On Tue, Aug 18, 2026 at 11:18:37PM +0200, Alexander Bluhm wrote:
> On Tue, Aug 18, 2026 at 01:05:10PM -0700, Andrew Hewus Fresh wrote:
> > On Tue, Aug 18, 2026 at 09:49:38PM +0200, Alexander Bluhm wrote:
> > > Do we have to bump libperl.so to force rebuild and install of the
> > > XS modules from packages?
> > 
> > Yes, but perl minor updates are supposed to be binary compatible, so I'm
> > not sure we're supposed to need to.
> > 
> > Bumps are cheap though, so can if you like.
> 
> The bump prevents installing XS modules until packages are rebuilt.
> 
> > I guess I should double check that, I don't recall if I did this time.
> 
> No significant header in this patch.  Bit you previous CVE-2026-15534
> commit contained a struct change in regexp.h.  It installs in
> /usr/libdata/perl5/amd64-openbsd/CORE/regexp.h
> 
> https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb
> 
> So the Perl update itself looks safe, but maybe we bump anyway to
> rebuild after the CVE commit and the update.

Will do.  I did notice this email after, but for some reason the patches
were fighting me to apply which apparently meant I didn't actually think
enough about that side effect.

https://www.nntp.perl.org/group/perl.perl5.porters/2026/08/msg271140.html