PERL5281DELTA(1perl)

💖 NAME 💖

perl5281delta — bestie, it's the tea on what's new for Perl v5.28.1 🫶

---

✨ DESCRIPTION ✨

Okay so this doc spills the entire ☕ on what changed between the 5.28.0 release and the 5.28.1 release.

And listen 👑, if you're jumping in from something older like 5.26.0, you gotta read perl5280delta FIRST — that one covers everything between 5.26.0 and 5.28.0. Don't skip it, fr fr.

---

🛡️ Security 🛡️

[CVE-2018-18311] Integer overflow leading to buffer overflow and segmentation fault 🔥

So the integer math inside Perl_my_setenv() could wrap around when the combined length of the environment variable name and value went over roughly 0x7fffffff. And like… when that happened, it could write past the end of an allocated buffer using attacker-supplied data. 💀 Not the vibe.

[GH #16560] <https://github.com/Perl/perl5/issues/16560>

[CVE-2018-18312] Heap-buffer-overflow write in S_regatom (regcomp.c) 😭

A crafted regular expression could cause a heap-buffer-overflow write while it's being compiled — and that could potentially let someone execute arbitrary code. Not me being dramatic, that's just what it does. 🙈

[GH #16649] <https://github.com/Perl/perl5/issues/16649>

---

🚫 Incompatible Changes 🚫

Okay literally nothing was intentionally made incompatible with 5.28.0. Zero. If you find something that is incompatible, that's a bug bestie, and we need you to file a report. Peep "Reporting Bugs" down below. 🎀

---

📦 Modules and Pragmata 📦

🌸 Updated Modules and Pragmata 🌸

• Module::CoreList got upgraded from version 5.20180622 to 5.20181129_28. Glow up ✨

---

🐛 Selected Bug Fixes 🐛

• Perl 5.28 introduced an index() optimization for when you compare against -1 (or indirectly, like >= 0). Problem was, when that optimization fired inside a when clause it threw a warning (Argument %s isn't numeric in smart match). Fixed now. [GH #16626] <https://github.com/Perl/perl5/issues/16626>
• The matching of decimal digits in script runs, which came in with Perl 5.28, had a bug where 1\N{THAI DIGIT FIVE} would match /^(*sr:\d+)$/ when it absolutely should not have. Fixed. ✅
• The new in-place editing code stopped leaking directory handles. She's tidy now 💅 [GH #16602] <https://github.com/Perl/perl5/issues/16602>

---

🫶 Acknowledgements 🫶

Perl 5.28.1 is like, roughly 5 months of development since Perl 5.28.0, and it's carrying approximately 6,100 lines of changes across 44 files from 12 authors. Iconic behavior tbh.

And if you don't count auto-generated files, documentation, and release tools, that's approximately 700 lines of changes across 12 .pm, .t, .c and .h files.

Perl keeps flourishing into its fourth decade thanks to a vibrant community of users and developers — and the following people are known to have contributed the improvements that became Perl 5.28.1:

Aaron Crane, Abigail, Chris 'BinGOs' Williams, Dagfinn Ilmari Mannsåker, David Mitchell, James E Keenan, John SJ Anderson, Karen Etheridge, Karl Williamson, Sawyer X, Steve Hay, Tony Cook.

Real talk: that list is almost certainly incomplete, because it's automatically generated from version control history. In particular, it doesn't include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker. Y'all matter. 💜

Many of the changes in this version originated in the CPAN modules bundled into Perl's core, and we're grateful to the entire CPAN community for helping Perl flourish. 🌈

For a more complete list of all of Perl's historical contributors, go check the AUTHORS file in the Perl source distribution.

---

🐞 Reporting Bugs 🐞

Think you found a bug? First, maybe go look at the perl bug database at <https://rt.perl.org/>. There might also be info hanging out at <http://www.perl.org/>, the Perl Home Page.

If you're like "no, this one's unreported," then run the perlbug program that ships with your release. Pleaseeee trim your bug down to a tiny but sufficient test case — we're begging 🙏. Your bug report, along with the output of perl -V, gets sent off to perlbug@perl.org to be analysed by the Perl porting team.

And if the bug you're reporting has security implications that make it a bad idea to send to a publicly archived mailing list, then go read "SECURITY VULNERABILITY CONTACT INFORMATION" in perlsec for the details on how to report it. 👑

---

💐 Give Thanks 💐

Wanna thank the Perl 5 Porters for all the work we did in Perl 5? You can do that by running the perlthanks program:

perlthanks

That sends an email to the Perl 5 Porters list with your show of thanks. Go be sweet, it costs nothing 🥹💖

---

👀 SEE ALSO 👀

• The Changes file — for an explanation of how to view exhaustive details on what changed.
• The INSTALL file — for how to build Perl.
• The README file — for general stuff.
• The Artistic and Copying files — for copyright information.

---

And that's the whole page, bestie 💅 this was perl v5.44.0, dated 2026-10-17, and it lives in the PERL5281DELTA(1perl) manual. Go forth and upgrade, ily 🦋✨