Jason A. Crome

Dancer2 2.2.1 is now on CPAN. This is a security release; upgrading is recommended.

Dancer2::Serializer::YAML handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class could therefore instantiate an arbitrary blessed object, and !!perl/code could ask for a string eval. Both are now refused explicitly rather than left to YAML.pm's defaults.

Note that you can be exposed without having configured YAML yourself: Serializer::Mutable maps both text/x-yaml and text/html to this serializer.

Two packaging notes for this release: the minimum YAML version is now 1.30, and Dancer2 now declares the minimum CLI::Osprey it needs (0.09).

Thanks to David Precious for the YAML work.

We have just released Dancer2 2.2.0. It is a maintenance release containing a number of bug fixes, several important security updates, and one breaking change (see below).

First and foremost, please read the following security announcements; if you are running affected versions of Dancer2, you should plan to update immediately:

• GHSA-6xw8-v24c-m783 (Severity: High; Versions affected: <= 2.1.0)
• GHSA-v527-r4px-7vx7 (Severity: Moderate; Versions affected: >= 2.0.0, <= 2.1.0)

A recap of all changes follows.

Security fixes

• Path traversal in static file serving. Dancer2::Handler::File could serve files from outside public_dir. (GHSA-6xw8-v24c-m783)
• Hook exception handling. If an on_hook_exception handler halted, the route that the hook refused could still run. (GHSA-v527-r4px-7vx7)
• Header injection. CR and LF are now stripped from response header names, as they already were from header values.
• AutoPage no longer serves a layout as a page on case-insensitive filesystems.
• Session IDs are now always generated with Crypt::URandom, and validate_id rejects invalid session IDs more strictly.

Breaking changes

• The Data::Dumper serializer has been removed from core, along with the from_dumper and to_dumper keywords. If your app uses them, make sure to download Dancer2::Serializer::Dumper from CPAN.

Bug fixes

• send_file now sends the correct error codes.
• The path() and dirname() DSL keywords no longer drop their first argument.
• Serializer::JSON handles UTF-8 correctly for readonly values and no longer recurses endlessly into blessed objects.
• Serializer::Mutable ignores content type parameters such as charset when choosing a format.
• Each response content assignment is now encoded, not just the first.
• uri_for_route accepts a route parameter of 0 and gives a clearer error for an empty one.
• Hooks are compiled only once, however many times to_app is called.
• A NUL byte in a static file request no longer produces a warning on every request.
• App root directory detection has been fixed.
• Several dancer2 gen fixes:
  • -g and -r no longer die after writing the app.
  • The app directory is named after the dashed distribution name.
  • The pattern added to MANIFEST.SKIP is relative and matches correctly.

Documentation

• The header precedence documented for Serializer::Mutable now matches what it actually does.
• %D has been removed from the documented log_format characters, since it was never implemented.

Thanks

Thanks to everyone who contributed to this release, especially:

• Anton Lundin, for fixing the error codes in send_file
• Mike Weisenborn, for the path()/dirname() fix
• Curtis "Ovid" Poe, for surfacing many of these issues with PAAD
• David Precious (bigpresh) and Russell Jenkins (veryrusty) for running with these items and seeing them through to completion

Cheers,

Jason/CromeDome

We're thrilled to announce the release of Dancer2 2.1.0! This release represents a major investment in the health and quality of the project. We've gone deep into the issue tracker and PR backlog, closing out some of our oldest open issues — some dating back years — and significantly grooming both the issue and pull request queues. A big thank you to everyone who contributed.

Bug Fixes

This release addresses a number of long-standing issues:

• UTF-8 handling improvements: to_json no longer double-encodes UTF-8 (#686), the charset config option is now properly respected (#1124), and UTF-8 in URLs is handled correctly (#1143). To the best of our knowledge, this release fixes all known UTF-8 issues. The default charset for Dancer2 apps is now UTF-8 rather than undefined. You can set an empty charset for your app if needed.
• Case-insensitive system confusion has been resolved (#863).
• Plugin DSL keywords are now app-specific (#1449, #1630), preventing cross-application bleed in multi-app setups.
• Test suite fixes: Resolved content_type errors in t/dsl/send_file.t (#1772), JSON warnings in t/dsl/send_as.t (#1773), and void warnings in t/hooks.t (#1774).
• Windows compatibility: File uploads are now properly unlinked on Windows (#1777).

Enhancements

• Strict config mode (#763): Dancer2 can now warn on unknown config keys, with an opt-out available. New apps scaffolded with dancer2 gen will have strict config enabled by default.
• Path::Tiny migration (#1264): Internal path handling has moved to Path::Tiny for cleaner, more reliable file operations.
• Unicode::UTF8 support (#1594): When Unicode::UTF8 is available, Dancer2 will use it for faster encoding/decoding.
• Batch session cookie access (#1073): Retrieve multiple session cookie values at once with the clear method.
• Fully qualified engine namespaces (#1323): All engines now accept fully qualified package names.
• Double server header fix (#1664): Dancer2 no longer sends duplicate Server headers.
• Improved send_as (#1709): send_as now uses the full serializer pipeline, including hooks.
• Dispatching improvements (PR #1757): Removed the deprecated api_version and improved the dispatching loop.
• MIME ownership (PR #1758): MIME type handling has been moved to the app level.
• Package name in logger output (PR #1780): Logger output can now include the calling package name, making multi-module debugging easier.

Documentation

• Better documentation for the views setting behavior (#1431).
• Fixed broken links in the manual and tutorial (PR #1749, #1750).
• Improved config documentation structure (PR #1753).
• Removed the stale logger keyword from the DSL docs (PR #1762).

Security

• The "Powered by..." text has been removed from the default error page (PR #1776). Security researchers flagged this as an information disclosure concern — advertising the framework and version in error responses gives potential attackers a head start. The default error page is now clean of framework identifiers.

Thank You

Thanks to all who contributed to this release: Sawyer X, Russell Jenkins, Mikko Koivunalho, Gil Magno, and Sorin Pop.

You can install or upgrade via CPAN:

cpanm Dancer2

Happy Dancing!

Jason/CromeDome

Dancer2 2.0.1 has been released. It's a small maintenance release that fixes a few broken documentation links.

Enjoy, and keep Dancing!

Jason / CromeDome

At long last - Dancer2 2.0.0!

I apologize it took longer than expected - open source doesn't always move as fast as we'd like it to - but there's a lot of great things in this release that make it worth the wait.

Head on over to Perl.com to check out the details. Here's a quick summary of what's new:

• New documentation, courtesy of a grant from the Perl and Raku Foundation
• Extendable config system, thanks to Mikko Koivunalho
• Removed Dancer2::Template::Simple from core Dancer2
• Retired our fork of Template::Tiny, and integrated our changes into the core distribution (thanks, @ether!)
• Configurable data/secrets censoring with Data::Censor
• Logging of hooks as they are executed
• New hook: on_hook_exception
• CLI improvements:
  • Changes that allow for scaffolding of other things (plugins, etc.) in future Dancer2 releases
  • Scaffolding of tutorial app

We're really excited for this release, and we hope you are too!

Keep Dancing!

Jason/CromeDome