perl5440delta - Man Page

what is new for perl v5.44.0

Description

This document describes differences between the 5.42.0 release and the 5.44.0 release.

Core Enhancements

Named Parameters in Signatures

This adds a major new ability to subroutine signatures, allowing callers to pass parameters by name/value pairs rather than by position.

    sub f ($x, $y, :$alpha, :$beta = undef) { ... }

    f( 123, 456, alpha => 789 );

Originally specified in PPC0024 <https://github.com/Perl/PPCs/blob/main/ppcs/ppc0024-signature-named-parameters.md>.

This feature is currently considered experimental, and is described in further detail in "Signatures" in perlsub.

Multi-variable foreach can now use aliased references

Perl version 5.22 introduced reference aliases, allowing a foreach loop iteration variable to create new aliases to references. Perl version 5.36 introduced foreach loops with multiple variables, consuming more than one input list item on each iteration. New in this version, the two features may now be used together, allowing multiple iteration variables where any of them are permitted to be reference aliases.

    use v5.44;
    use feature qw( refaliasing declared_refs );

    my %hash = (
        one => [1],
        two => [2, 2],
    );

    foreach my ( $key, \@items ) ( %hash ) {
        say "The $key array contains: @items";
    }

Currently both the refaliasing and declared_refs features remain experimental.

Enhanced operation of regular expression patterns under /xx

Experimentally, the /xx pattern modifier can allow bracketed character classes (e.g., [a-zA-Z] to extend across multiple lines and to contain comments, and to warn you of potential cases where a portion of a pattern inadvertently has been treated as a comment instead of what you intended.  This behavior is enabled by use feature "enhanced_xx".  See "/x and  /xx" in perlre.

Unicode 17.0 is supported

See <https://www.unicode.org/versions/Unicode17.0.0/>.

New source of entropy for PRNG seeding

Perl now uses the getentropy() system call to fetch random bytes suitable for seeding the internal PRNG. Previously Perl would read raw bytes from the /dev/urandom device. Perl now seeds itself in this order (and falls through upon failure):

  1. getentropy() on systems that support this call (Linux, BSD, MacOS)
  2. /dev/urandom on systems that have it
  3. Hash of internal state variables: Unix time, process ID, and pointer value

Note that the internal PRNG is still unsuitable for security applications. See "rand EXPR" in perlfunc for a discussion of security.

Security

CVE-2026-8376 - Buffer overflow in Perl_study_chunk

Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. On 32-bit builds, this can lead to an integer overflow of the size of the buffer leading to out-of-bounds writes.

CVE-2026-57432 - Buffer overflow in S_measure_struct

If you call pack or unpack to operate on a structure whose computed size is too large to fit in memory, an integer overflow could happen that would result in a buffer overflow. This usually happens as a result of embedding a large number as the repeat count for an item.

CVE-2026-13221 - Regex trie 16-bit field overflow

The trie optimization in the regex engine could overflow in an alternation with more than ~65k branches. This could cause both false positives and false negatives on such regular expressions.

Incompatible Changes

Unicode rules are now fully enforced on identifier and regular expression group names.

Before Unicode, Perl accepted any \w character in an identifier or other name, except the first character couldn't be a digit.  Later, Unicode created two properties that described this.  Even later, they found those properties to be insufficient, and created two new similar properties.  These are the ones that perl has intended to use since: \p{XID_Start} and \p{XID_Continue}.  (The X stands for "eXtended" and indicates these are the more modern versions.)

(And even later, long after Perl identifier rules were formed using the above properties, Unicode added recommendations to further restrict legal identifier names.  These were added to counter cases where, for example, programmers snuck code past reviewers using characters that look like other ones.  The two properties are Identifier_Status and Identifier_Type.  See <https://www.unicode.org/reports/tr39/>.  Perl currently doesn't do anything with these, except to furnish you the ability to use them in regular expressions.)

We soon discovered that there were 14 characters that match XID_Start and XID_Continue that don't also match \w.  To avoid breaking code that had long relied on \w, we chose to not add those to the list of acceptable identifier characters.

It turns out that there are about 160 characters that match \w but not the Unicode XID properties.  Thus they are illegal according to Unicode.  Those are now explicitly forbidden in both Perl identifiers and regular expression group names.  Previously, it was likely that their use in identifiers wouldn't work anyway; they could be accepted initially as legal, but other code would later reject them, but with a message that had nothing to do with the underlying problem.  However group names in regular expression patterns could contain illegal continuation characters and have a higher probability of not being caught.  That is now changed.

Only programs that do use utf8 can be affected, and then only characters that appear in the 2nd or later positions of the name.  The characters that an identifier name can begin with are unchanged.

130 of the now unacceptable characters are 5 sets of 26 Latin letters that are enclosed by some shape, such as CIRCLED LATIN CAPITAL LETTER N. Another 8 are generic modifiers that add shapes around other characters; 5 are modifiers to Cyrillic numbers; and 16 are Arabic ligatures and isolated forms.  The other two are GREEK YPOGEGRAMMENI and VERTICAL TILDE.

Deprecations

Performance Enhancements

Modules and Pragmata

Updated Modules and Pragmata

  • Archive::Tar has been upgraded from version 3.04 to 3.12.

    This fixes CVE-2026-9538, CVE-2026-42496, and CVE-2026-42497.

  • attributes has been upgraded from version 0.36 to 0.37.
  • B has been upgraded from version 1.89 to 1.92.
  • B::Concise has been upgraded from version 1.007 to 1.012.
  • B::Deparse has been upgraded from version 1.85 to 1.89.
  • charnames has been upgraded from version 1.50 to 1.51.
  • Compress::Raw::Bzip2 has been upgraded from version 2.213 to 2.218.
  • Compress::Raw::Zlib has been upgraded from version 2.213 to 2.222.
  • Config::Perl::V has been upgraded from version 0.38 to 0.39.
  • CPAN::Meta has been upgraded from version 2.150010 to 2.150013.
  • CPAN::Meta::Requirements has been upgraded from version 2.143 to 2.145.
  • DB_File has been upgraded from version 1.859 to 1.860.
  • Encode has been upgraded from version 3.21 to 3.24.
  • English has been upgraded from version 1.11 to 1.12.
  • Errno has been upgraded from version 1.38 to 1.39.
  • experimental has been upgraded from version 0.035 to 0.036.
  • ExtUtils::CBuilder has been upgraded from version 0.280242 to 0.280243.
  • ExtUtils::MakeMaker has been upgraded from version 7.76 to 7.78.
  • ExtUtils::Miniperl has been upgraded from version 1.14 to 1.15.
  • ExtUtils::ParseXS has been upgraded from version 3.57 to 3.63.
  • ExtUtils::Typemaps has been upgraded from version 3.57 to 3.63.
  • feature has been upgraded from version 1.97 to 2.02.
  • File::Copy has been upgraded from version 2.41 to 2.43.
  • File::Fetch has been upgraded from version 1.04 to 1.08.
  • File::Glob has been upgraded from version 1.42 to 1.44.
  • File::Spec has been upgraded from version 3.94 to 3.95.
  • File::stat has been upgraded from version 1.14 to 1.15.
  • File::Temp has been upgraded from version 0.2311 to 0.2312.
  • Filter::Simple has been upgraded from version 0.96 to 0.97.
  • Filter::Util::Call has been upgraded from version 1.64 to 1.65.
  • Getopt::Std has been upgraded from version 1.14 to 1.15.
  • HTTP::Tiny has been upgraded from version 0.090 to 0.096.

    This fixes CVE-2026-7010 and CVE-2026-7017.

  • IO has been upgraded from version 1.55 to 1.56.
  • IO::Compress has been upgraded from version 2.213 to 2.223.

    This fixes CVE-2025-15649, CVE-2026-48961, CVE-2026-48962, and CVE-2026-48959.

  • IO::Socket::IP has been upgraded from version 0.43 to 0.44.
  • Math::BigInt has been upgraded from version 2.005002 to 2.005003.
  • Module::CoreList has been upgraded from version 5.20250702 to 5.20260708.
  • Module::Metadata has been upgraded from version 1.000038 to 1.000039.
  • mro has been upgraded from version 1.29 to 1.30.
  • Net::Ping has been upgraded from version 2.76 to 2.77.
  • Opcode has been upgraded from version 1.69 to 1.71.
  • overloading has been upgraded from version 0.02 to 0.03.
  • PerlIO::via has been upgraded from version 0.19 to 0.21.
  • Pod::Html has been upgraded from version 1.35 to 1.36.
  • Pod::Simple has been upgraded from version 3.45 to 3.48.
  • POSIX has been upgraded from version 2.23 to 2.26.
  • Scalar::Util has been upgraded from version 1.68_01 to 1.70.
  • SelectSaver has been upgraded from version 1.02 to 1.03.
  • SelfLoader has been upgraded from version 1.28 to 1.29.
  • Socket has been upgraded from version 2.038 to 2.041.

    This fixes CVE-2026-12087.

  • Storable has been upgraded from version 3.37 to 3.41.

    This fixes CVE-2026-57433.

  • Term::Table has been upgraded from version 0.024 to 0.028.
  • Test::Harness has been upgraded from version 3.50 to 3.52.
  • Test::Simple has been upgraded from version 1.302210 to 1.302219.
  • Text::Balanced has been upgraded from version 2.06 to 2.07.
  • threads has been upgraded from version 2.43 to 2.45.
  • threads::shared has been upgraded from version 1.70 to 1.73.
  • Time::HiRes has been upgraded from version 1.9778 to 1.9780.
  • Time::Piece has been upgraded from version 1.36 to 1.41.
  • Unicode::UCD has been upgraded from version 0.81 to 0.83.
  • UNIVERSAL has been upgraded from version 1.17 to 1.18.
  • utf8 has been upgraded from version 1.27 to 1.29.
  • version has been upgraded from version 0.9933 to 0.9934.
  • warnings has been upgraded from version 1.74 to 1.78.
  • XS::APItest has been upgraded from version 1.43 to 1.50.
  • XS::Typemap has been upgraded from version 0.20 to 0.22.

Documentation

Changes to Existing Documentation

We have attempted to update the documentation to reflect the changes listed in this document. If you find any we have missed, open an issue at <https://github.com/Perl/perl5/issues>.

Additionally, the following selected changes have been made:

perlapi

  • Auto-generation of this document now includes the line number of the source code, as well as its documentation.
  • It now contains information about how to find what release of Perl first contained an API element.

perlexperiment

  • New entry for "New object system and class syntax".

perlxs

  • The reference manual for writing Perl XS code has been completely rewritten and modernized.  It is about twice the size of the old file, and promotes more modern XS syntax, such as ANSI signatures.

Diagnostics

The following additions or changes have been made to diagnostic output, including warnings and fatal error messages. For the complete list of diagnostic messages, see perldiag.

Changes to Existing Diagnostics

  • Use of uninitialized value%s

    This warning was issued in the reverse order (right-to-left) when both operands of a binary operator are uninitialized values.  This is now fixed to be consistent with evaluation order of operands.

  • Certain diagnostics about byte sequences that are supposed to comprise a UTF-8 encoded character, but that are invalid in some way, now don't include bytes irrelevant to that determination.  An example is

    old message

    Malformed UTF-8 character: \xc1\x27 (any UTF-8 sequence that starts with \xc1 is overlong which can and should be represented with a different, shorter sequence)

    new message

    Malformed UTF-8 character: \xc1 (any UTF-8 sequence that starts with \xc1 is overlong which can and should be represented with a different, shorter sequence)

    In this case the \xc1 is all that is needed to make the sequence invalid.  Whatever comes after it is irrelevant (in this case, \x27), and including it in the message might lead the reader to think that it somehow does matter.

  • The error Unrecognised parameters for "%s" constructor: %s has been changed to Unrecognized parameters for "%s" constructor: %s.
  • Variables whose name started with ^_ were incorrectly shown in diagnostics with a literal Ctrl-_ (which is an invisible ASCII character) in their name.

    The names of variables whose names begin with a caret and are longer than two characters are now wrapped in braces, just as they have to be in the source code.

    Therefore, using an undefined ${^_FOO} will now correctly warn with Use of uninitialized value ${^_FOO}, instead of the earlier Use of uninitialized value $FOO (with a literal Ctrl-_ after the dollar sign).

    [GH #24135 <https://github.com/Perl/perl5/issues/24135>]

  • Calling the import method on a package with no import method now produces a regular warning rather than a deprecation warning or error.

    Since Perl 5.39.1, calling import with arguments on a package without such a method has triggered a deprecation warning. In Perl 5.43.6, this deprecation was promoted into an error. This broke a significant amount of code while providing very little advantage over the warning. This fatal error has been converted back to a warning, with its deprecation status removed. There are no longer any plans to make this fatal in the future. The category for this warning is missing_import and it is enabled by default.

New Diagnostics

New Errors

  • Can't redeclare catch variable as "%s"

    (F) A my, our or state keyword was used with the exception variable in a catch block:

        try { ... }
        catch (my $e) { ... }
        # or catch (our $e) { ... }
        # or catch (state $e) { ... }

    This is not valid syntax. catch takes a bare variable name, which is automatically lexically declared. [GH #23222 <https://github.com/Perl/perl5/issues/23222>]

  • Use of "goto" to jump into a construct is no longer permitted

    (F) You have used goto LABEL; or goto EXPR; in an attempt to jump into the body of a loop or other block construct from the outside.  As of Perl 5.44, this throws an exception.

  • \x{%X} is a \w char that isn't valid in a name "%s"

    In most cases where this message now appears, an error would have occurred anyway, but the text would not have been helpful in finding the problem.

New Warnings

  • Possible attempt to escape whitespace in qw() list

    (W qw) qw() lists contain items separated by whitespace; contrary to what some might expect, backslash characters cannot be used to "protect" whitespace from being split, but are instead treated as literal data.

    Note that this warning is only emitted when the backslash is followed by actual whitespace (that qw splits on).

Configuration and Compilation

Testing

Tests were added and changed to reflect the other additions and changes in this release. Furthermore, these changes were made:

Platform Support

Platform-Specific Notes

Windows
  • Fix builds with USE_IMP_SYS defined but USE_ITHREADS not defined.
OpenBSD
AIX
  • Thread-safe locale handling has been turned off on all releases due to apparent bugs in the underlying operating system support.
  • The ibm-clang/ibm-clang_r IBM Open XL C/C++ compiler is now supported for AIX 7.2 and 7.3. This is the recommended compiler to use when compiling Perl on these versions of AIX.
z/OS
  • clang is now the only supported compiler
  • A single test failure remains for the core Perl test suite

    It is for a misleading warning message in an edge case for reading malformed UTF-8 in XS-APItest/t/utf8_warn00.t.  (Several instances of the same failure occur.)

  • Some cpan modules shipped with core have known problems:

    Encode

    ExtUtils-MakeMaker

    HTTP-Tiny

    IO-Compress

    JSON-PP

    libnet

    MIME-Base64

    PerlIO-via-QuotedPrint

    Pod-Checker

    podlators

    Pod-Simple
    Check for updates to these on cpan.

  • You can get a perl that works in ASCII mode

    An open source project has been created to modify the official perl to work on z/OS in ASCII mode.  See <https://github.com/zopencommunity/perlport>.

Internal Changes

Selected Bug Fixes

Known Problems

None

Obituary

"WELL VOLUNTEERED!" echoed across conference rooms and IRC channels. Matt S. Trout's battle cry that transformed reluctant volunteers into community leaders.

With profound sadness, we announce Matt's passing. Since the early 2000s, Matt shaped Perl through sheer force of will: IRC operator, PAUSE administrator, Shadowcat Systems co-founder, architect of DBIx::Class. His opinions came wrapped in profanity and delivered at maximum volume. He suffered no fools and grew to sometimes realize he should apologize. Yet this same abrasive exterior protected fierce dedication to mentoring, developers he harangued into volunteering now lead the community themselves. Matt's deliberately mind-bending code pushed Perl forward. Every modern Perl developer touches his legacy daily.

Well volunteered, Matt. Rest in peace.

Acknowledgements

Perl 5.44.0 represents approximately 12 months of development since Perl 5.42.0 and contains approximately 270,000 lines of changes across 1,300 files from 71 authors.

Excluding auto-generated files, documentation and release tools, there were approximately 110,000 lines of changes to 860 .pm, .t, .c and .h files.

Perl continues to flourish into its fourth decade thanks to a vibrant community of users and developers. The following people are known to have contributed the improvements that became Perl 5.44.0:

Alexander Karelas, Aristotle Pagaltzis, Arne Johannessen, Bartosz Jarzyna, Branislav Zahradník, brian d foy, Chad Granum, Chris 'BinGOs' Williams, Chris Prather, Christian Hansen, Craig A. Berry, Dagfinn Ilmari Mannsåker, Dan Book, Dan Church, Daniel Dragan, Daniel Laügt, Daniel Tang, Dan Kogai, Dave Cross, David Mitchell, Dmitrii Kuvaiskii, E. Choroba, Ed J, Elvin Aslanov, Eric Herman, Eugen Konkov, Graham Knop, Harald Jörg, H.Merijn Brand, Igor Todorovski, James Cook, James E Keenan, James Raspass, Jörg Thomas, Karen Etheridge, Karl Williamson, Leon Timmermans, Lukas Mai, Marc Reisner, Masahiro Iuchi, Matthew Horsfall, Maxim Vuets, Max Maischein, Nicolas R, Olaf Alders, Paul Evans, Paul Marquess, Peter John Acklam, Philippe Bruhat (BooK), Ricardo Signes, Richard Leach, Robert Rothenberg, Ryan Carsten Schmidt, Samuel Smith, Samuel Young, Scott Baker, Sevan Janiyan, Shirakata Kentaro, Sisyphus, Stan Ulbrych, Stefan Adams, Štěpán Němec, Steve Hay, TAKAI Kousuke, Thibault Duponchelle, Toby Inkster, Tomasz Konojacki, Tom Wyant, Tony Cook, Unicode Consortium, Yitzchak Scott-Thoennes.

The list above is almost certainly incomplete as it is automatically generated from version control history. In particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker.

Many of the changes included in this version originated in the CPAN modules included in Perl's core. We're grateful to the entire CPAN community for helping Perl to flourish.

For a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.

Reporting Bugs

If you find what you think is a bug, you might check the perl bug database at <https://github.com/Perl/perl5/issues>. There may also be information at <https://www.perl.org/>, the Perl Home Page.

If you believe you have an unreported bug, please open an issue at <https://github.com/Perl/perl5/issues>. Be sure to trim your bug down to a tiny but sufficient test case.

If the bug you are reporting has security implications which make it inappropriate to send to a public issue tracker, then see "Security VULNERABILITY CONTACT INFORMATION" in perlsec for details of how to report the issue.

Give Thanks

If you wish to thank the Perl 5 Porters for the work we had done in Perl 5, you can do so by running the perlthanks program:

    perlthanks

This will send an email to the Perl 5 Porters list with your show of thanks.

See Also

The Changes file for an explanation of how to view exhaustive details on what changed.

The INSTALL file for how to build Perl.

The README file for general stuff.

The Artistic and Copying files for copyright information.

Info

2026-07-23 perl v5.44.0 Perl Programmers Reference Guide