From d4db41d8bfa5e92019bdf43e5a932f600224afef Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sun, 9 Aug 2026 05:58:49 +0000 Subject: [PATCH] perlPackages.Yancy: skip tests broken by Mojolicious 9.48 Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these tests drive forms without a token and fail with 400 "CSRF token failure". Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index a7b34c72bba8..918a76d21803 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -39604,6 +39604,11 @@ with self; MojoliciousPluginOpenAPI RoleTiny ]; + # Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these + # tests drive forms without a token and fail with 400 "CSRF token failure". + preCheck = '' + rm t/plugin/auth/github.t t/plugin/form/bootstrap4.t + ''; meta = { homepage = "http://preaction.me/yancy/"; description = "Best Web Framework Deserves the Best CMS";