(yes, that's a lot of twos!)

Dancer2 2.2.2 is now headed to CPAN. This is a small bug fix release.

Bug Fixes

• Fixed a crash when using class-method serializers (GH #1837)
• Fixed test failures in gen.t affecting CPAN Testers and Debian builds (GH #1843)

Documentation

• Updated a contributor's name in the documentation (PR #1844)

There are no security fixes, enhancements, or deprecations in this release.

Thanks to David Precious and Nova Patch for their contributions.

As always, bug reports and pull requests are welcome on GitHub.

Jason, on behalf of the Dancer Core Team

Dancer2 2.2.1 is now on CPAN. This is a security release; upgrading is recommended.

Dancer2::Serializer::YAML handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class could therefore instantiate an arbitrary blessed object, and !!perl/code could ask for a string eval. Both are now refused explicitly rather than left to YAML.pm's defaults.

Note that you can be exposed without having configured YAML yourself: Serializer::Mutable maps both text/x-yaml and text/html to this serializer.

Two packaging notes for this release: the minimum YAML version is now 1.30, and Dancer2 now declares the minimum CLI::Osprey it needs (0.09).

Thanks to David Precious for the YAML work.

We have just released Dancer2 2.2.0. It is a maintenance release containing a number of bug fixes, several important security updates, and one breaking change (see below).

First and foremost, please read the following security announcements; if you are running affected versions of Dancer2, you should plan to update immediately:

• GHSA-6xw8-v24c-m783 (Severity: High; Versions affected: <= 2.1.0)
• GHSA-v527-r4px-7vx7 (Severity: Moderate; Versions affected: >= 2.0.0, <= 2.1.0)

A recap of all changes follows.

Security fixes

• Path traversal in static file serving. Dancer2::Handler::File could serve files from outside public_dir. (GHSA-6xw8-v24c-m783)
• Hook exception handling. If an on_hook_exception handler halted, the route that the hook refused could still run. (GHSA-v527-r4px-7vx7)
• Header injection. CR and LF are now stripped from response header names, as they already were from header values.
• AutoPage no longer serves a layout as a page on case-insensitive filesystems.
• Session IDs are now always generated with Crypt::URandom, and validate_id rejects invalid session IDs more strictly.

Breaking changes

• The Data::Dumper serializer has been removed from core, along with the from_dumper and to_dumper keywords. If your app uses them, make sure to download Dancer2::Serializer::Dumper from CPAN.

Bug fixes

• send_file now sends the correct error codes.
• The path() and dirname() DSL keywords no longer drop their first argument.
• Serializer::JSON handles UTF-8 correctly for readonly values and no longer recurses endlessly into blessed objects.
• Serializer::Mutable ignores content type parameters such as charset when choosing a format.
• Each response content assignment is now encoded, not just the first.
• uri_for_route accepts a route parameter of 0 and gives a clearer error for an empty one.
• Hooks are compiled only once, however many times to_app is called.
• A NUL byte in a static file request no longer produces a warning on every request.
• App root directory detection has been fixed.
• Several dancer2 gen fixes:
  • -g and -r no longer die after writing the app.
  • The app directory is named after the dashed distribution name.
  • The pattern added to MANIFEST.SKIP is relative and matches correctly.

Documentation

• The header precedence documented for Serializer::Mutable now matches what it actually does.
• %D has been removed from the documented log_format characters, since it was never implemented.

Thanks

Thanks to everyone who contributed to this release, especially:

• Anton Lundin, for fixing the error codes in send_file
• Mike Weisenborn, for the path()/dirname() fix
• Curtis "Ovid" Poe, for surfacing many of these issues with PAAD
• David Precious (bigpresh) and Russell Jenkins (veryrusty) for running with these items and seeing them through to completion

Cheers,

Jason/CromeDome