Jason A. Crome

Dancer2 2.2.1 is now on CPAN. This is a security release; upgrading is recommended.

Dancer2::Serializer::YAML handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class could therefore instantiate an arbitrary blessed object, and !!perl/code could ask for a string eval. Both are now refused explicitly rather than left to YAML.pm's defaults.

Note that you can be exposed without having configured YAML yourself: Serializer::Mutable maps both text/x-yaml and text/html to this serializer.

Two packaging notes for this release: the minimum YAML version is now 1.30, and Dancer2 now declares the minimum CLI::Osprey it needs (0.09).

Thanks to David Precious for the YAML work.