SUSE-SU-2026:4926-1: Security update for perl-Cpanel-JSON-XS

This update for perl-Cpanel-JSON-XS fixes the following issues:

- CVE-2025-40929: integer overflow (bsc#1249331). - CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled (bsc#1267546). - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in decodehv (bsc#1286166). - CVE-2026-110673: stack exhaustion via nested tagged values under allowtags in decodetag (bsc#1286167). - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under dupkeysasarrayref in decodehv (bsc#1286168). - CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under allowbarekey in decodehv (bsc#1286169). - CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under allowbignum (bsc#1286170). - CVE-2026-110677: array collecting duplicate key values leaked under dupkeysasarrayref in decodehv (bsc#1286173). - CVE-2026-110678: memory exhaustion by buffering incremental input past maxsize in incrparse (bsc#1286174). - CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in encodehv (bsc#1286175). - CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new ithread (bsc#1286176). - CVE-2026-110682: input chunking can change the decoded value of top-level numbers in incrparse (bsc#1286177). - CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in encodestringify (bsc#1286179). - CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in decodetag (bsc#1286180). - CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in decodehv (bsc#1286181). - CVE-2026-110687: byte-string keys misordered during canonical encoding in utf16cmp (bsc#1286182). - CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in incrparse (bsc#1286183).

Changes for perl-Cpanel-JSON-XS:

- updated to 4.800.0 (4.80) - Add version markers to all module files. (PR #260 demerphq) - Use utf8ntouvchr on Perl 5.32 and later to avoid the deprecated utf8ntouvuni API. (PR #260 demerphq) - Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides checktype($data, $schema[, $foundtype]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSONTYPE / jsontypearrayof / jsontypehashof / jsontypeanyof), plus the new jsontypeoptional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decodeandvalidate($jsontext, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity. - jsontypeoptional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands jsontypeoptional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for checktype()/decodeandvalidate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242). eg/benchlarge.pl: old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53 new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80 4.53 2026-09-28 (rurban) - Fix C90 violations with arm neon (GH #258 rjbs) - Added a native arm64 test runner. - updated to 4.520.0 (4.52) 4.52 2026-09-12 (rurban) - OSX 10.9 fix for SIMD UTF-8 (Christian Carey) - Change my maintainer email to reini.urban@gmail.com 4.51 2026-09-11 (rurban) - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang) - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to make xtest when yath is installed. - Skip one t/117numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen). 4.50 2026-09-08 (rurban) - Add $json->encodeto($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58). Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures. - Encoder performance improvements suggested in GH #237 (17dec): Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000). encodestr now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape. Added eg/benchlarge.pl with results. - updated to 4.440.0 (4.44) 4.44 2026-09-02 (rurban) - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length. - updated to 4.430.0 (4.43) 4.43 2026-07-18 (rurban) - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont) - Fix canonical sort on Perl 5.8-5.18: utf16cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set. - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux). The .0 guard condition that suppressed appending for NV values > UVMAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NVDIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values. - updated to 4.420.0 (4.42) 4.42 2026-06-27 (rurban) - Ensure encode with a type spec hashref does not change the hashref argument (GH #240) - Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage). - Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to ''. Added defined() guard. - Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any '' overload. - Fix typeallstring overriding allowblessed/convertblessed (GH #175, reported by alpha6). With typeallstring + allowblessed, blessed objects are now encoded as null (not stringified as HASH address). - Fix infinite recursion when encode is called from a '' overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convertblessed and allowstringify flags on the JSON object before calling the overload, preventing re-entrant encode loops. - Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's stash rather than using the stringified reference. - Change allownonref default to true (GH #241, matching JSON::PP and JSON::XS 4.0+ and the insecure RFC 7159). encode and decode now accept non-reference values by default. decodejson() with an explicit 0/1 second argument still works. allownonref(0) to disable scalars-only for secure JSON. - Fix minor t/12blessed.t typo. - Fix GH #112: encode large whole-number NV values without .0 on 32-bit Perl (values exceeding UVMAX that Perl stores as float). - Fix GH #197: prefer IOK over pNOK when encoding values where IV is accurate but NV is imprecise (SvNOK not set). - updated to 4.410.0 (4.41) 4.41 2026-05-27 (rurban) - Fix incrparse single-quote string delimiter (GH #245, reported by Paul Johnson) - Fix a one-byte out-of-bounds heap read reachable via allowbarekey on truncated input (GH #244, reported by Paul Johnson) - updated to 4.400.0 (4.40) 4.40 2025-09-07 (rurban) - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only. - Detect more malformed numbers, with two decimal points. - Pin github actions to latest @v via pinact run -u (bsc#1249331) - updated to 4.390.0 (4.39) 4.39 2024-12-12 (rurban) - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229) - Fix inconsistent behavior between decoding escaped and unescaped surrogates, and escaped non-characters vs non-escaped non-characters. Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227) - Add typeallstring tests (Bernhard Schmalhofer GH #236) - Silence UV to char cast warnings (bulk88 GH #232) - Fix MSVC preprocessor errors (bulk88 GH #232) - Fix -Wformat warnings on Windows (sisyphus GH #228) - Clarify BigInt decoding (GH #226)