perlPackages.CpanelJSONXS: 4.37 -> 4.42

Fixes CVE-2026-9334, CVE-2026-9516. Supersedes the in-tree CVE-2025-40929 patch.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit 66e7adfa8f)

pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch

@@ -1,47 +0,0 @@
-From 5592bfb58eb8d1c8a644e67c9bba795d1384a995 Mon Sep 17 00:00:00 2001
-From: Marc Lehmann <schmorp@schmorp.de>
-Date: Sat, 6 Sep 2025 11:31:36 +0200
-Subject: [PATCH 1/2] fix json_atof_scan1 overflows
-
-with fuzzed overlong numbers. CVE-2025-40928
-Really the comparisons were wrong.
----
- XS.xs | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/XS.xs b/XS.xs
-index 9b1ce2b..94ab0d6 100755
---- a/XS.xs
-+++ b/XS.xs
-@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-   /* if we recurse too deep, skip all remaining digits */
-   /* to avoid a stack overflow attack */
-   if (UNLIKELY(--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = (U8)(*s - '0');
- 
-       if (UNLIKELY(dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
--- 
-2.50.1
-

pkgs/top-level/perl-packages.nix

@@ -6691,12 +6691,11 @@ with self;
 
   CpanelJSONXS = buildPerlPackage {
     pname = "Cpanel-JSON-XS";
-    version = "4.37";
+    version = "4.42";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.37.tar.gz";
-      hash = "sha256-wkFhWg4X/3Raqoa79Gam4pzSQFFeZfBqegUBe2GebUs=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.42.tar.gz";
+      hash = "sha256-4awvqx46bS2ZjTRAxgAGc2W9x9vwyPKyBZy85LTIMXM=";
     };
-    patches = [ ../development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch ];
     meta = {
       description = "CPanel fork of JSON::XS, fast and correct serializing";
       license = with lib.licenses; [