Jason A. Crome

(yes, that's a lot of twos!)

Dancer2 2.2.2 is now headed to CPAN. This is a small bug fix release.

Bug Fixes

• Fixed a crash when using class-method serializers (GH #1837)
• Fixed test failures in gen.t affecting CPAN Testers and Debian builds (GH #1843)

Documentation

• Updated a contributor's name in the documentation (PR #1844)

There are no security fixes, enhancements, or deprecations in this release.

Thanks to David Precious and Nova Patch for their contributions.

As always, bug reports and pull requests are welcome on GitHub.

Jason, on behalf of the Dancer Core Team

Dancer2 2.2.1 is now on CPAN. This is a security release; upgrading is recommended.

Dancer2::Serializer::YAML handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class could therefore instantiate an arbitrary blessed object, and !!perl/code could ask for a string eval. Both are now refused explicitly rather than left to YAML.pm's defaults.

Note that you can be exposed without having configured YAML yourself: Serializer::Mutable maps both text/x-yaml and text/html to this serializer.

Two packaging notes for this release: the minimum YAML version is now 1.30, and Dancer2 now declares the minimum CLI::Osprey it needs (0.09).

Thanks to David Precious for the YAML work.

We have just released Dancer2 2.2.0. It is a maintenance release containing a number of bug fixes, several important security updates, and one breaking change (see below).

First and foremost, please read the following security announcements; if you are running affected versions of Dancer2, you should plan to update immediately:

• GHSA-6xw8-v24c-m783 (Severity: High; Versions affected: <= 2.1.0)
• GHSA-v527-r4px-7vx7 (Severity: Moderate; Versions affected: >= 2.0.0, <= 2.1.0)

A recap of all changes follows.

Security fixes

• Path traversal in static file serving. Dancer2::Handler::File could serve files from outside public_dir. (GHSA-6xw8-v24c-m783)
• Hook exception handling. If an on_hook_exception handler halted, the route that the hook refused could still run. (GHSA-v527-r4px-7vx7)
• Header injection. CR and LF are now stripped from response header names, as they already were from header values.
• AutoPage no longer serves a layout as a page on case-insensitive filesystems.
• Session IDs are now always generated with Crypt::URandom, and validate_id rejects invalid session IDs more strictly.

Breaking changes

• The Data::Dumper serializer has been removed from core, along with the from_dumper and to_dumper keywords. If your app uses them, make sure to download Dancer2::Serializer::Dumper from CPAN.

Bug fixes

• send_file now sends the correct error codes.
• The path() and dirname() DSL keywords no longer drop their first argument.
• Serializer::JSON handles UTF-8 correctly for readonly values and no longer recurses endlessly into blessed objects.
• Serializer::Mutable ignores content type parameters such as charset when choosing a format.
• Each response content assignment is now encoded, not just the first.
• uri_for_route accepts a route parameter of 0 and gives a clearer error for an empty one.
• Hooks are compiled only once, however many times to_app is called.
• A NUL byte in a static file request no longer produces a warning on every request.
• App root directory detection has been fixed.
• Several dancer2 gen fixes:
  • -g and -r no longer die after writing the app.
  • The app directory is named after the dashed distribution name.
  • The pattern added to MANIFEST.SKIP is relative and matches correctly.

Documentation

• The header precedence documented for Serializer::Mutable now matches what it actually does.
• %D has been removed from the documented log_format characters, since it was never implemented.

Thanks

Thanks to everyone who contributed to this release, especially:

• Anton Lundin, for fixing the error codes in send_file
• Mike Weisenborn, for the path()/dirname() fix
• Curtis "Ovid" Poe, for surfacing many of these issues with PAAD
• David Precious (bigpresh) and Russell Jenkins (veryrusty) for running with these items and seeing them through to completion

Cheers,

Jason/CromeDome

We're thrilled to announce the release of Dancer2 2.1.0! This release represents a major investment in the health and quality of the project. We've gone deep into the issue tracker and PR backlog, closing out some of our oldest open issues — some dating back years — and significantly grooming both the issue and pull request queues. A big thank you to everyone who contributed.

Bug Fixes

This release addresses a number of long-standing issues:

• UTF-8 handling improvements: to_json no longer double-encodes UTF-8 (#686), the charset config option is now properly respected (#1124), and UTF-8 in URLs is handled correctly (#1143). To the best of our knowledge, this release fixes all known UTF-8 issues. The default charset for Dancer2 apps is now UTF-8 rather than undefined. You can set an empty charset for your app if needed.
• Case-insensitive system confusion has been resolved (#863).
• Plugin DSL keywords are now app-specific (#1449, #1630), preventing cross-application bleed in multi-app setups.
• Test suite fixes: Resolved content_type errors in t/dsl/send_file.t (#1772), JSON warnings in t/dsl/send_as.t (#1773), and void warnings in t/hooks.t (#1774).
• Windows compatibility: File uploads are now properly unlinked on Windows (#1777).

Enhancements

• Strict config mode (#763): Dancer2 can now warn on unknown config keys, with an opt-out available. New apps scaffolded with dancer2 gen will have strict config enabled by default.
• Path::Tiny migration (#1264): Internal path handling has moved to Path::Tiny for cleaner, more reliable file operations.
• Unicode::UTF8 support (#1594): When Unicode::UTF8 is available, Dancer2 will use it for faster encoding/decoding.
• Batch session cookie access (#1073): Retrieve multiple session cookie values at once with the clear method.
• Fully qualified engine namespaces (#1323): All engines now accept fully qualified package names.
• Double server header fix (#1664): Dancer2 no longer sends duplicate Server headers.
• Improved send_as (#1709): send_as now uses the full serializer pipeline, including hooks.
• Dispatching improvements (PR #1757): Removed the deprecated api_version and improved the dispatching loop.
• MIME ownership (PR #1758): MIME type handling has been moved to the app level.
• Package name in logger output (PR #1780): Logger output can now include the calling package name, making multi-module debugging easier.

Documentation

• Better documentation for the views setting behavior (#1431).
• Fixed broken links in the manual and tutorial (PR #1749, #1750).
• Improved config documentation structure (PR #1753).
• Removed the stale logger keyword from the DSL docs (PR #1762).

Security

• The "Powered by..." text has been removed from the default error page (PR #1776). Security researchers flagged this as an information disclosure concern — advertising the framework and version in error responses gives potential attackers a head start. The default error page is now clean of framework identifiers.

Thank You

Thanks to all who contributed to this release: Sawyer X, Russell Jenkins, Mikko Koivunalho, Gil Magno, and Sorin Pop.

You can install or upgrade via CPAN:

cpanm Dancer2

Happy Dancing!

Jason/CromeDome

Dancer2 2.0.1 has been released. It's a small maintenance release that fixes a few broken documentation links.

Enjoy, and keep Dancing!

Jason / CromeDome