflags=-DNO_PERL_HASH_SEED_DEBUG.NaN and Inf to make builds more reproducible. [GH #15725]PERL_HASH_FUNC_SDBM PERL_HASH_FUNC_DJB2 PERL_HASH_FUNC_SUPERFAST PERL_HASH_FUNC_MURMUR3 PERL_HASH_FUNC_ONE_AT_A_TIME PERL_HASH_FUNC_ONE_AT_A_TIME_OLD PERL_HASH_FUNC_MURMUR_HASH_64A PERL_HASH_FUNC_MURMUR_HASH_64B
This install warning is more or less obsolete, since most platforms already will have a /usr/bin/perl or similar provided by the OS.
make install.manPreviously, two progress messages were emitted for each manpage: one by installman itself, and one by the function in install_lib.pl that it calls to actually install the file. Disabling the second of those in each case saves over 750 lines of unhelpful output.
clang -Weverything support. [GH #15683]USE_PAD_RESET now work again; this configuration had bit-rotted.gai_strerror was added to Configure that checks if the gai_strerror() routine is available and can be used to translate error codes returned by getaddrinfo() into human readable strings.-Duselongdouble and -Dusequadmath are requested. [GH #14944]-quadmath to the archname even if it was already present. [GH #15423]-DPERL_GLOBAL_STRUCT or -DPERL_GLOBAL_STRUCT_PRIVATE have been fixed (by disabling Thread Safety Analysis for these configurations).perl -V has been reformatted so that each configuration and compile-time option is now listed one per line, to improve readability.miniperl and generate_uudmap if you invoke it with -Dusecrosscompiler but not -Dtargethost=somehost. This means you can supply your target platform config.sh, generate the headers and proceed to build your cross-target perl. [GH #15126]-Accflags=-DPERL_TRACE_OPS now only dumps the operator counts when the environment variable PERL_TRACE_OPS is set to a non-zero integer. This allows make test to pass on such a build.-flto option to gcc), Configure was treating all probed symbols as present on the system, regardless of whether they actually exist. This has been fixed. [GH #15322]Tests were added and changed to reflect the other additions and changes in this release. Furthermore, these substantive changes were made:
runperl() and the like are available for use.\t characters should not be expanded into spaces.$ENV{PERLDB_OPTS}. [GH #15782]
Perl now compiles under NetBSD on VAX machines. However, it's not possible for that platform to implement floating-point infinities and NaNs compatible with most modern systems, which implement the IEEE-754 floating point standard. The hexadecimal floating point (0x...p[+-]n literals, printf %a) is not implemented, either. The make test passes 98% of tests.
inf, nan, and -0.0 support.-Dprefix=/usr as special: instead require an extra option -Ddarwin_distribution to produce the same results.clock_gettime() or clock_getres() APIs; emulate them as necessary.syscall(2) on macOS 10.12.Several tests have been updated to work (or be skipped) on EBCDIC platforms.
The Net::Ping UDP test is now skipped on HP-UX.
The hints for Hurd have been improved, enabling malloc wrap and reporting the GNU libc used (previously it was an empty string when reported).
VAX floating point formats are now supported on NetBSD.
PERL5LIB and PERLLIB environment entries is now a colon (":") when running under a Unix shell. There is no change when running under DCL (it's still "|").
This version of VC++ includes a completely rewritten C run-time library, some of the changes in which mean that work done to resolve a socket close() bug in perl #120091 and perl #118059 is not workable in its current state with this version of VC++. Therefore, we have effectively reverted that bug fix for VS2015 onwards on the basis that being able to build with VS2015 onwards is more important than keeping the bug fix. We may revisit this in the future to attempt to fix the bug again in a way that is compatible with VS2015.
These changes do not affect compilation with GCC or with Visual Studio versions up to and including VS2013, i.e., the bug fix is retained (unchanged) for those compilers.
Note that you may experience compatibility problems if you mix a perl built with GCC or VS <= VS2013 with XS modules built with VS2015, or if you mix a perl built with VS2015 with XS modules built with GCC or VS <= VS2013. Some incompatibility may arise because of the bug fix that has been reverted for VS2015 builds of perl, but there may well be incompatibility anyway because of the rewritten CRT in VS2015 (e.g., see discussion at http://stackoverflow.com/questions/30412951).
Drop support for Linux a.out executable format. Linux has used ELF for over twenty years.
OpenBSD 6 still does not support returning pid, gid, or uid with SA_SIGINFO. Make sure to account for it.
t/uni/overload.t: Skip hanging test on FreeBSD.
DragonFly BSD now has support for setproctitle(). [GH #15703].
sv_setpv_bufsize() allows simultaneously setting the length and the allocated size of the buffer in an SV, growing the buffer if necessary.SvPVCLEAR() sets its SV argument to an empty string, like Perl-space $x = '', but with several optimisations.isALPHA_utf8 and toLOWER_utf8 have been added, each with the suffix _safe, like isSPACE_utf8_safe. These take an extra parameter, giving an upper limit of how far into the string it is safe to read. Using the old versions could cause attempts to read beyond the end of the input buffer if the UTF-8 is not well-formed, and their use now raises a deprecation warning. Details are at "Character classification" in perlapi.isALPHA_utf8 and toLOWER_utf8 now die if they detect that their input UTF-8 is malformed. A deprecation warning had been issued since Perl 5.18.
UTF8_GOT_ABOVE_31_BIT UTF8_GOT_CONTINUATION UTF8_GOT_EMPTY UTF8_GOT_LONG UTF8_GOT_NONCHAR UTF8_GOT_NON_CONTINUATION UTF8_GOT_OVERFLOW UTF8_GOT_SHORT UTF8_GOT_SUPER UTF8_GOT_SURROGATE UTF8_IS_INVARIANT UTF8_IS_NONCHAR UTF8_IS_SUPER UTF8_IS_SURROGATE UVCHR_IS_INVARIANT isUTF8_CHAR_flags isSTRICT_UTF8_CHAR isC9_STRICT_UTF8_CHAR
is_utf8_string_*() functions, that apply various restrictions to the UTF-8 recognized as valid:
is_strict_utf8_string, is_strict_utf8_string_loc, is_strict_utf8_string_loclen,
is_c9strict_utf8_string, is_c9strict_utf8_string_loc, is_c9strict_utf8_string_loclen,
is_utf8_string_flags, is_utf8_string_loc_flags, is_utf8_string_loclen_flags,
is_utf8_fixed_width_buf_flags, is_utf8_fixed_width_buf_loc_flags, is_utf8_fixed_width_buf_loclen_flags.
is_utf8_invariant_string. is_utf8_valid_partial_char. is_utf8_valid_partial_char_flags.
utf8n_to_uvchr and its derivatives have had several changes of behaviour.Calling them, while passing a string length of 0 is now asserted against in DEBUGGING builds, and otherwise, returns the Unicode REPLACEMENT CHARACTER. If you have nothing to decode, you shouldn't call the decode function.
They now return the Unicode REPLACEMENT CHARACTER if called with UTF-8 that has the overlong malformation and that malformation is allowed by the input parameters. This malformation is where the UTF-8 looks valid syntactically, but there is a shorter sequence that yields the same code point. This has been forbidden since Unicode version 3.1.
They now accept an input flag to allow the overflow malformation. This malformation is when the UTF-8 may be syntactically valid, but the code point it represents is not capable of being represented in the word length on the platform. What "allowed" means, in this case, is that the function doesn't return an error, and it advances the parse pointer to beyond the UTF-8 in question, but it returns the Unicode REPLACEMENT CHARACTER as the value of the code point (since the real value is not representable).
They no longer abandon searching for other malformations when the first one is encountered. A call to one of these functions thus can generate multiple diagnostics, instead of just one.
valid_utf8_to_uvchr() has been added to the API (although it was present in core earlier). Like utf8_to_uvchr_buf(), but assumes that the next character is well-formed. Use with caution.utf8n_to_uvchr_error, has been added for use by modules that need to know the details of UTF-8 malformations beyond pass/fail. Previously, the only ways to know why a sequence was ill-formed was to capture and parse the generated diagnostics or to do your own analysis.utf8_hop_safe(). Unlike utf8_hop(), utf8_hop_safe() won't navigate before the beginning or after the end of the supplied buffer.utf8_hop_forward() and utf8_hop_back() are similar to utf8_hop_safe() but are for when you know which direction you wish to travel.PERL_OP_PARENT compiler define enabled by default. To disable it, use the PERL_NO_OP_PARENT compiler define. This flag alters how the op_sibling field is used in OP structures, and has been available optionally since perl 5.22.See "Internal Changes" in perl5220delta for more details of what this build option does.
OP_ARGELEM, OP_ARGDEFELEM, and OP_ARGCHECK have been added. These are intended principally to implement the individual elements of a subroutine signature, plus any overall checking required.OP_PUSHRE op has been eliminated and the OP_SPLIT op has been changed from class LISTOP to PMOP.
Formerly the first child of a split would be a pushre, which would have the split's regex attached to it. Now the regex is attached directly to the split op, and the pushre has been eliminated.
op_class() API function has been added. This is like the existing OP_CLASS() macro, but can more accurately determine what struct an op has been allocated as. For example OP_CLASS() might return OA_BASEOP_OR_UNOP indicating that ops of this type are usually allocated as an OP or UNOP; while op_class() will return OPclass_BASEOP or OPclass_UNOP as appropriate.sassign op is a BINOP; previously it was listed as a BASEOP in regen/opcodes, which meant that several parts of the internals had to be special-cased to accommodate it. This oddity's original motivation was to handle code like $x ||= 1; that is now handled in a simpler way.op_dump() function (as used by perl -Dx) has changed: it now displays an "ASCII-art" tree structure, and shows more low-level details about each op, such as its address and class.PADOFFSET type has changed from being unsigned to signed, and several pad-related variables such as PL_padix have changed from being of type I32 to type PADOFFSET.DEBUGGING-mode output for regex compilation and execution has been enhanced.SVpbm_VALID, SVpbm_TAIL, SvTAIL_on, SvTAIL_off, SVrepl_EVAL, SvEVALED.op_private flag has been eliminated: OPpRUNTIME. This used to often get set on PMOP ops, but had become meaningless over time.strxfrm() implementations in their libc. [GH #13768] $-{$name} would leak an AV on each access if the regular expression had no named captures. The same applies to access to any hash tied with Tie::Hash::NamedCapture and all => 1. [GH #15882]$# as the object in an indirect object method call could cause a heap use after free or buffer overflow. [GH #15599]formline would cause an assertion failure. [GH #15862] $value1 =~ qr/.../ ~~ $value2 would have the match converted into a qr// operator, leaving extra elements on the stack to confuse any surrounding expression. [GH #15859]qr// objects) could end up with the wrong current pad and crash or give weird results. [GH #15657]local()s in a code block within a patterns weren't being undone when the pattern matching backtracked over the code block. [GH #15056]substr() to modify a magic variable could access freed memory in some cases. [GH #15871]use utf8, the entire source code is now checked for being UTF-8 well formed, not just quoted strings as before. [GH #14973].".." on strings now handles its arguments correctly when in the scope of the unicode_strings feature. The previous behaviour was sufficiently unexpected that we believe no correct program could have made use of it.split operator did not ensure enough space was allocated for its return value in scalar context. It could then write a single pointer immediately beyond the end of the memory block allocated for the stack. [GH #15749]"W" pack template character with the current output position aligned at just the right point could cause a write of a single zero byte immediately beyond the end of an allocated buffer. [GH #15572]<=> operator. [GH #15768]/(?{ ... <<EOF })/ that broke Method::Signatures. [GH #15779]chop and chomp, which could be triggered by chop(@x =~ tr/1/1/). [GH #15738]./x; it could stop skipping a byte early, which could be in the middle of a UTF-8 character. [GH #15790].{}->$x when $x isn't defined. [GH #15791]."_". [GH #9989].tr/// parse code could be looking at uninitialized data after a perse error. [GH #15624].\1) to an unmatched capture could read back beyond the start of the string being matched. [GH #15634].use re 'strict' is supposed to warn if you use a range (such as /(?[ [ X-Y ] ])/) whose start and end digit aren't from the same group of 10. It didn't do that for five groups of mathematical digits starting at U+1D7E.sub c { sub c; }) could sometimes crash or loop infinitely. [GH #15557]#!perl -i u could be erroneously interpreted as requesting the -u option. This has been fixed. [GH #15623]$1, $2, etc.) erroneously containing data from regex execution paths that weren't actually executed for the final match. [GH #15666]regex_sets feature could trigger an assertion failure. This has been fixed. [GH #15620]\eval=time) could sometimes crash in addition to giving a syntax error. [GH #14815]evalbytes. [GH #15586]splice on arrays with non-existent elements could cause other operators to crash. [GH #15577]s///l where it thought it was dealing with UTF-8 when it wasn't. [GH #15543]&. operator (and the "&" operator, when it treats its arguments as strings) were failing to append a trailing null byte if at least one string was marked as utf8 internally. Many code paths (system calls, regexp compilation) still expect there to be a null byte in the string buffer just past the end of the logical string. An assertion failure was the result. [GH #15606]-DC options on DEBUGGING builds. [GH #15563]:attr(foo' that does not have an ending '")"'.gv_fetchmethod_pvn_flags, rework separator parsing to prevent possible string overrun with an invalid len argument. [GH #15598]@a = sort { ... } @a, where the source and destination of the sort are the same plain array, are optimised to do less copying around. Two side-effects of this optimisation were that the contents of @a as seen by sort routines were partially sorted; and under some circumstances accessing @a during the sort could crash the interpreter. Both these issues have been fixed, and Sort functions see the original value of @a. [GH #15387]pack("p", ...) used to emit its warning ("Attempt to pack pointer to temporary value") erroneously in some cases, but has been fixed.@DB::args is now exempt from "used once" warnings. The warnings only occurred under -w, because warnings.pm itself uses @DB::args multiple times.qq|@DB::args| and qq|@SIG{'CHLD', 'HUP'}|. (The special variables @- and @+ were already exempt from the warning.)gethostent and similar functions now perform a null check internally, to avoid crashing with the torsocks library. This was a regression from v5.22. [GH #15478]defined *{'!'}, defined *{'['}, and defined *{'-'} no longer leak memory if the typeglob in question has never been accessed before.printf "%a" of hexadecimal floating point were fixed. In addition, the "subnormals" (formerly known as "denormals") floating point numbers are now supported both with the plain IEEE 754 floating point numbers (64-bit or 128-bit) and the x86 80-bit "extended precision". Note that subnormal hexadecimal floating point literals will give a warning about "exponent underflow". [GH #15495] [GH #15503] [GH #15504] [GH #15505] [GH #15510] [GH #15512]tr/\N{U+...}/foo/ when the code point was between 128 and 255 has been fixed. [GH #15475]."?" in m?...?), resulting in inconsistent behaviour. Note that this is non-portable, and is based on Perl's extension to UTF-8, and is probably not displayable nor enterable by any editor. [GH #15477]@{x followed by a newline where "x" represents a control or non-ASCII character no longer produces a garbled syntax error message or a crash. [GH #15518]%: = 0 has been fixed. [GH #15358]"$foo::$bar" was accidentally changed, such that it would be treated as $foo."::".$bar. The previous behavior, which was to parse it as $foo:: . $bar, has been restored. [GH #15408]delete $My::{"Foo::"}; \&My::Foo::foo) no longer crashes. It had begun crashing in Perl 5.18. [GH #15420]$ISA[0][0]. This has now been fixed. [GH #15364]sub P::f{} undef *P::; *P::f =sub{}; has been fixed. In these cases, where the STASH is missing, the warning will now appear as "Subroutine NAME redefined". [GH #15368]format STDOUT = @ 0"$x"
/(?<=/ and /(?<!/. This has now been fixed. [GH #15332] until ($x = 1) { ... } and ... until $x = 1 now properly warn when syntax warnings are enabled. [GH #15138]$! on failure. [GH #15383]bitwise feature would crash if the left-hand side was an array or hash. [GH #15346]require followed by a single colon (as in foo() ? require : ... is now parsed correctly as require with implicit $_, rather than require "". [GH #15380]keys %hash can now be assigned to consistently in all scalar lvalue contexts. Previously it worked for some contexts but not others.vec or substr with an array or hash for its first argument used to result in crashes or "Can't coerce" error messages at run time, unlike scalar assignment, which would give an error at compile time. List assignment now gives a compile-time error, too. [GH #15370]&& or || operator (or their synonyms and and or) were being compiled incorrectly in some cases. If the left-hand side consisted of either a negated bareword constant or a negated do {} block containing a constant expression, and the right-hand side consisted of a negated non-foldable expression, one of the negations was effectively ignored. The same was true of if and unless statement modifiers, though with the left-hand and right-hand sides swapped. This long-standing bug has now been fixed. [GH #15285]reset with an argument no longer crashes when encountering stash entries other than globs. [GH #15314]*:::::: no longer causes crashes. [GH #15307]
for ($x > $y) {
($_, ...) = (...); # here $_ is aliased to a truth value
}
This was a regression from v5.24. [GH #15690]
\N{ in a regex. An unclosed \N{ could give the wrong error message: "\N{NAME} must be resolved by the lexer".(($a,$b,@c,$d) = (1)) in list context returned ($a); now it returns ($a,$b,$d). (($a,$b,$c) = (1)) is unchanged: it still returns ($a,$b,$c). This can be seen in the following:
sub inc { $_++ for @_ }
inc(($a,$b,@c,$d) = (10))
Formerly, the values of ($a,$b,$d) would be left as (11,undef,undef); now they are (11,1,1).
/(?{ s!!! })/ could trigger infinite recursion on the C stack (not the normal perl stack) when the last successful pattern in scope is itself. We avoid the segfault by simply forbidding the use of the empty pattern when it would resolve to the currently executing pattern. [GH #15669]do "a\0b" fail silently (and return undef and set $!) instead of throwing an error. [GH #15676]chdir with no argument didn't ensure that there was stack space available for returning its result. [GH #15569]do now refer to do; some formerly claimed to be from require instead.undef $x where $x is tied or magical no longer incorrectly blames the variable for an uninitialized-value warning encountered by the tied/magical code.$x = $x . "a" was incorrectly failing to yield a use of uninitialized value warning when $x was a lexical variable with an undefined value. That has now been fixed. [GH #15269]undef *_; shift or undef *_; pop inside a subroutine, with no argument to shift or pop, began crashing in Perl 5.14, but has now been fixed."string$scalar->$*" now correctly prefers concatenation overloading to string overloading if $scalar->$* returns an overloaded object, bringing it into consistency with $$scalar./@0{0*->@*/*0 and similar contortions used to crash, but no longer do, but merely produce a syntax error. [GH #15333]do or require with an argument which is a reference or typeglob which, when stringified, contains a null character, started crashing in Perl 5.20, but has now been fixed. [GH #15337]tie() package/method. This brings the error messages in line with the ones used for normal method calls.0x1.fffffffffffffp-1022, they become zeros. [GH #15990]Jon Portnoy (AVENJ), a prolific Perl author and admired Gentoo community member, has passed away on August 10, 2016. He will be remembered and missed by all those who he came in contact with, and enriched with his intellect, wit, and spirit.
It is with great sadness that we also note Kip Hampton's passing. Probably best known as the author of the Perl & XML column on XML.com, he was a core contributor to AxKit, an XML server platform that became an Apache Foundation project. He was a frequent speaker in the early days at OSCON, and most recently at YAPC::NA in Madison. He was frequently on irc.perl.org as ubu, generally in the #axkit-dahut community, the group responsible for YAPC::NA Asheville in 2011.
Kip and his constant contributions to the community will be greatly missed.
Perl 5.26.0 represents approximately 13 months of development since Perl 5.24.0 and contains approximately 360,000 lines of changes across 2,600 files from 86 authors.
Excluding auto-generated files, documentation and release tools, there were approximately 230,000 lines of changes to 1,800 .pm, .t, .c and .h files.
Perl continues to flourish into its third decade thanks to a vibrant community of users and developers. The following people are known to have contributed the improvements that became Perl 5.26.0:
Aaron Crane, Abigail, Ævar Arnfjörð Bjarmason, Alex Vandiver, Andreas König, Andreas Voegele, Andrew Fresh, Andy Lester, Aristotle Pagaltzis, Chad Granum, Chase Whitener, Chris 'BinGOs' Williams, Chris Lamb, Christian Hansen, Christian Millour, Colin Newell, Craig A. Berry, Dagfinn Ilmari Mannsåker, Dan Collins, Daniel Dragan, Dave Cross, Dave Rolsky, David Golden, David H. Gutteridge, David Mitchell, Dominic Hargreaves, Doug Bell, E. Choroba, Ed Avis, Father Chrysostomos, François Perrad, Hauke D, H.Merijn Brand, Hugo van der Sanden, Ivan Pozdeev, James E Keenan, James Raspass, Jarkko Hietaniemi, Jerry D. Hedden, Jim Cromie, J. Nick Koston, John Lightsey, Karen Etheridge, Karl Williamson, Leon Timmermans, Lukas Mai, Matthew Horsfall, Maxwell Carey, Misty De Meo, Neil Bowers, Nicholas Clark, Nicolas R., Niko Tyni, Pali, Paul Marquess, Peter Avalos, Petr Písař, Pino Toscano, Rafael Garcia-Suarez, Reini Urban, Renee Baecker, Ricardo Signes, Richard Levitte, Rick Delaney, Salvador Fandiño, Samuel Thibault, Sawyer X, Sébastien Aperghis-Tramoni, Sergey Aleynikov, Shlomi Fish, Smylers, Stefan Seifert, Steffen Müller, Stevan Little, Steve Hay, Steven Humphrey, Sullivan Beck, Theo Buehler, Thomas Sibley, Todd Rinaldo, Tomasz Konojacki, Tony Cook, Unicode Consortium, Yaroslav Kuzmin, Yves Orton, Zefram.
The list above is almost certainly incomplete as it is automatically generated from version control history. In particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker.
Many of the changes included in this version originated in the CPAN modules included in Perl's core. We're grateful to the entire CPAN community for helping Perl to flourish.
For a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.
If you find what you think is a bug, you might check the perl bug database at https://rt.perl.org/. There may also be information at http://www.perl.org/, the Perl Home Page.
If you believe you have an unreported bug, please run the perlbug program included with your release. Be sure to trim your bug down to a tiny but sufficient test case. Your bug report, along with the output of perl -V, will be sent off to perlbug@perl.org to be analysed by the Perl porting team.
If the bug you are reporting has security implications which make it inappropriate to send to a publicly archived mailing list, then see "SECURITY VULNERABILITY CONTACT INFORMATION" in perlsec for details of how to report the issue.
If you wish to thank the Perl 5 Porters for the work we had done in Perl 5, you can do so by running the perlthanks program:
perlthanks
This will send an email to the Perl 5 Porters list with your show of thanks.
The Changes file for an explanation of how to view exhaustive details on what changed.
The INSTALL file for how to build Perl.
The README file for general stuff.
The Artistic and Copying files for copyright information.