On Tue, Aug 18, 2026 at 01:05:10PM -0700, Andrew Hewus Fresh wrote:
> On Tue, Aug 18, 2026 at 09:49:38PM +0200, Alexander Bluhm wrote:
> > On Mon, Aug 17, 2026 at 05:23:38PM -0700, Andrew Hewus Fresh wrote:
> > > I'd like to bring perl up to date with upstream 5.42.3 plus local
> > > patches.
> > > 
> > > I already committed the CVE fixes that were the main part of this perl
> > > update, so there are only a couple small additions to Archive::Tar,
> > > Compress::Raw::Bzip2, IO::Compress, and all the docs that go along with
> > > a perl update.
> > > 
> > > The patch is here:
> > > 
> > > https://cvs.afresh1.com/~andrew/perl-update/OpenBSD-perl-5.42.3.patch
> > > 
> > > Comments, OK?
> > 
> > I have successfully installed Perl v5.42.3 on my laptop.
> 
> Yay!
> 
> 
> > Do we have to bump libperl.so to force rebuild and install of the
> > XS modules from packages?
> 
> Yes, but perl minor updates are supposed to be binary compatible, so I'm
> not sure we're supposed to need to.
> 
> Bumps are cheap though, so can if you like.

The bump prevents installing XS modules until packages are rebuilt.

> I guess I should double check that, I don't recall if I did this time.

No significant header in this patch.  Bit you previous CVE-2026-15534
commit contained a struct change in regexp.h.  It installs in
/usr/libdata/perl5/amd64-openbsd/CORE/regexp.h

https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb

So the Perl update itself looks safe, but maybe we bump anyway to
rebuild after the CVE commit and the update.

bluhm