From 7a147d4004864f0f3cca385bdaebaaacdb53fb7a Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:04:00 +0200
Subject: [PATCH 01/57] perlPackages.CpanelJSONXS: 4.37 -> 4.42

Fixes CVE-2026-9334, CVE-2026-9516. Supersedes the in-tree CVE-2025-40929 patch.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 66e7adfa8f255bff2e1ec8c12b888a8514aad48c)
---
 .../Cpanel-JSON-XS-CVE-2025-40929.patch       | 47 -------------------
 pkgs/top-level/perl-packages.nix              |  7 ++-
 2 files changed, 3 insertions(+), 51 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch

diff --git a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
deleted file mode 100644
index 0f76f7313fde..000000000000
--- a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 5592bfb58eb8d1c8a644e67c9bba795d1384a995 Mon Sep 17 00:00:00 2001
-From: Marc Lehmann <schmorp@schmorp.de>
-Date: Sat, 6 Sep 2025 11:31:36 +0200
-Subject: [PATCH 1/2] fix json_atof_scan1 overflows
-
-with fuzzed overlong numbers. CVE-2025-40928
-Really the comparisons were wrong.
----
- XS.xs | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/XS.xs b/XS.xs
-index 9b1ce2b..94ab0d6 100755
---- a/XS.xs
-+++ b/XS.xs
-@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-   /* if we recurse too deep, skip all remaining digits */
-   /* to avoid a stack overflow attack */
-   if (UNLIKELY(--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = (U8)(*s - '0');
- 
-       if (UNLIKELY(dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
--- 
-2.50.1
-
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 47e3e1035ddc..a112470336b0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6691,12 +6691,11 @@ with self;
 
   CpanelJSONXS = buildPerlPackage {
     pname = "Cpanel-JSON-XS";
-    version = "4.37";
+    version = "4.42";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.37.tar.gz";
-      hash = "sha256-wkFhWg4X/3Raqoa79Gam4pzSQFFeZfBqegUBe2GebUs=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.42.tar.gz";
+      hash = "sha256-4awvqx46bS2ZjTRAxgAGc2W9x9vwyPKyBZy85LTIMXM=";
     };
-    patches = [ ../development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch ];
     meta = {
       description = "CPanel fork of JSON::XS, fast and correct serializing";
       license = with lib.licenses; [

From 09bbf90e12da63cc2eae23b4a1b71f3910a29e39 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:06:54 +0200
Subject: [PATCH 02/57] perlPackages.HTMLParser: 3.81 -> 3.85

Fixes CVE-2026-8829.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 7a4c9efd01e0980532edff7245f49768ad1deb01)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a112470336b0..dd180aaf582f 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16302,10 +16302,10 @@ with self;
 
   HTMLParser = buildPerlPackage {
     pname = "HTML-Parser";
-    version = "3.81";
+    version = "3.85";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTML-Parser-3.81.tar.gz";
-      hash = "sha256-wJEKXI+S+IF+3QbM/SJLocLr6MEPVR8DJYeh/IPWL/I=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTML-Parser-3.85.tar.gz";
+      hash = "sha256-/UK6ar4HJBzwrVe+JGw5gAZfaD5EZeWbRq+e/ryODHE=";
     };
     propagatedBuildInputs = [
       HTMLTagset

From 5be34527fc67abdd8b142b3878ee24ef851d739a Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:07:12 +0200
Subject: [PATCH 03/57] perlPackages.NetStatsd: 0.12 -> 0.13

Fixes CVE-2026-46739.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 9020587aa04036671788a5745f2ea63df581b064)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index dd180aaf582f..0fb71ea2d892 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -26403,10 +26403,10 @@ with self;
 
   NetStatsd = buildPerlPackage {
     pname = "Net-Statsd";
-    version = "0.12";
+    version = "0.13";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CO/COSIMO/Net-Statsd-0.12.tar.gz";
-      hash = "sha256-Y+RTYD2hZbxtHEygtV7aPSIE8EDFkwSkd4LFqniGVlw=";
+      url = "mirror://cpan/authors/id/C/CO/COSIMO/Net-Statsd-0.13.tar.gz";
+      hash = "sha256-xKYP9dP002ompqR3YxGI7HnNzp4wUMZ6NOm1rikgoQA=";
     };
     meta = {
       description = "Perl client for Etsy's statsd daemon";

From 4e17ae400bf0caabf37e2664a50167f9ab3a2c86 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:07:28 +0200
Subject: [PATCH 04/57] perlPackages.ProtocolHTTP2: 1.11 -> 1.13

Fixes CVE-2026-10725.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 0002e3ea35b952f747cc1cd19657f729422b7f42)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0fb71ea2d892..36d24240eb0b 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -29136,10 +29136,10 @@ with self;
 
   ProtocolHTTP2 = buildPerlModule {
     pname = "Protocol-HTTP2";
-    version = "1.11";
+    version = "1.13";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.11.tar.gz";
-      hash = "sha256-Vp8Fsavpl7UHyCUVMMyB0e6WvZMsxoJTS2zkhlNQCRM=";
+      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.13.tar.gz";
+      hash = "sha256-LsO0oYpkqGHgKYHO/Y7W8iOHUTj75e/us0DvF5ZVMGI=";
     };
     buildInputs = [
       AnyEvent

From eec0b58b304cd433944b8c6d6f3163487a7fe692 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:08:56 +0200
Subject: [PATCH 05/57] perlPackages.CryptPBKDF2: 0.161520 -> 0.261630

Fixes CVE-2017-20240, CVE-2026-9638, CVE-2026-9641.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit f1ec9089c3939acbba18a7e3c1650eff87cdf9c4)
---
 pkgs/top-level/perl-packages.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 36d24240eb0b..5616a7db40a0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7747,15 +7747,19 @@ with self;
     };
   };
 
-  CryptPBKDF2 = buildPerlPackage {
+  CryptPBKDF2 = buildPerlModule {
     pname = "Crypt-PBKDF2";
-    version = "0.161520";
+    version = "0.261630";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Crypt-PBKDF2-0.161520.tar.gz";
-      hash = "sha256-l9+nmjCaCG4YSk5hBH+KEP+z2wUQJefSIqJfGRMLpBc=";
+      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Crypt-PBKDF2-0.261630.tar.gz";
+      hash = "sha256-GHVxiWOJMrMJs0xFu4EKo+SFbj7VgBAAF9reZXk/RsA=";
     };
-    buildInputs = [ TestFatal ];
+    buildInputs = [
+      ModuleBuildTiny
+      TestFatal
+    ];
     propagatedBuildInputs = [
+      CryptURandom
       DigestHMAC
       DigestSHA3
       Moo

From 87965eb13e26b3f90c95076aa59767ad08d54366 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:39 +0200
Subject: [PATCH 06/57] perlPackages.ExtUtilsHelpers: 0.026 -> 0.028

Required by ExtUtils::Builder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 32536524aff1b490a54ec6d4e60c89f6f2252423)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 5616a7db40a0..fb2be124c1ef 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12697,10 +12697,10 @@ with self;
 
   ExtUtilsHelpers = buildPerlPackage {
     pname = "ExtUtils-Helpers";
-    version = "0.026";
+    version = "0.028";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Helpers-0.026.tar.gz";
-      hash = "sha256-3pAbZ5CkVXz07JCBSeA1eDsSW/EV65ZA/rG8HCTDNBY=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Helpers-0.028.tar.gz";
+      hash = "sha256-yFdIdczgc+fcU0WnsG1QLlIETWiJT5FgID/KqzeVFP4=";
     };
     meta = {
       description = "Various portability utilities for module builders";

From 1a4bd417df97c4b1205596405b8465bca0127388 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 07/57] perlPackages.ExtUtilsConfig: 0.008 -> 0.010

Required by ExtUtils::Builder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit f57d979624839d4840d60f6c134a24b83dd95ecb)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index fb2be124c1ef..73ee1abff8cc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12606,10 +12606,10 @@ with self;
 
   ExtUtilsConfig = buildPerlPackage {
     pname = "ExtUtils-Config";
-    version = "0.008";
+    version = "0.010";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Config-0.008.tar.gz";
-      hash = "sha256-rlEE9jRlDc6KebftE/tZ1no5whOmd2z9qj7nSeYvGow=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Config-0.010.tar.gz";
+      hash = "sha256-gufk6Qy+OA4VL13m4+QDdGmC1QLdMBl6EjZS5GYQxm0=";
     };
     meta = {
       description = "Wrapper for perl's configuration";

From 5d2b277dd51dab0817271f81912713610d58a347 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 08/57] perlPackages.ExtUtilsBuilder: init at 0.020

Dependency of Dist::Build.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 5ebb6bf806f336e1a44479bcfc65ae10c7284a79)
---
 pkgs/top-level/perl-packages.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 73ee1abff8cc..8a5f11bce9e3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12587,6 +12587,27 @@ with self;
     };
   };
 
+  ExtUtilsBuilder = buildPerlPackage {
+    pname = "ExtUtils-Builder";
+    version = "0.020";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Builder-0.020.tar.gz";
+      hash = "sha256-UtZR46oDJyUOR5h9Rf9I6cyQtbe9L7D/P3h4PlMq/8w=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsConfig
+      ExtUtilsHelpers
+    ];
+    meta = {
+      description = "Abstract representation of build processes";
+      homepage = "https://github.com/Leont/extutils-builder-plan";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ExtUtilsCChecker = buildPerlModule {
     pname = "ExtUtils-CChecker";
     version = "0.11";

From a3dbc7030277744e8670bfa7564f8c63a9572542 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 09/57] perlPackages.ExtUtilsBuilderCompiler: init at 0.037

Dependency of Dist::Build.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 47c2f1daf9350d321fe5a41ef4fa550f3f8a7d85)
---
 pkgs/top-level/perl-packages.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8a5f11bce9e3..6be02308f145 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12608,6 +12608,27 @@ with self;
     };
   };
 
+  ExtUtilsBuilderCompiler = buildPerlPackage {
+    pname = "ExtUtils-Builder-Compiler";
+    version = "0.037";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Builder-Compiler-0.037.tar.gz";
+      hash = "sha256-s5VNaI45gDkoUnkWfG6+7nVX8Q6VYBzj/baBkyY2h7g=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsBuilder
+      ExtUtilsConfig
+    ];
+    meta = {
+      description = "Interface around different compilers";
+      homepage = "https://github.com/Leont/extutils-builder-compiler";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ExtUtilsCChecker = buildPerlModule {
     pname = "ExtUtils-CChecker";
     version = "0.11";

From 74643a5f7056ddec7eed40ec7beb6d5ac7ea8d2d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:21:35 +0200
Subject: [PATCH 10/57] perlPackages.DistBuild: init at 0.028
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build dependency of Crypt::Argon2.

Co-authored-by: Robert Schütz <nix@dotlambda.de>
Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 46324ed6bb63470975f19e9e4ba58e9ceadf268c)
---
 pkgs/top-level/perl-packages.nix | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6be02308f145..a9a96fd3b507 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11039,6 +11039,31 @@ with self;
     };
   };
 
+  DistBuild = buildPerlModule {
+    pname = "Dist-Build";
+    version = "0.028";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Dist-Build-0.028.tar.gz";
+      hash = "sha256-JPFLFA4Tq3x1PU25bI0zbQnepcb1H+1IvA92Khyhgx8=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsBuilder
+      ExtUtilsBuilderCompiler
+      ExtUtilsConfig
+      ExtUtilsHelpers
+      ExtUtilsInstallPaths
+    ];
+    meta = {
+      changelog = "https://github.com/Leont/dist-build/blob/v0.028/Changes";
+      description = "Modern module builder, author tools not included";
+      homepage = "https://github.com/Leont/dist-build";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   DistributionMetadata = buildPerlModule {
     pname = "Distribution-Metadata";
     version = "0.10";

From e7eb5dc94473eec5e104fd2fe61a281c7f857c1f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:21:35 +0200
Subject: [PATCH 11/57] perlPackages.CryptArgon2: 0.019 -> 0.031
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes CVE-2026-8463.

Co-authored-by: Robert Schütz <nix@dotlambda.de>
Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit de1d803f4387e8afbccf6a7650b8a8ff0c45b2fc)
---
 pkgs/top-level/perl-packages.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a9a96fd3b507..d64d048b6516 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6889,13 +6889,15 @@ with self;
 
   CryptArgon2 = buildPerlModule {
     pname = "Crypt-Argon2";
-    version = "0.019";
+    version = "0.031";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.019.tar.gz";
-      hash = "sha256-+Fm+6NL2tAf11EZFwiOu4hL+AFkd/YLlBlrhvnio5Dg=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.031.tar.gz";
+      hash = "sha256-1l5RoZQ+6AglEkUNw1KuUpUQZswJI/u38uYK+l8WTi0=";
     };
     nativeBuildInputs = [ pkgs.ld-is-cc-hook ];
+    buildInputs = [ DistBuild ];
     meta = {
+      changelog = "https://github.com/Leont/crypt-argon2/blob/v0.031/Changes";
       description = "Perl interface to the Argon2 key derivation functions";
       license = with lib.licenses; [ cc0 ];
     };

From 2810eba39c0ca0bca96bb03cfc6a50227a25146b Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:25:57 +0200
Subject: [PATCH 12/57] perlPackages.ClassErrorHandler: init at 0.04

Dependency of Convert::PEM.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 9f61f7a1b02416d738b87a5c97d586d8fe3dd250)
---
 pkgs/top-level/perl-packages.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d64d048b6516..f5f4cc443cb7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5092,6 +5092,22 @@ with self;
     };
   };
 
+  ClassErrorHandler = buildPerlPackage {
+    pname = "Class-ErrorHandler";
+    version = "0.04";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TOKUHIROM/Class-ErrorHandler-0.04.tar.gz";
+      hash = "sha256-NC0tz8eXogvugXmxuWuFwK56W0iCc1lSPNjHTD5wRQI=";
+    };
+    meta = {
+      description = "Base class for error handling";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ClassInspector = buildPerlPackage {
     pname = "Class-Inspector";
     version = "1.36";

From 8e84248b5f6e0510f6b52f4c29d659200f942300 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:26:10 +0200
Subject: [PATCH 13/57] perlPackages.CryptDESEDE3: init at 0.03

Dependency of Convert::PEM.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit b7bd8c9e93c0cab35230863db815c3cafaa9bd41)
---
 pkgs/top-level/perl-packages.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f5f4cc443cb7..a507c4652731 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7034,6 +7034,23 @@ with self;
     };
   };
 
+  CryptDESEDE3 = buildPerlPackage {
+    pname = "Crypt-DES_EDE3";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DES_EDE3-0.03.tar.gz";
+      hash = "sha256-KFktt7njR0WqkfPhnl27uDqvRyop5we5eR0NArPiJ/U=";
+    };
+    propagatedBuildInputs = [ CryptDES ];
+    meta = {
+      description = "Triple-DES EDE encryption/decryption";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   CryptDH = buildPerlPackage {
     pname = "Crypt-DH";
     version = "0.07";

From 61b61bd6d4ed3c07d981de6392539dad299c5483 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:26:22 +0200
Subject: [PATCH 14/57] perlPackages.ConvertPEM: init at 0.13

Dependency of Crypt::DSA.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit f098e09528a436b2119e1bdee879d12079b8567f)
---
 pkgs/top-level/perl-packages.nix | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a507c4652731..6d7eaace2b45 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6413,6 +6413,29 @@ with self;
     };
   };
 
+  ConvertPEM = buildPerlPackage {
+    pname = "Convert-PEM";
+    version = "0.13";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Convert-PEM-0.13.tar.gz";
+      hash = "sha256-eZ+jLCcAgfTmKSsN31GAlScQqKS+Ey6Qe9oxdqe9HCM=";
+    };
+    buildInputs = [ TestException ];
+    propagatedBuildInputs = [
+      ClassErrorHandler
+      ConvertASN1
+      CryptDESEDE3
+      CryptX
+    ];
+    meta = {
+      description = "Read/write encrypted ASN.1 PEM files";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ConvertUU = buildPerlPackage {
     pname = "Convert-UU";
     version = "0.5201";

From 80de9e17dd592349724623c9e7767632aff5b9ee Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:27:45 +0200
Subject: [PATCH 15/57] perlPackages.CryptDSA: 1.17 -> 1.21

Fixes CVE-2026-8700, CVE-2026-8704, CVE-2026-12205.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit e86a4b4e44855be1d7c7ba081f2d057c98ebb928)
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6d7eaace2b45..acf816995432 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7116,14 +7116,17 @@ with self;
 
   CryptDSA = buildPerlPackage {
     pname = "Crypt-DSA";
-    version = "1.17";
+    version = "1.21";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AD/ADAMK/Crypt-DSA-1.17.tar.gz";
-      hash = "sha256-0bhYX2v3RvduXcXaNkHTJe1la8Ll80S1RRS1XDEAmgM=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz";
+      hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA=";
     };
     propagatedBuildInputs = [
+      ConvertASN1
+      ConvertPEM
+      CryptSysRandom
+      CryptURandom
       DataBuffer
-      DigestSHA1
       FileWhich
     ];
     meta = {

From ea711b89bb5ce52d130b2e01b69173b99103abb0 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:31:40 +0200
Subject: [PATCH 16/57] perlPackages.Sereal: 5.004 -> 5.006

Fixes CVE-2026-8796. Covers Sereal, Sereal::Decoder and Sereal::Encoder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 261df4c82cbef82eff433195316c3222c9dd5873)
---
 pkgs/top-level/perl-packages.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index acf816995432..c42733e3d8f3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -30712,10 +30712,10 @@ with self;
 
   SerealDecoder = buildPerlPackage {
     pname = "Sereal-Decoder";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-5.004.tar.gz";
-      hash = "sha256-aO8DFNh9Gm5guw9m/PQ+ssrN6xdUQy9eJeeE450+Z4Q=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-5.006.tar.gz";
+      hash = "sha256-eZGFXpGBo3nJsBIv6PwvaONEnJFhaow1eSbxFh9oR2g=";
     };
     buildInputs = [
       TestDeep
@@ -30737,10 +30737,10 @@ with self;
 
   SerealEncoder = buildPerlPackage {
     pname = "Sereal-Encoder";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-5.004.tar.gz";
-      hash = "sha256-XlqGzNMtrjTtgJMuy+XGjil1K13g6bCnk6t+sspVyxs=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-5.006.tar.gz";
+      hash = "sha256-kLQsyHdZgq4MdJno9ZLOeu+ug0M1g+EKWtVxKBHRcK0=";
     };
     buildInputs = [
       SerealDecoder
@@ -30762,10 +30762,10 @@ with self;
 
   Sereal = buildPerlPackage {
     pname = "Sereal";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-5.004.tar.gz";
-      hash = "sha256-nCW7euS9c20ksa0dk9dzlbDGXKh0HiZr/Ay+VCJh128=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-5.006.tar.gz";
+      hash = "sha256-uwXnY+1ry+pEx5IX/vCy05GKwVRxlHIwOMbER+5vWd4=";
     };
     buildInputs = [
       TestDeep

From 222035703574b49d298862f3ed4269861461c57d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:36:58 +0200
Subject: [PATCH 17/57] perlPackages.XMLLibXML: 2.0210 -> 2.0213

Fixes CVE-2026-8177. Drops the libxml-2.13 test patch, now included upstream.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 5fb740257c36a83351b79b1dc15d8056a1533976)
---
 .../XML-LibXML-fix-tests-libxml-2.13.0.patch  | 242 ------------------
 pkgs/top-level/perl-packages.nix              |  10 +-
 2 files changed, 3 insertions(+), 249 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch

diff --git a/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch b/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
deleted file mode 100644
index 5433d3afd934..000000000000
--- a/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From bee8338fd1cbd7aad4bf60c2965833343b6ead6f Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Tue, 21 May 2024 15:17:30 +0200
-Subject: [PATCH 1/3] Fix test suite with libxml2 2.13.0
-
----
- t/02parse.t                        | 7 ++++++-
- t/08findnodes.t                    | 8 +++++++-
- t/19die_on_invalid_utf8_rt_58848.t | 2 +-
- t/25relaxng.t                      | 4 ++--
- t/26schema.t                       | 4 ++--
- t/60error_prev_chain.t             | 8 ++++----
- 6 files changed, 22 insertions(+), 11 deletions(-)
-
-diff --git a/t/02parse.t b/t/02parse.t
-index b111507b..40aa5f13 100644
---- a/t/02parse.t
-+++ b/t/02parse.t
-@@ -884,7 +884,12 @@ EOXML
-         eval {
-            $doc2    = $parser->parse_string( $xmldoc );
-         };
--        isnt($@, '', "error parsing $xmldoc");
-+        # https://gitlab.gnome.org/GNOME/libxml2/-/commit/b717abdd
-+        if (XML::LibXML::LIBXML_RUNTIME_VERSION() < 21300) {
-+            isnt($@, '', "error parsing $xmldoc");
-+        } else {
-+            is( $doc2->documentElement()->firstChild()->nodeName(), "foo" );
-+        }
- 
-         $parser->validation(1);
- 
-diff --git a/t/08findnodes.t b/t/08findnodes.t
-index 016c85a1..e9417bc5 100644
---- a/t/08findnodes.t
-+++ b/t/08findnodes.t
-@@ -123,7 +123,13 @@ my $docstring = q{
- my @ns = $root->findnodes('namespace::*');
- # TEST
- 
--is(scalar(@ns), 2, ' TODO : Add test name' );
-+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/aca16fb3
-+# fixed xmlCopyNamespace with XML namespace.
-+if (XML::LibXML::LIBXML_RUNTIME_VERSION() < 21300) {
-+    is(scalar(@ns), 2, ' TODO : Add test name' );
-+} else {
-+    is(scalar(@ns), 3, ' TODO : Add test name' );
-+}
- 
- # bad xpaths
- # TEST:$badxpath=4;
-diff --git a/t/19die_on_invalid_utf8_rt_58848.t b/t/19die_on_invalid_utf8_rt_58848.t
-index aa8ad105..4160cb27 100644
---- a/t/19die_on_invalid_utf8_rt_58848.t
-+++ b/t/19die_on_invalid_utf8_rt_58848.t
-@@ -16,7 +16,7 @@ use XML::LibXML;
-     my $err = $@;
- 
-     # TEST
--    like ("$err", qr{parser error : Input is not proper UTF-8},
-+    like ("$err", qr{not proper UTF-8|Invalid bytes in character encoding},
-         'Parser error.',
-     );
- }
-diff --git a/t/25relaxng.t b/t/25relaxng.t
-index 93e61883..71383b2a 100644
---- a/t/25relaxng.t
-+++ b/t/25relaxng.t
-@@ -132,7 +132,7 @@ print "# 6 check that no_network => 1 works\n";
- {
-     my $rng = eval { XML::LibXML::RelaxNG->new( location => $netfile, no_network => 1 ) };
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'RNG from file location with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'RNG from file location with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $rng, 'RNG from file location with external import and no_network => 1 is not loaded.' );
- }
-@@ -152,7 +152,7 @@ print "# 6 check that no_network => 1 works\n";
- </grammar>
- EOF
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'RNG from buffer with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'RNG from buffer with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $rng, 'RNG from buffer with external import and no_network => 1 is not loaded.' );
- }
-diff --git a/t/26schema.t b/t/26schema.t
-index 17f641e4..c404cedd 100644
---- a/t/26schema.t
-+++ b/t/26schema.t
-@@ -117,7 +117,7 @@ EOF
- {
-     my $schema = eval { XML::LibXML::Schema->new( location => $netfile, no_network => 1 ) };
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'Schema from file location with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'Schema from file location with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $schema, 'Schema from file location with external import and no_network => 1 is not loaded.' );
- }
-@@ -129,7 +129,7 @@ EOF
- </xsd:schema>
- EOF
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'Schema from buffer with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'Schema from buffer with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $schema, 'Schema from buffer with external import and no_network => 1 is not loaded.' );
- }
-diff --git a/t/60error_prev_chain.t b/t/60error_prev_chain.t
-index e48215c4..55ac0b2e 100644
---- a/t/60error_prev_chain.t
-+++ b/t/60error_prev_chain.t
-@@ -16,13 +16,11 @@ use XML::LibXML;
- 
- {
-     my $parser = XML::LibXML->new();
--    $parser->validation(0);
--    $parser->load_ext_dtd(0);
- 
-     eval
-     {
-         local $^W = 0;
--        $parser->parse_file('example/JBR-ALLENtrees.htm');
-+        $parser->parse_string('<doc>&ldquo;&nbsp;&rdquo;</doc>');
-     };
- 
-     my $err = $@;
-@@ -31,7 +29,7 @@ use XML::LibXML;
-     if( $err && !ref($err) ) {
-       plan skip_all => 'The local libxml library does not support errors as objects to $@';
-     }
--    plan tests => 1;
-+    plan tests => 2;
- 
-     while (defined($err) && $count < 200)
-     {
-@@ -44,6 +42,8 @@ use XML::LibXML;
- 
-     # TEST
-     ok ((!$err), "Reached the end of the chain.");
-+    # TEST
-+    is ($count, 3, "Correct number of errors reported")
- }
- 
- =head1 COPYRIGHT & LICENSE
-
-From c9f9c2fe51173b0a00969f01b577399f1098aa47 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Thu, 13 Feb 2025 19:50:35 +0100
-Subject: [PATCH 2/3] Fix test suite with libxml2 2.14.0
-
----
- t/16docnodes.t   | 7 ++++++-
- t/49_load_html.t | 8 +++++++-
- 2 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/t/16docnodes.t b/t/16docnodes.t
-index db7bc1fc..0b0ae005 100644
---- a/t/16docnodes.t
-+++ b/t/16docnodes.t
-@@ -60,7 +60,12 @@ for my $time (0 .. 2) {
-     $doc->setDocumentElement($node);
- 
-     # TEST
--    is( $node->serialize(), '<test contents="&#xE4;"/>', 'Node serialise works.' );
-+    # libxml2 2.14 avoids unnecessary escaping of attribute values.
-+    if (XML::LibXML::LIBXML_VERSION() >= 21400) {
-+        is( $node->serialize(), "<test contents=\"\xE4\"/>", 'Node serialise works.' );
-+    } else {
-+        is( $node->serialize(), '<test contents="&#xE4;"/>', 'Node serialise works.' );
-+    }
- 
-     $doc->setEncoding('utf-8');
-     # Second output
-diff --git a/t/49_load_html.t b/t/49_load_html.t
-index 70d26607..3861edf8 100644
---- a/t/49_load_html.t
-+++ b/t/49_load_html.t
-@@ -52,7 +52,13 @@ use XML::LibXML;
- </div>
- EOS
- 
--    {
-+    SKIP: {
-+        # libxml2 2.14 tokenizes HTML according to HTML5 where
-+        # this isn't an error, see "13.2.5.73 Named character
-+        # reference state".
-+        skip("libxml2 version >= 21400", 1)
-+            if XML::LibXML::LIBXML_VERSION >= 21400;
-+
-         my $buf = '';
-         open my $fh, '>', \$buf;
-         # redirect STDERR there
-
-From ecbebc2f33fecb66b3d5487c6e48bea353e374f9 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Fri, 16 May 2025 19:11:12 +0200
-Subject: [PATCH 3/3] Remove tests that disable line numbers
-
-Line numbers are always enabled since libxml2 2.15.0.
----
- t/02parse.t | 13 ++-----------
- 1 file changed, 2 insertions(+), 11 deletions(-)
-
-diff --git a/t/02parse.t b/t/02parse.t
-index 40aa5f13..17419f8f 100644
---- a/t/02parse.t
-+++ b/t/02parse.t
-@@ -14,7 +14,7 @@ use locale;
- 
- POSIX::setlocale(LC_ALL, "C");
- 
--use Test::More tests => 533;
-+use Test::More tests => 531;
- use IO::File;
- 
- use XML::LibXML::Common qw(:libxml);
-@@ -25,7 +25,7 @@ use constant XML_DECL => "<?xml version=\"1.0\"?>\n";
- 
- use Errno qw(ENOENT);
- 
--# TEST*533
-+# TEST*531
- 
- ##
- # test values
-@@ -773,15 +773,6 @@ EOXML
- 
-     my $newkid = $root->appendChild( $doc->createElement( "bar" ) );
-     is( $newkid->line_number(), 0, "line number is 0");
--
--    $parser->line_numbers(0);
--    eval { $doc = $parser->parse_string( $goodxml ); };
--
--    $root = $doc->documentElement();
--    is( $root->line_number(), 0, "line number is 0");
--
--    @kids = $root->childNodes();
--    is( $kids[1]->line_number(), 0, "line number is 0");
- }
- 
- SKIP: {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index c42733e3d8f3..f9ba00aa2e18 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -38923,10 +38923,10 @@ with self;
 
   XMLLibXML = buildPerlPackage {
     pname = "XML-LibXML";
-    version = "2.0210";
+    version = "2.0213";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/XML-LibXML-2.0210.tar.gz";
-      hash = "sha256-opvz8Aq5ye4EIYFU4K/I95m/I2dOuZwantTeH0BZpI0=";
+      url = "mirror://cpan/authors/id/T/TO/TODDR/XML-LibXML-2.0213.tar.gz";
+      hash = "sha256-KvIcXWGsNOompfq/FbpaWEHmSPcYnbPjO28otUiYAqs=";
     };
     env.SKIP_SAX_INSTALL = 1;
     buildInputs = [
@@ -38940,10 +38940,6 @@ with self;
         zlib
       ]
     );
-    patches = [
-      # https://github.com/shlomif/perl-XML-LibXML/pull/87
-      ../development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
-    ];
     propagatedBuildInputs = [ XMLSAX ];
     meta = {
       description = "Perl Binding for libxml2";

From f4a185f99482b489b32e1e2a0dcde35162019eed Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:37:47 +0200
Subject: [PATCH 18/57] perlPackages.CryptPasswdMD5: 1.42 -> 1.43

Fixes CVE-2026-6659.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 62e6ec8536bbdb987df446af821549d619a10aca)
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f9ba00aa2e18..09f88f90ebc2 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7320,11 +7320,12 @@ with self;
 
   CryptPasswdMD5 = buildPerlPackage {
     pname = "Crypt-PasswdMD5";
-    version = "1.42";
+    version = "1.43";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RS/RSAVAGE/Crypt-PasswdMD5-1.42.tgz";
-      hash = "sha256-/Tlubn9E7rkj6TyZOUC49nqa7Vb8dKrK8Dj8QFPvO1k=";
+      url = "mirror://cpan/authors/id/R/RS/RSAVAGE/Crypt-PasswdMD5-1.43.tgz";
+      hash = "sha256-Qr+Sk0UQlYXUlWkCVX7ONdBh7aQ454lPhucHV0EoB1k=";
     };
+    propagatedBuildInputs = [ CryptURandom ];
     meta = {
       description = "Provide interoperable MD5-based crypt() functions";
       license = with lib.licenses; [

From 2cb06e584c3a695bc47304c69eef9d9ef0fab340 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:38:37 +0200
Subject: [PATCH 19/57] perlPackages.CryptScryptKDF: 0.010 -> 0.011

Fixes CVE-2026-8647.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 4b37127ec079734d0201385a0f3f96e1c6c20f45)
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 09f88f90ebc2..38eb57275a15 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7558,12 +7558,15 @@ with self;
 
   CryptScryptKDF = buildPerlModule {
     pname = "Crypt-ScryptKDF";
-    version = "0.010";
+    version = "0.011";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIK/Crypt-ScryptKDF-0.010.tar.gz";
-      hash = "sha256-fRbulczj61TBdGc6cpn0wIb7o6yF+EfQ4TT+7V93YBc=";
+      url = "mirror://cpan/authors/id/M/MI/MIK/Crypt-ScryptKDF-0.011.tar.gz";
+      hash = "sha256-IZLJ8E8rX/cHN/XNrz9PZ6VXE8MeoIVAOMvzXjttFrQ=";
     };
-    propagatedBuildInputs = [ CryptOpenSSLRandom ];
+    propagatedBuildInputs = [
+      CryptOpenSSLRandom
+      CryptX
+    ];
     meta = {
       description = "Scrypt password based key derivation function";
       homepage = "https://github.com/DCIT/perl-Crypt-ScryptKDF";

From d2859e330de02fd57588b1e737b5956cb69c9c09 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:40:15 +0200
Subject: [PATCH 20/57] perlPackages.Starlet: 0.31 -> 0.32

Fixes CVE-2026-40561.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit d22c1175af2ad1614c19f547a34677bc9250618d)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 38eb57275a15..bb2db1caf486 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -31543,10 +31543,10 @@ with self;
 
   Starlet = buildPerlPackage {
     pname = "Starlet";
-    version = "0.31";
+    version = "0.32";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KA/KAZUHO/Starlet-0.31.tar.gz";
-      hash = "sha256-uWA7jmKIDLRYL2p5Oer+xl5u/T2QDyx900Ll9MaNYtg=";
+      url = "mirror://cpan/authors/id/K/KA/KAZUHO/Starlet-0.32.tar.gz";
+      hash = "sha256-gZI9OmCX3YHH4Og9SBvuof89ZejgHY0f59yziFV1vY8=";
     };
     buildInputs = [
       LWP

From af88ec17296e66e552bc2aaf5a0ffa8eb4d1960c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:41:21 +0200
Subject: [PATCH 21/57] perlPackages.GD: 2.78 -> 2.86

Fixes CVE-2026-11526.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 55c68fd7a07225921f12f09c3fca242c5335dd53)
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bb2db1caf486..6110e19498b7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -14802,10 +14802,10 @@ with self;
 
   GD = buildPerlPackage {
     pname = "GD";
-    version = "2.78";
+    version = "2.86";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/GD-2.78.tar.gz";
-      hash = "sha256-aDEFS/VCS09cI9NifT0UhEgPb5wsZmMiIpFfKFG+buQ=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/GD-2.86.tar.gz";
+      hash = "sha256-bWTTvhQpzB606IqPICL+yRDqPgeS2k/ljT7fdpXEbKI=";
     };
 
     nativeBuildInputs = [
@@ -14820,6 +14820,7 @@ with self;
       pkgs.fontconfig
       pkgs.libxpm
       ExtUtilsPkgConfig
+      FileWhich
       TestFork
       TestNoWarnings
     ];

From d89874815f7ffb8d4b14fd51fee960e43dd35973 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:41:41 +0200
Subject: [PATCH 22/57] perlPackages.ConfigIniFiles: 3.000003 -> 3.002000

Fixes CVE-2026-11527.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 02ee43b56f68a424ce31e1c986b9fe4dccb1cb2f)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6110e19498b7..dca50236ff70 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6061,10 +6061,10 @@ with self;
 
   ConfigIniFiles = buildPerlPackage {
     pname = "Config-IniFiles";
-    version = "3.000003";
+    version = "3.002000";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Config-IniFiles-3.000003.tar.gz";
-      hash = "sha256-PEV7ZdmOX/QL25z4FLDVmD6wxT+4aWvaO6A1rSrNaAI=";
+      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Config-IniFiles-3.002000.tar.gz";
+      hash = "sha256-Bmke17QZl+hQxOfGs05cOWFF4M0FCvGUSiDQaMOlpAs=";
     };
     propagatedBuildInputs = [ IOStringy ];
     meta = {

From f94ec895737077ffc264c516510533cb43153624 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:44:06 +0200
Subject: [PATCH 23/57] perlPackages.CookieBaker: 0.11 -> 0.12

Required by Plack::Middleware::Session 0.36.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 3cb2e3221aacd925b9a2ff29b2f7ba60a0517bad)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index dca50236ff70..f9f1892642a7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6519,10 +6519,10 @@ with self;
 
   CookieBaker = buildPerlModule {
     pname = "Cookie-Baker";
-    version = "0.11";
+    version = "0.12";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KA/KAZEBURO/Cookie-Baker-0.11.tar.gz";
-      hash = "sha256-WSdfR04HwKo2EePmhLiU59uRMzPYIUQgvmPxLsGM16s=";
+      url = "mirror://cpan/authors/id/K/KA/KAZEBURO/Cookie-Baker-0.12.tar.gz";
+      hash = "sha256-mwTfXUfc1FrEKZYmoQ7JkPtAyU7lpjAMOoi9+zV17Ck=";
     };
     buildInputs = [
       ModuleBuildTiny

From 4be4476bea7ed41db973c743848097be4a91d05b Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:44:58 +0200
Subject: [PATCH 24/57] perlPackages.PlackMiddlewareSession: 0.33 -> 0.36

Fixes CVE-2025-40923, CVE-2013-10031.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 02bfa3d8bc458884286314b9b12121c5578e34f1)
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f9f1892642a7..506037e746ff 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -28713,12 +28713,13 @@ with self;
 
   PlackMiddlewareSession = buildPerlModule {
     pname = "Plack-Middleware-Session";
-    version = "0.33";
+    version = "0.36";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-Middleware-Session-0.33.tar.gz";
-      hash = "sha256-T/miydGK2ASbRd/ze5vdQSIeLC8eFrr7gb/tyIxRpO4=";
+      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-Middleware-Session-0.36.tar.gz";
+      hash = "sha256-kqWDFliBDSNzLm47rnpEofpafYpqbm3NdbkcapwktGY=";
     };
     propagatedBuildInputs = [
+      CryptSysRandom
       DigestHMAC
       Plack
     ];

From fc7097d2f99496d59a60fb24f3cca3afcecf2639 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:46:07 +0200
Subject: [PATCH 25/57] perlPackages.YAMLLibYAML: 0.89 -> 0.907.0

Fixes CVE-2025-40908.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 2c79c8f23a6b7a61195c7f53622ef68ed3a84e9f)
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 506037e746ff..c5c00e60419a 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -39540,11 +39540,12 @@ with self;
 
   YAMLLibYAML = buildPerlPackage {
     pname = "YAML-LibYAML";
-    version = "0.89";
+    version = "0.907.0";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TINITA/YAML-LibYAML-0.89.tar.gz";
-      hash = "sha256-FVq4NnU0XFCt0DMRrPndkVlVcH+Qmiq9ixfXeShZsuw=";
+      url = "mirror://cpan/authors/id/T/TI/TINITA/YAML-LibYAML-v0.907.0.tar.gz";
+      hash = "sha256-a6CHIkkROJ52+hmLFJzsg/BlsKx13cUmGPNJCULNlQY=";
     };
+    buildInputs = [ TestWarnings ];
     meta = {
       description = "Perl YAML Serialization using XS and libyaml";
       license = with lib.licenses; [

From 7b3f2aa4a1aed512ee53eca47216d298abda6e93 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:47:18 +0200
Subject: [PATCH 26/57] perlPackages.CryptCBC: 2.33 -> 3.07

Fixes CVE-2025-2814.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 49ef24302dabf5edc456c4ed56af2133cac0b48c)
---
 pkgs/top-level/perl-packages.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index c5c00e60419a..1562852baadc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6990,11 +6990,16 @@ with self;
 
   CryptCBC = buildPerlPackage {
     pname = "Crypt-CBC";
-    version = "2.33";
+    version = "3.07";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LD/LDS/Crypt-CBC-2.33.tar.gz";
-      hash = "sha256-anDeIbbMfysQAGfo4Yjblm6agAG122+pdufLWylK5kU=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-CBC-3.07.tar.gz";
+      hash = "sha256-9N37TdasUBPfg0G/pzTZye4PEOLnEhXsj+W/eAt8kSc=";
     };
+    propagatedBuildInputs = [
+      CryptPBKDF2
+      CryptURandom
+      CryptX
+    ];
     meta = {
       description = "Encrypt Data with Cipher Block Chaining Mode";
       license = with lib.licenses; [

From e8a22292980672133624eedb73a93612ee73298f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:48:14 +0200
Subject: [PATCH 27/57] perlPackages.Mojolicious: 9.39 -> 9.46

Fixes CVE-2024-58135.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 5b6275f4054ef7e0c374079db3bfd761b710aad4)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 1562852baadc..bc3f97886d79 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22846,10 +22846,10 @@ with self;
 
   Mojolicious = buildPerlPackage {
     pname = "Mojolicious";
-    version = "9.39";
+    version = "9.46";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.39.tar.gz";
-      hash = "sha256-EwpJDXfXYTn3NM4biU1Fm64DgF+x89/dWPxE/oKvPP0=";
+      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz";
+      hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw=";
     };
     meta = {
       description = "Real-time web framework";

From 3cadb4dafa9032d3e9251283a4e3550a5812e250 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:21:30 +0200
Subject: [PATCH 28/57] perlPackages.IOCompress: 2.220 -> 2.221

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit a06c0268f6fadd8d6a070df7f3bf30cec3ee0237)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bc3f97886d79..e247acf9f7f1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17720,10 +17720,10 @@ with self;
 
   IOCompress = buildPerlPackage {
     pname = "IO-Compress";
-    version = "2.220";
+    version = "2.221";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
-      hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
+      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.221.tar.gz";
+      hash = "sha256-r0LJyRBK3313LSVcDZpASjRi6kXnvELQbaCgtR3j0K4=";
     };
     propagatedBuildInputs = [
       CompressRawBzip2

From cb699ed771166c9959ec00646784c5b2b30a9037 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:22:08 +0200
Subject: [PATCH 29/57] perlPackages.HTTPMessage: 6.45 -> 7.02

Required by libwww-perl 6.83.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit d95a5e6344e6e7b308e6c6e35cadfd37da5229a9)
---
 pkgs/top-level/perl-packages.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e247acf9f7f1..69aa8fd91985 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17042,10 +17042,10 @@ with self;
 
   HTTPMessage = buildPerlPackage {
     pname = "HTTP-Message";
-    version = "6.45";
+    version = "7.02";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Message-6.45.tar.gz";
-      hash = "sha256-AcuEBmEqP3OIQtHpcxOuTYdIcNG41tZjMfFgAJQ9TL4=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Message-7.02.tar.gz";
+      hash = "sha256-eKvvHYMxRrSNF9shmxsD1Ty743oozNrQ79zFgzylxgw=";
     };
     buildInputs = [
       TestNeeds
@@ -17053,8 +17053,11 @@ with self;
     ];
     propagatedBuildInputs = [
       Clone
+      CompressRawBzip2
+      CompressRawZlib
       EncodeLocale
       HTTPDate
+      IOCompress
       IOHTML
       LWPMediaTypes
       URI

From 42b4bd40255c39b30549ef53c5c28854bcdc979d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:23:31 +0200
Subject: [PATCH 30/57] perlPackages.libwwwperl: 6.72 -> 6.83

Fixes CVE-2026-8368. Covers both the libwwwperl and LWP attributes.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 03a06252a45713863ded5d69ef44e0a738281389)
---
 pkgs/top-level/perl-packages.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 69aa8fd91985..0cb6c6e5b7e0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18961,10 +18961,10 @@ with self;
 
   libwwwperl = buildPerlPackage {
     pname = "libwww-perl";
-    version = "6.72";
+    version = "6.83";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.72.tar.gz";
-      hash = "sha256-6bg1T9XiC+IHr+I93VhPzVm/gpmNwHfez2hLodrloF0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.83.tar.gz";
+      hash = "sha256-518PqdPG8Nr1pacvqfixycDSPjqEqFIsy0+DUjK5VQU=";
     };
     buildInputs = [
       HTTPDaemon
@@ -20218,10 +20218,10 @@ with self;
 
   LWP = buildPerlPackage {
     pname = "libwww-perl";
-    version = "6.72";
+    version = "6.83";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.72.tar.gz";
-      hash = "sha256-6bg1T9XiC+IHr+I93VhPzVm/gpmNwHfez2hLodrloF0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.83.tar.gz";
+      hash = "sha256-518PqdPG8Nr1pacvqfixycDSPjqEqFIsy0+DUjK5VQU=";
     };
     propagatedBuildInputs = [
       FileListing

From f5395dd66d93957344b2e60bb535398a6977a2fe Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:45:13 +0000
Subject: [PATCH 31/57] perlPackages.CSSMinifierXS: 0.13 -> 0.15

Fixes CVE-2026-13593.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit f8629eeb4bd1f78b65bad68576a6d560a10f47ce)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0cb6c6e5b7e0..6534e5e0d670 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7969,10 +7969,10 @@ with self;
 
   CSSMinifierXS = buildPerlPackage {
     pname = "CSS-Minifier-XS";
-    version = "0.13";
+    version = "0.15";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.13.tar.gz";
-      hash = "sha256-xBnjCM3IKvHCXWuNB7L/JjR6Yit6Y+wghWq+jbQFH4I=";
+      url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.15.tar.gz";
+      hash = "sha256-iprSIxYtpGceP4EsSlXyl3OUg70xar2kH0wn6K3XhVM=";
     };
     buildInputs = [ TestDiagINC ];
     meta = {

From a5467ee151248992341d7065a77b70e15a3bd9e0 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:47:39 +0000
Subject: [PATCH 32/57] perlPackages.CGISession: 4.48 -> 4.49

Fixes CVE-2026-56016 in CGI::Session::ID::md5. The fix replaces rand()
with Crypt::SysRandom.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 27574bbdf94ffde412ac7343ae367dca5785e4d8)
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6534e5e0d670..4fe2c974d06d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4627,12 +4627,15 @@ with self;
 
   CGISession = buildPerlModule {
     pname = "CGI-Session";
-    version = "4.48";
+    version = "4.49";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.48.tar.gz";
-      hash = "sha256-RnVkYcJM52ZrgQjduW26thJpnfMBLIDvEQFmGf4VVPc=";
+      url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.49.tar.gz";
+      hash = "sha256-X9iKgwo19UUmeH8DauXkp9FLYcQUzSmthjG/RuaXEgc=";
     };
-    propagatedBuildInputs = [ CGI ];
+    propagatedBuildInputs = [
+      CGI
+      CryptSysRandom
+    ];
     meta = {
       description = "Persistent session data in CGI applications";
       license = with lib.licenses; [ artistic1 ];

From 2a6bc9b9d96a5bc37937fa493199c286f79aa2d8 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:48:17 +0000
Subject: [PATCH 33/57] perlPackages.HTMLGumbo: 0.18 -> 0.20

Fixes CVE-2025-15646.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit aa5e047da036ff9e1165a1323e09e49b438537c8)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4fe2c974d06d..3f482acfcb11 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16383,10 +16383,10 @@ with self;
 
   HTMLGumbo = buildPerlModule {
     pname = "HTML-Gumbo";
-    version = "0.18";
+    version = "0.20";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RUZ/HTML-Gumbo-0.18.tar.gz";
-      hash = "sha256-v1C2HCRlbMP8lYYC2AqcfQFyR6842Nv6Dp3sW3VCXV8=";
+      url = "mirror://cpan/authors/id/B/BP/BPS/HTML-Gumbo-0.20.tar.gz";
+      hash = "sha256-ImEK+8bIfgZ92E9/EZo9J4Ie1kEwNFU8Ga694iEdiDU=";
     };
     propagatedBuildInputs = [ AlienLibGumbo ];
     meta = {

From 378f4a92b30d857eaa52668b2c0c95ca70154377 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:49:28 +0000
Subject: [PATCH 34/57] perlPackages.StringUtil: 1.34 -> 1.36

Fixes CVE-2026-14895. Upstream switched from Module::Build to
ExtUtils::MakeMaker in 1.35.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 11acdf3f307c8aa708e62655b7eab4832ac732eb)
---
 pkgs/top-level/perl-packages.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3f482acfcb11..0270b649ae85 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -32180,14 +32180,13 @@ with self;
     };
   };
 
-  StringUtil = buildPerlModule {
+  StringUtil = buildPerlPackage {
     pname = "String-Util";
-    version = "1.34";
+    version = "1.36";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.34.tar.gz";
-      hash = "sha256-MZzozWZTQeVlIfoVXZYqGTKOkNn3A2dlklzN4mclxGk=";
+      url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.36.tar.gz";
+      hash = "sha256-UXsasyVm/U1ei+I9mTOc47/+4pEsX/KfXclYcP9Pyw4=";
     };
-    buildInputs = [ ModuleBuildTiny ];
     meta = {
       description = "String processing utility functions";
       homepage = "https://github.com/scottchiefbaker/String-Util";

From 364774f0c37c16d0bb97d0a0b3b26b1ab701a358 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:51:10 +0000
Subject: [PATCH 35/57] perlPackages.CryptDSA: 1.21 -> 1.24

Fixes CVE-2026-14570. 1.24 uses Crypt::SysRandom and no longer requires
Crypt::URandom.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 079bcf2560f70325dfcf937984fd4ac85f3f7e80)
---
 pkgs/top-level/perl-packages.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0270b649ae85..2aaf4d4dd15b 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7124,16 +7124,15 @@ with self;
 
   CryptDSA = buildPerlPackage {
     pname = "Crypt-DSA";
-    version = "1.21";
+    version = "1.24";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz";
-      hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.24.tar.gz";
+      hash = "sha256-ChY4tvK07+ktbuL0kBzKAtenBWf2uw9Iapu19pvnZ2Y=";
     };
     propagatedBuildInputs = [
       ConvertASN1
       ConvertPEM
       CryptSysRandom
-      CryptURandom
       DataBuffer
       FileWhich
     ];

From def3f6771d02a5b35b6c396b0fd12d407cf8c9d9 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:52:53 +0000
Subject: [PATCH 36/57] perlPackages.DevelDeprecate: init at 0.01

New runtime dependency of Data::Entropy 0.010.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit b3b347504e08b7e453dcf4fe8c58e7fa36a3aeef)
---
 pkgs/top-level/perl-packages.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2aaf4d4dd15b..1900d6c447ba 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9679,6 +9679,24 @@ with self;
     };
   };
 
+  DevelDeprecate = buildPerlPackage {
+    pname = "Devel-Deprecate";
+    version = "0.01";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/O/OV/OVID/Devel-Deprecate-0.01.tar.gz";
+      hash = "sha256-xQLEGoL+JU6XFRJ3ytOk8KQHrTydP2I9J3sDA6PhoS8=";
+    };
+    buildInputs = [ SubOverride ];
+    propagatedBuildInputs = [ DateTime ];
+    meta = {
+      description = "Create deprecation schedules in your code";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   DevelDeprecationsEnvironmental = buildPerlPackage {
     pname = "Devel-Deprecations-Environmental";
     version = "1.101";

From fd630b74c1969791fa32c6ba960e91a7e6d9a3e8 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:54:58 +0000
Subject: [PATCH 37/57] perlPackages.DataEntropy: 0.008 -> 0.010

Fixes CVE-2026-18536. 0.010 removes the Random.org sources, which were
the only consumers of HTTP::Lite, and requires Devel::Deprecate.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 26c50f57329a0da8224b771b36d1aa9f5ee1c015)
---
 pkgs/top-level/perl-packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 1900d6c447ba..74ed3fcfeb35 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8232,16 +8232,16 @@ with self;
 
   DataEntropy = buildPerlPackage {
     pname = "Data-Entropy";
-    version = "0.008";
+    version = "0.010";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.008.tar.gz";
-      hash = "sha256-GKUrE4boLGuM2zhKOYYdYCIKRCp5DgdwEL5y3YU7Z7M=";
+      url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.010.tar.gz";
+      hash = "sha256-0M8s2wKCAuidw2K42Qtw00WFApOwGQDZoYgqDG8g+Dc=";
     };
     propagatedBuildInputs = [
       CryptRijndael
       CryptURandom
       DataFloat
-      HTTPLite
+      DevelDeprecate
       ParamsClassify
     ];
     meta = {

From 1fdb0b868b9695181e36ac774542118b6dbdca8c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:55:50 +0000
Subject: [PATCH 38/57] perlPackages.MojoJWT: 0.09 -> 1.02

Fixes CVE-2026-9537. 1.02 requires CryptX at runtime.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit b2a490b6534095408f0449fcc565f626df639935)
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 74ed3fcfeb35..82d708c62443 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -23234,13 +23234,16 @@ with self;
 
   MojoJWT = buildPerlModule {
     pname = "Mojo-JWT";
-    version = "0.09";
+    version = "1.02";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-0.09.tar.gz";
-      hash = "sha256-wE4DmD4MbyvORdCOoucph5yWee+mNLDmjLa4t7SoWIY=";
+      url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-1.02.tar.gz";
+      hash = "sha256-yBHXkoWMJBFQNyDxJDbjNDZ0k2dUO/vCqV1PgDzmCHQ=";
     };
     buildInputs = [ ModuleBuildTiny ];
-    propagatedBuildInputs = [ Mojolicious ];
+    propagatedBuildInputs = [
+      CryptX
+      Mojolicious
+    ];
     meta = {
       description = "JSON Web Token the Mojo way";
       homepage = "https://github.com/jberger/Mojo-JWT";

From 8824ac460ee9a21f630ef22daf85c651fe9fff8c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:56:26 +0000
Subject: [PATCH 39/57] perlPackages.ack: 3.9.0 -> 3.10.0

Fixes CVE-2026-49146. CVE-2026-49145 and CVE-2026-49147 remain unfixed
in 3.10.0.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 2f2c8475756fe4a204a20a2d400a68a7d911bfb0)
---
 pkgs/top-level/perl-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 82d708c62443..5a9b7cec28a2 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -116,11 +116,11 @@ with self;
 
   ack = buildPerlPackage rec {
     pname = "ack";
-    version = "3.9.0";
+    version = "3.10.0";
 
     src = fetchurl {
       url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v${version}.tar.gz";
-      hash = "sha256-lO1Hfjs/lNEmzscynw6DmfHQzoLHxNiCqUrbFQ5//JA=";
+      hash = "sha256-Zeg8+zinH8pyXpoUqCAe6HHmKfxrECMeEwPdNQG6Vjo=";
     };
 
     outputs = [

From f993762d71a35500bf106a1d5b0d2edbfef4cfe3 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:59:57 +0000
Subject: [PATCH 40/57] perlPackages.HTTPDate: 6.06 -> 6.08

Fixes CVE-2026-14741.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 0d1907cd9fc18179000472f036fff8b23b7ffa42)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 5a9b7cec28a2..8738332ae73f 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16932,10 +16932,10 @@ with self;
 
   HTTPDate = buildPerlPackage {
     pname = "HTTP-Date";
-    version = "6.06";
+    version = "6.08";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.06.tar.gz";
-      hash = "sha256-e2hRkcasw+dz0fwCyV7h+frpT3d4MXX154wYHMktK1I=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.08.tar.gz";
+      hash = "sha256-tX2Aym2CHGlJykiydGfUWrp6nHc0ZWIwb6zKeBoAPkQ=";
     };
     propagatedBuildInputs = [ TimeDate ];
     meta = {

From 57e11a11fea1af058be1063dbd07e9e9688f811e Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 16:38:53 +0000
Subject: [PATCH 41/57] perlPackages.Mojolicious: 9.46 -> 9.48

Fixes CVE-2026-14803 in Mojo::JSON and CVE-2026-15747.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit dda5a5d9a982a1b411fdbdf96afdf364140f49db)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8738332ae73f..0a943dd63d32 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22869,10 +22869,10 @@ with self;
 
   Mojolicious = buildPerlPackage {
     pname = "Mojolicious";
-    version = "9.46";
+    version = "9.48";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz";
-      hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw=";
+      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.48.tar.gz";
+      hash = "sha256-Jv8EFSgR/VsaNrR9mewhnFiZW6jnsVugKzPQdwpe7pg=";
     };
     meta = {
       description = "Real-time web framework";

From f5e9e9b4be0326bcb9daade7543cf31a96bbcc38 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 16:51:31 +0000
Subject: [PATCH 42/57] perlPackages.DBI: 1.648 -> 1.651

Fixes CVE-2026-14380, CVE-2026-14739 and CVE-2026-14740 (1.650), and
CVE-2026-15043, CVE-2026-15392, CVE-2026-60081 and CVE-2026-60082 (1.651).

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit d56e5a7696268bcaa4678acf321a758f9baa3221)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0a943dd63d32..b634f0e3f075 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10137,11 +10137,11 @@ with self;
 
   DBI = buildPerlPackage {
     pname = "DBI";
-    version = "1.648";
+    version = "1.651";
 
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz";
-      hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.651.tgz";
+      hash = "sha256-2mIaI/po4eBPrIJM/T1B6P+6sqs+umQqEkmSQui+UlM=";
     };
 
     env = lib.optionalAttrs stdenv.cc.isGNU {

From 6004c4f5d2c9237baa455e10dcc2a025e2096e08 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 16:56:10 +0000
Subject: [PATCH 43/57] perlPackages.JSONXS: 4.03 -> 4.04

4.04 contains the upstream fix for CVE-2025-40928.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit eb5ca223180217b72d0b28da37f8f41e241ff9bc)
---
 .../perl-modules/JSON-XS-CVE-2025-40928.patch | 31 -------------------
 pkgs/top-level/perl-packages.nix              |  7 ++---
 2 files changed, 3 insertions(+), 35 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch

diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
deleted file mode 100644
index f1d258c12a3d..000000000000
--- a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- a/XS.xs	2025-09-06 08:34:51.376455632 -0300
-+++ b/XS.xs	2025-09-06 08:35:30.725873619 -0300
-@@ -253,16 +253,16 @@
-   // if we recurse too deep, skip all remaining digits
-   // to avoid a stack overflow attack
-   if (expect_false (--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = *s - '0';
- 
-       if (expect_false (dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -282,7 +282,7 @@
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b634f0e3f075..703f003d4e09 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18668,12 +18668,11 @@ with self;
 
   JSONXS = buildPerlPackage {
     pname = "JSON-XS";
-    version = "4.03";
+    version = "4.04";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz";
-      hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg=";
+      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.04.tar.gz";
+      hash = "sha256-jv8enzBMViW1mre0IlhBX20+NoHB3atrclUYoBin9eA=";
     };
-    patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ];
     propagatedBuildInputs = [ TypesSerialiser ];
     buildInputs = [ CanaryStability ];
     meta = {

From 7a77df36a8dbd0b2f079a6f811866362f6f097ca Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 00:51:03 +0000
Subject: [PATCH 44/57] perlPackages.FileFindRule: 0.34 -> 0.35

0.35 contains the upstream fix for CVE-2011-10007.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 61d5a4891aaa93359e2d1105282f84d7f960d10d)
---
 .../FileFindRule-CVE-2011-10007.patch         | 25 -------------------
 pkgs/top-level/perl-packages.nix              |  9 +++----
 2 files changed, 3 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch

diff --git a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch b/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
deleted file mode 100644
index dd8492c60f21..000000000000
--- a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From ca70a73bb147549e62e74751d924b1dbb59d1707 Mon Sep 17 00:00:00 2001
-From: Stig Palmquist <stig@stig.io>
-Date: Thu, 5 Jun 2025 03:45:50 +0200
-Subject: [PATCH] Fix CVE-2011-10007
-
----
- lib/File/Find/Rule.pm | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/File/Find/Rule.pm b/lib/File/Find/Rule.pm
-index feccc76..d4dc475 100644
---- a/lib/File/Find/Rule.pm
-+++ b/lib/File/Find/Rule.pm
-@@ -420,7 +420,7 @@ sub grep {
- 
-     $self->exec( sub {
-         local *FILE;
--        open FILE, $_ or return;
-+        open FILE, '<', $_ or return;
-         local ($_, $.);
-         while (<FILE>) {
-             for my $p (@pattern) {
--- 
-2.49.0
-
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 703f003d4e09..c57e9dba4619 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13638,14 +13638,11 @@ with self;
 
   FileFindRule = buildPerlPackage {
     pname = "File-Find-Rule";
-    version = "0.34";
+    version = "0.35";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.34.tar.gz";
-      hash = "sha256-fm8WzDPrHyn/Jb7lHVE/S4qElHu/oY7bLTzECi1kyv4=";
+      url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.35.tar.gz";
+      hash = "sha256-K9VWKJptRK0u50gDJYuwsAUNJG8egcqrCyY8MDrPDII=";
     };
-    patches = [
-      ../development/perl-modules/FileFindRule-CVE-2011-10007.patch
-    ];
     propagatedBuildInputs = [
       NumberCompare
       TextGlob

From 592db207a643e3d53804848f4822e20a9358a0f3 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 00:56:50 +0000
Subject: [PATCH 45/57] perlPackages.CatalystAuthenticationCredentialHTTP:
 1.018 -> 1.019

1.019 contains the upstream fix for CVE-2025-40920, which uses
Crypt::SysRandom instead of Data::UUID.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit d3a1694c8f48ccce9932b5b10a4c914ff82ec4e5)
---
 pkgs/top-level/perl-packages.nix | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index c57e9dba4619..b04946fe8991 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3352,18 +3352,11 @@ with self;
 
   CatalystAuthenticationCredentialHTTP = buildPerlModule {
     pname = "Catalyst-Authentication-Credential-HTTP";
-    version = "1.018";
+    version = "1.019";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/ET/ETHER/Catalyst-Authentication-Credential-HTTP-1.018.tar.gz";
-      hash = "sha256-b6GBbe5kSw216gzBXF5xHcLO0gg2JavOcJZSHx1lpSk=";
+      url = "mirror://cpan/authors/id/A/AB/ABRAXXA/Catalyst-Authentication-Credential-HTTP-1.019.tar.gz";
+      hash = "sha256-7IHpbCo/ZYbqQdCI6o6AGx80ABqxnMmmXe+KOMOaW9o=";
     };
-    patches = [
-      (fetchpatch {
-        name = "CVE-2025-40920.patch";
-        url = "https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch";
-        hash = "sha256-WI6JwvY6i3KkQO9HbbSvHPX8mgM8I2cF0UTjF1D14T4=";
-      })
-    ];
     buildInputs = [
       ModuleBuildTiny
       TestException
@@ -3374,7 +3367,6 @@ with self;
       CatalystPluginAuthentication
       ClassAccessor
       CryptSysRandom
-      DataUUID
       StringEscape
     ];
     meta = {

From 149fb526e84c8ce912b4af22b93fc2b668c25721 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 02:51:18 +0000
Subject: [PATCH 46/57] perl: 5.42.0 -> 5.42.3

5.42.3 ships the interpreter fixes and the updated dual-life modules, so
the CVE-2026-8376 patch and every vendoredPerlDistributions entry are
dropped.

perl-cross 1.6.4 has no patch set for 5.42.3, so the perl5-5.42.0 set,
which applies unchanged, is vendored under the name perl-cross expects.

- perl: CVE-2026-13221, CVE-2026-57432, CVE-2026-8376
  https://metacpan.org/release/SHAY/perl-5.42.3/view/pod/perldelta.pod

- HTTP-Tiny 0.096: CVE-2026-7010, CVE-2026-7017
  https://metacpan.org/release/HAARG/HTTP-Tiny-0.096/changes

- Socket 2.041: CVE-2026-12087
  https://metacpan.org/release/PEVANS/Socket-2.041/changes

- Storable 3.37_01: CVE-2026-57433

- Archive-Tar 3.12, Compress-Raw-Bzip2 2.218, Compress-Raw-Zlib 2.222,
  IO-Compress 2.223

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 7b1e682245c0c05aae0541b1697b472c7f74d578)
---
 .../interpreters/perl/CVE-2026-8376.patch     | 20 -----
 .../development/interpreters/perl/default.nix |  4 +-
 .../interpreters/perl/interpreter.nix         | 47 +---------
 .../perl/perl-cross-1.6.4--5.42.3.patch       | 86 +++++++++++++++++++
 4 files changed, 91 insertions(+), 66 deletions(-)
 delete mode 100644 pkgs/development/interpreters/perl/CVE-2026-8376.patch
 create mode 100644 pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch

diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
deleted file mode 100644
index c8ad72298178..000000000000
--- a/pkgs/development/interpreters/perl/CVE-2026-8376.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly.
-
-diff --git a/regcomp_study.c b/regcomp_study.c
-index b513454a4258..1602663f4b26 100644
---- a/regcomp_study.c
-+++ b/regcomp_study.c
-@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_
-                                                (U8 *) SvEND(data->last_found))
-                                 - (U8*)s;
-                         l -= old;
-+
-+                        if (l > 0 &&
-+                            (mincount >= SSize_t_MAX / (SSize_t)l
-+                             || old > SSize_t_MAX - mincount * (SSize_t)l)) {
-+                            FAIL("Regexp out of space");
-+                        }
-+
-                         /* Get the added string: */
-                         last_str = newSVpvn_utf8(s  + old, l, UTF);
-                         last_chrs = UTF ? utf8_length((U8*)(s + old),
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index cab0ea1a2268..6cc6f5755ac4 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -73,8 +73,8 @@ in
 rec {
   perl5 = callPackage ./interpreter.nix {
     self = perl5;
-    version = "5.42.0";
-    sha256 = "sha256-4JPvGE1/mhuXl+JGUpb1VRCtttq4hCsMPtUzKWYwltw=";
+    version = "5.42.3";
+    sha256 = "sha256-ETd0CYWDe1zfFfDPq5Miedy0NS+RL+1vwUTotPCCNic=";
     inherit passthruFun;
   };
 }
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index cdb03912b517..4b308c156f02 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -36,8 +36,6 @@ let
   commonPatches = [
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
-
-    ./CVE-2026-8376.patch
   ]
 
   # Fix build on Solaris on x86_64
@@ -83,48 +81,7 @@ let
 
   # Inject fixed CPAN releases for bundled dual-life distributions until the
   # next perl maintenance release includes them.
-  vendoredPerlDistributions = [
-    {
-      # CVE-2026-7010
-      path = "cpan/HTTP-Tiny";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz";
-        hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M=";
-      };
-    }
-    {
-      # CVE-2026-3381, CVE-2026-4176
-      path = "cpan/Compress-Raw-Zlib";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz";
-        hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg=";
-      };
-    }
-    {
-      # Runtime dependency of IO-Compress 2.220.
-      path = "cpan/Compress-Raw-Bzip2";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz";
-        hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g=";
-      };
-    }
-    {
-      # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959
-      path = "cpan/IO-Compress";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
-        hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
-      };
-    }
-    {
-      # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
-      path = "cpan/Archive-Tar";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
-        hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
-      };
-    }
-  ];
+  vendoredPerlDistributions = [ ];
 
   replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: ''
     rm -rf ${d.path}
@@ -440,6 +397,8 @@ stdenv.mkDerivation (
       # fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option
       # https://github.com/arsv/perl-cross/pull/159
       ./cross-fdopendir.patch
+
+      ./perl-cross-1.6.4--5.42.3.patch
     ];
 
     depsBuildBuild = [
diff --git a/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
new file mode 100644
index 000000000000..853fb8a667a2
--- /dev/null
+++ b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
@@ -0,0 +1,86 @@
+perl-cross 1.6.4 ships no patch set for perl 5.42.3. The perl5-5.42.0 set
+applies unchanged, so link it under the name perl-cross looks for. The
+links are per-file because `find cnf/diffs/perl5-$version`, which
+perl-cross uses to collect them, does not descend into a symlinked
+directory.
+
+diff --git a/cnf/diffs/perl5-5.42.3/constant.patch b/cnf/diffs/perl5-5.42.3/constant.patch
+new file mode 120000
+index 0000000..61f792a
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/constant.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/constant.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/dynaloader.patch b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+new file mode 120000
+index 0000000..543415e
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/dynaloader.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/findext.patch b/cnf/diffs/perl5-5.42.3/findext.patch
+new file mode 120000
+index 0000000..94ed668
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/findext.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/findext.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/installscripts.patch b/cnf/diffs/perl5-5.42.3/installscripts.patch
+new file mode 120000
+index 0000000..6f715b4
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/installscripts.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/installscripts.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/liblist.patch b/cnf/diffs/perl5-5.42.3/liblist.patch
+new file mode 120000
+index 0000000..5037380
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/liblist.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/liblist.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/makemaker.patch b/cnf/diffs/perl5-5.42.3/makemaker.patch
+new file mode 120000
+index 0000000..cf9fc6c
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/posix-makefile.patch b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+new file mode 120000
+index 0000000..072ba89
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/posix-makefile.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-checkcase.patch b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+new file mode 120000
+index 0000000..6ecc9bc
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-checkcase.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-makemaker.patch b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+new file mode 120000
+index 0000000..fc6bcda
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/xconfig.patch b/cnf/diffs/perl5-5.42.3/xconfig.patch
+new file mode 120000
+index 0000000..87ac501
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/xconfig.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/xconfig.patch
+\ No newline at end of file

From f700426a5eed7f8b068696e3bf7a98c9a51abfd7 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 05:58:49 +0000
Subject: [PATCH 47/57] perlPackages.Yancy: skip tests broken by Mojolicious
 9.48

Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these
tests drive forms without a token and fail with 400 "CSRF token failure".

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit d4db41d8bfa5e92019bdf43e5a932f600224afef)
---
 pkgs/top-level/perl-packages.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b04946fe8991..60cf3a89f31d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -39609,6 +39609,11 @@ with self;
       MojoliciousPluginOpenAPI
       RoleTiny
     ];
+    # Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these
+    # tests drive forms without a token and fail with 400 "CSRF token failure".
+    preCheck = ''
+      rm t/plugin/auth/github.t t/plugin/form/bootstrap4.t
+    '';
     meta = {
       homepage = "http://preaction.me/yancy/";
       description = "Best Web Framework Deserves the Best CMS";

From 0db31ab897e7cfb87530330abc229b88790b6084 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 18:59:53 +0000
Subject: [PATCH 48/57] perl: fix CVE-2026-15534

Apply upstream commits 568e6fd238867bb9e99fa3f47cba3169009239e0 and
54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 709e8699ab3e17bfdaf02e11cf0e8e2996491360)
---
 .../interpreters/perl/CVE-2026-15534-1.patch  | 39 ++++++++++++
 .../interpreters/perl/CVE-2026-15534-2.patch  | 59 +++++++++++++++++++
 .../interpreters/perl/interpreter.nix         |  3 +
 3 files changed, 101 insertions(+)
 create mode 100644 pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
 create mode 100644 pkgs/development/interpreters/perl/CVE-2026-15534-2.patch

diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
new file mode 100644
index 000000000000..fc8ee2f29ea9
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
@@ -0,0 +1,39 @@
+CVE-2026-15534, upstream commit
+568e6fd238867bb9e99fa3f47cba3169009239e0.
+
+diff --git a/regexec.c b/regexec.c
+index 35a727459c4a..29aa73c13cb9 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9211,7 +9211,8 @@ NULL
+                     reginfo->poscache_iter = reginfo->poscache_maxiter;
+                 }
+ 
+-                if (reginfo->poscache_iter-- == 0) {
++                if (reginfo->poscache_iter == 1) {
++                    reginfo->poscache_iter--;
+                     /* initialise cache */
+                     const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
+                     regmatch_info_aux *const aux = reginfo->info_aux;
+@@ -9232,11 +9233,10 @@ NULL
+                     );
+                 }
+ 
+-                if (reginfo->poscache_iter < 0) {
++                if (reginfo->poscache_iter == 0) {
+                     /* have we already failed at this position? */
+                     SSize_t offset, mask;
+ 
+-                    reginfo->poscache_iter = -1; /* stop eventual underflow */
+                     offset  = (FLAGS(scan) & 0xf) - 1
+                                 +   (locinput - reginfo->strbeg)
+                                   * (FLAGS(scan)>>4);
+@@ -9252,6 +9252,8 @@ NULL
+                     ST.cache_offset = offset;
+                     ST.cache_mask   = mask;
+                 }
++                else
++                    reginfo->poscache_iter--;
+             }
+ 
+             /* Prefer B over A for minimal matching. */
diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
new file mode 100644
index 000000000000..b5d0ff5ed3d0
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
@@ -0,0 +1,59 @@
+CVE-2026-15534, upstream commit
+54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.
+
+diff --git a/regexec.c b/regexec.c
+index 29aa73c13cb9..66e0c0924059 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9202,22 +9202,27 @@ NULL
+                 if (!reginfo->poscache_maxiter) {
+                     /* start the countdown: Postpone detection until we
+                      * know the match is not *that* much linear. */
+-                    reginfo->poscache_maxiter
+-                        =    (reginfo->strend - reginfo->strbeg + 1)
+-                           * (FLAGS(scan)>>4);
+-                    /* possible overflow for long strings and many CURLYX's */
+-                    if (reginfo->poscache_maxiter < 0)
+-                        reginfo->poscache_maxiter = I32_MAX;
+-                    reginfo->poscache_iter = reginfo->poscache_maxiter;
++                    STRLEN len = reginfo->strend - reginfo->strbeg;
++                    /* number of participating WHILEMs */
++                    U8 n = (FLAGS(scan)>>4);
++
++                    /* Only do the calculations and enable the cache if it
++                     * won't overflow. This test is equivalent to:
++                     *    ((len + 1) * n  + 7) <= max(STRLEN)
++                     */
++                    if (len < ((~(STRLEN)0) - 7)/n) {
++                        reginfo->poscache_maxiter = (len + 1) * n;
++                        reginfo->poscache_iter = reginfo->poscache_maxiter;
++                    }
+                 }
+ 
+                 if (reginfo->poscache_iter == 1) {
+                     reginfo->poscache_iter--;
+                     /* initialise cache */
+-                    const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
++                    const STRLEN size = (reginfo->poscache_maxiter + 7)/8;
+                     regmatch_info_aux *const aux = reginfo->info_aux;
+                     if (aux->poscache) {
+-                        if ((SSize_t)reginfo->poscache_size < size) {
++                        if (reginfo->poscache_size < size) {
+                             Renew(aux->poscache, size, char);
+                             reginfo->poscache_size = size;
+                         }
+diff --git a/regexp.h b/regexp.h
+index 057d9ac5011b..d5d40e0a5618 100644
+--- a/regexp.h
++++ b/regexp.h
+@@ -839,8 +839,8 @@ typedef struct {
+     char *cutpoint;      /* (*COMMIT) position (if any) */
+     regmatch_info_aux      *info_aux; /* extra fields that need cleanup */
+     regmatch_info_aux_eval *info_aux_eval; /* extra saved state for (?{}) */
+-    I32  poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
+-    I32  poscache_iter;    /* current countdown from _maxiter to zero */
++    STRLEN poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
++    STRLEN poscache_iter;    /* current countdown from _maxiter to zero */
+     STRLEN poscache_size;  /* size of regmatch_info_aux.poscache */
+     bool intuit;    /* re_intuit_start() is the top-level caller */
+     bool is_utf8_pat;    /* regex is utf8 */
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index 4b308c156f02..ae75db2ead90 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -36,6 +36,9 @@ let
   commonPatches = [
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
+
+    ./CVE-2026-15534-1.patch
+    ./CVE-2026-15534-2.patch
   ]
 
   # Fix build on Solaris on x86_64

From da49bdf5c98bf3af169666755589ffa902724379 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 22:57:43 +0000
Subject: [PATCH 49/57] perlPackages.DBI: 1.651 -> 1.653

Fixes CVE-2026-73193, CVE-2026-73194 and CVE-2026-78030.

Assisted-by: Codex (GPT-6)
(cherry picked from commit 489a75f613fd13643b77e58217512120be1aff5e)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 60cf3a89f31d..87fc7a42efe2 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10129,11 +10129,11 @@ with self;
 
   DBI = buildPerlPackage {
     pname = "DBI";
-    version = "1.651";
+    version = "1.653";
 
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.651.tgz";
-      hash = "sha256-2mIaI/po4eBPrIJM/T1B6P+6sqs+umQqEkmSQui+UlM=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.653.tgz";
+      hash = "sha256-qYwh/Tfu2PhBFyh10XXZcv6H8GPX0NKjt3ZZCLsl61g=";
     };
 
     env = lib.optionalAttrs stdenv.cc.isGNU {

From 148318bfe61b8a8aa3088394aa039eb0439dd529 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:02:07 +0000
Subject: [PATCH 50/57] perlPackages.HTMLFormHandler: 0.40068 -> 0.410002

Fixes CVE-2022-4993, CVE-2026-19872, CVE-2026-85484,
CVE-2026-85485 and CVE-2026-85630.

Assisted-by: Codex (GPT-6)
(cherry picked from commit 9ffd40254c14f0a08bf49eb4ff07527dfa948684)
---
 pkgs/top-level/perl-packages.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 87fc7a42efe2..ddffe9c13a9a 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16350,19 +16350,18 @@ with self;
 
   HTMLFormHandler = buildPerlPackage {
     pname = "HTML-FormHandler";
-    version = "0.40068";
+    version = "0.410002";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GS/GSHANK/HTML-FormHandler-0.40068.tar.gz";
-      hash = "sha256-63t43aMSV1LMi8wDltOXf70o2jPS1ExQQq1tNdbN6Cc=";
+      url = "mirror://cpan/authors/id/A/AB/ABRAXXA/HTML-FormHandler-0.410002.tar.gz";
+      hash = "sha256-wT3n5PLDmV5QR1xilSm2VM+eLGJ73WLifqSMfG1jqeU=";
     };
-    # a single test is failing on perl 5.20
-    doCheck = false;
     buildInputs = [
       FileShareDirInstall
       PadWalker
       TestDifferences
       TestException
       TestMemoryCycle
+      TestNeeds
       TestWarn
     ];
     propagatedBuildInputs = [

From e4a1627c2a581b658e5379179e8ff801ea2e067c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:02:58 +0000
Subject: [PATCH 51/57] perlPackages.NetDNS: 1.56 -> 1.57

Fixes CVE-2026-81928.

Assisted-by: Codex (GPT-6)
(cherry picked from commit c71af76b99b9063b6de90bbc33147ea9cb0afd38)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index ddffe9c13a9a..af21c58b3ab4 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -25683,10 +25683,10 @@ with self;
 
   NetDNS = buildPerlPackage {
     pname = "Net-DNS";
-    version = "1.56";
+    version = "1.57";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/N/NL/NLNETLABS/Net-DNS-1.56.tar.gz";
-      hash = "sha256-WTDjn3aJWzgMfKEfwINS0VrXHEH+hMEt+2oyLRf2aUY=";
+      url = "mirror://cpan/authors/id/N/NL/NLNETLABS/Net-DNS-1.57.tar.gz";
+      hash = "sha256-fJjeMpy11qmau7A6qtKGbLBBCS7Zk2pyRpCOFwAFsFg=";
     };
     propagatedBuildInputs = [ DigestHMAC ];
     makeMakerFlags = [ "--noonline-tests" ];

From 6f13895f8125f0450c11fc0a86c934c8322d729e Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:03:34 +0000
Subject: [PATCH 52/57] perlPackages.ProtocolHTTP2: 1.13 -> 1.14

Fixes CVE-2026-16028.

Assisted-by: Codex (GPT-6)
(cherry picked from commit e27c8da168cb998fce2b106098fc3c1170ad2f4e)
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index af21c58b3ab4..3ffa626191e6 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -29292,10 +29292,10 @@ with self;
 
   ProtocolHTTP2 = buildPerlModule {
     pname = "Protocol-HTTP2";
-    version = "1.13";
+    version = "1.14";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.13.tar.gz";
-      hash = "sha256-LsO0oYpkqGHgKYHO/Y7W8iOHUTj75e/us0DvF5ZVMGI=";
+      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.14.tar.gz";
+      hash = "sha256-pT8n6i+6wVakzUmB2O90nBvvNmwpCRNLTTHaIWRLSW4=";
     };
     buildInputs = [
       AnyEvent

From 824ca0e7c5c74109f841bf6a9d31e9630bbccc3a Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:06:51 +0000
Subject: [PATCH 53/57] perlPackages.CatalystPluginStaticSimple: 0.37 -> 0.38

Fixes CVE-2026-15743.

Refreshes the existing ETag patch for 0.38.

Assisted-by: Codex (GPT-6)
(cherry picked from commit 8d26ff3a4025049a87bcb52fd7eba3e879e0cea0)
---
 .../catalyst-plugin-static-simple-etag.patch  | 27 ++++---------------
 pkgs/top-level/perl-packages.nix              | 15 ++++++++---
 2 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/pkgs/development/perl-modules/catalyst-plugin-static-simple-etag.patch b/pkgs/development/perl-modules/catalyst-plugin-static-simple-etag.patch
index 06207a8b7334..31b21f5cb768 100644
--- a/pkgs/development/perl-modules/catalyst-plugin-static-simple-etag.patch
+++ b/pkgs/development/perl-modules/catalyst-plugin-static-simple-etag.patch
@@ -1,36 +1,19 @@
 Send an ETag header, and honour the If-None-Match request header
 
-diff -ru -x '*~' Catalyst-Plugin-Static-Simple-0.30-orig/lib/Catalyst/Plugin/Static/Simple.pm Catalyst-Plugin-Static-Simple-0.30/lib/Catalyst/Plugin/Static/Simple.pm
---- Catalyst-Plugin-Static-Simple-0.30-orig/lib/Catalyst/Plugin/Static/Simple.pm	2012-05-04 18:49:30.000000000 +0200
-+++ Catalyst-Plugin-Static-Simple-0.30/lib/Catalyst/Plugin/Static/Simple.pm	2013-02-25 22:57:18.667150181 +0100
-@@ -187,16 +187,27 @@
-     my $type      = $c->_ext_to_type( $full_path );
-     my $stat      = stat $full_path;
+--- a/lib/Catalyst/Plugin/Static/Simple.pm
++++ b/lib/Catalyst/Plugin/Static/Simple.pm
+@@ -223,6 +223,15 @@
  
--    $c->res->headers->content_type( $type );
--    $c->res->headers->content_length( $stat->size );
--    $c->res->headers->last_modified( $stat->mtime );
-     # Tell Firefox & friends its OK to cache, even over SSL:
--    $c->res->headers->header('Cache-control' => 'public');
-+    #$c->res->headers->header('Cache-control' => 'public');
-+
-+    $c->res->headers->last_modified( $stat->mtime );
-     # Optionally, set a fixed expiry time:
-     if ($config->{expires}) {
-         $c->res->headers->expires(time() + $config->{expires});
-     }
+     $c->res->headers->header('Cache-Control' => $cache_control);
  
 +    if ($config->{send_etag}) {
-+        my $etag = '"' . $stat->mtime . '-' . $stat->ino . '-'. $stat->size . '"';
++        my $etag = '"' . $stat->mtime . '-' . $stat->ino . '-' . $stat->size . '"';
 +        $c->res->headers->header('ETag' => $etag);
 +        if (($c->req->header('If-None-Match') // "") eq $etag) {
 +            $c->res->status(304);
 +            return 1;
 +        }
 +    }
-+
-+    $c->res->headers->content_type( $type );
-+    $c->res->headers->content_length( $stat->size );
 +
      my $fh = IO::File->new( $full_path, 'r' );
      if ( defined $fh ) {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3ffa626191e6..cf165c7b161a 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4108,12 +4108,19 @@ with self;
 
   CatalystPluginStaticSimple = buildPerlPackage {
     pname = "Catalyst-Plugin-Static-Simple";
-    version = "0.37";
+    version = "0.38";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/I/IL/ILMARI/Catalyst-Plugin-Static-Simple-0.37.tar.gz";
-      hash = "sha256-Wk2Fo1iM1Og/GwAlgUEufXG31X9mBW5dh6Nvk9icnnw=";
+      url = "mirror://cpan/authors/id/E/ET/ETHER/Catalyst-Plugin-Static-Simple-0.38.tar.gz";
+      hash = "sha256-BOtn69x4cyf3fvLHOXar7Pk/mu/KCnGFIv6YuMpSOLA=";
     };
-    patches = [ ../development/perl-modules/catalyst-plugin-static-simple-etag.patch ];
+    patches = [
+      (fetchpatch {
+        url = "https://security.metacpan.org/patches/C/Catalyst-Plugin-Static-Simple/0.38/CVE-2026-15743-r1.patch";
+        hash = "sha256-dNJOz7X7i03kisrf+lhqAaL6lYeTlt1NJZnJWNM7bgQ=";
+      })
+      ../development/perl-modules/catalyst-plugin-static-simple-etag.patch
+    ];
+    postPatch = "rm -f lib/Catalyst/Plugin/Static/Simple.pm.orig";
     propagatedBuildInputs = [
       CatalystRuntime
       MIMETypes

From baa8915bed76d98a9ee4c8aaf19819d7471f98c4 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:12:45 +0000
Subject: [PATCH 54/57] perlPackages.HTMLFormFu: fix CVE-2026-19873

Assisted-by: Codex (GPT-6)
(cherry picked from commit c2c93af85319583946edd86b77dcae616c2a2bca)
---
 pkgs/top-level/perl-packages.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index cf165c7b161a..3c8a22d1f34e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16296,6 +16296,12 @@ with self;
       url = "mirror://cpan/authors/id/C/CF/CFRANKS/HTML-FormFu-2.07.tar.gz";
       hash = "sha256-Ty8Bf3qHVPu26RIGyI7RPHVqFOO+oXgYjDuXdGNm6zI=";
     };
+    patches = [
+      (fetchpatch {
+        url = "https://security.metacpan.org/patches/H/HTML-FormFu/2.08/CVE-2026-19873-r1.patch";
+        hash = "sha256-1QquxDl/NuNJe6MFbeEH49hYA8agXXeWm1Q23fOM+Nc=";
+      })
+    ];
     buildInputs = [
       CGI
       FileShareDirInstall

From 90f960fa33b8a76c8fd3724a93153b0160161edb Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:15:48 +0000
Subject: [PATCH 55/57] perlPackages.CryptURandomMonkeyPatch: init at 0.1.4

Assisted-by: Codex (GPT-6)
(cherry picked from commit da210312f7c8df3b1bd0ffe121fde2900abcf392)
---
 pkgs/top-level/perl-packages.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3c8a22d1f34e..8cec4266417d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7562,6 +7562,21 @@ with self;
     };
   };
 
+  CryptURandomMonkeyPatch = buildPerlPackage {
+    pname = "Crypt-URandom-MonkeyPatch";
+    version = "0.1.4";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/R/RR/RRWO/Crypt-URandom-MonkeyPatch-v0.1.4.tar.gz";
+      hash = "sha256-eydufcxL7TnZW/+dnTemlTkycVaPTarMrFBowLQcKsk=";
+    };
+    buildInputs = [ TestOutput ];
+    propagatedBuildInputs = [ CryptURandom ];
+    meta = {
+      description = "Override core rand function to use system random sources";
+      license = lib.licenses.artistic2;
+    };
+  };
+
   CryptScryptKDF = buildPerlModule {
     pname = "Crypt-ScryptKDF";
     version = "0.011";

From 13e02ee4638dec752b752dc9af45566b81907036 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:17:28 +0000
Subject: [PATCH 56/57] perlPackages.GDSecurityImage: fix CVE-2026-13082

Assisted-by: Codex (GPT-6)
(cherry picked from commit ab5e75490032e8eb4d943f69ae90fbf5f35d4c27)
---
 pkgs/top-level/perl-packages.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8cec4266417d..2a2e4fa3cb30 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -14911,7 +14911,16 @@ with self;
       url = "mirror://cpan/authors/id/B/BU/BURAK/GD-SecurityImage-1.75.tar.gz";
       hash = "sha256-Pd4k2ay6lRzd5bVp0eQsrZRs/bUSgORGnzNv1f4MjqY=";
     };
-    propagatedBuildInputs = [ GD ];
+    patches = [
+      (fetchpatch {
+        url = "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch";
+        hash = "sha256-xIMPQD2JYuHdsYnW1ojqG3xgV7VWEKyJ6sEqNRUdNdQ=";
+      })
+    ];
+    propagatedBuildInputs = [
+      CryptURandomMonkeyPatch
+      GD
+    ];
     meta = {
       description = "Security image (captcha) generator";
       license = with lib.licenses; [

From 80044e238072a0e70387d1c5b5be0504ca0d6ba2 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Tue, 15 Sep 2026 01:15:08 +0000
Subject: [PATCH 57/57] perlPackages.Imager: 1.034 -> 1.035

Fixes CVE-2026-73639.

Drops two CVE-2026-73638 patches included in 1.035.

Assisted-by: Codex (GPT-6)
(cherry picked from commit 3629b02a8aa90b24c7b918d6188ccaafb7ba8b21)
---
 pkgs/top-level/perl-packages.nix | 19 ++-----------------
 1 file changed, 2 insertions(+), 17 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2a2e4fa3cb30..536ab009195e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17387,26 +17387,11 @@ with self;
 
   Imager = buildPerlPackage rec {
     pname = "Imager";
-    version = "1.034";
+    version = "1.035";
     src = fetchurl {
       url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
-      hash = "sha256-hrWizXGna4QJJJFSGl1WI4Qo8sN1AYMsmVxaMxJg+AM=";
+      hash = "sha256-W6BYrMmLtb+QK6/XTNKwepS7GVrmYWxEC1RwFIBv6xc=";
     };
-    # Remove when updating to the first release containing both fixes.
-    patches = [
-      (fetchpatch2 {
-        name = "fix-32-bit-exif-ifd-offset-checks.patch";
-        url = "https://github.com/tonycoz/imager/commit/48ba8ac0749f89466b6e6681fb88cbdb51086ebd.patch?full_index=1";
-        includes = [ "imexif.c" ];
-        hash = "sha256-rpUeTsgSkCdzJsy3Ny0rU+KNL6xkSosfkDqzFb813Wo=";
-      })
-      (fetchpatch2 {
-        name = "fix-32-bit-exif-limit-checks.patch";
-        url = "https://github.com/tonycoz/imager/commit/6f1fd003a8e48c7e6e58b7019a04cc71bbfec2c3.patch?full_index=1";
-        includes = [ "imexif.c" ];
-        hash = "sha256-Ct7T/JHuxAIAjjuzoUhdAPlp0qPYKRQQqejsrcGXPko=";
-      })
-    ];
     buildInputs = [
       pkgs.freetype
       pkgs.fontconfig