New "__CLASS__" Keyword

When using the new "class" feature, code inside a method, "ADJUST" block or field initializer expression is now permitted to use the new "__CLASS__" keyword. This yields a class name, similar to "__PACKAGE__", but whereas that gives the compile-time package that the code appears in, the "__CLASS__" keyword is aware of the actual run-time class that the object instance is a member of. This makes it useful for method dispatch on that class, especially during constructors, where access to $self is not permitted.

For more information, see "__CLASS__" in perlfunc.

":reader" attribute for field variables

When using the "class" feature, field variables can now take a ":reader" attribute. This requests that an accessor method be automatically created that simply returns the value of the field variable from the given instance.

    field $name :reader;

Is equivalent to

    field $name;
    method name () { return $name; }

An alternative name can also be provided:

    field $name :reader(get_name);

For more detail, see ":reader" in perlclass.

Permit a space in "-M" command-line option

When processing command-line options, perl now allows a space between the "-M" switch and the name of the module after it.

    $ perl -M Data::Dumper=Dumper -E 'say Dumper [1,2,3]'

This matches the existing behaviour of the "-I" option.

Restrictions to "use VERSION" declarations

In Perl 5.36, a deprecation warning was added when downgrading a "use VERSION" declaration from one above version 5.11, to below. This has now been made a fatal error.

Additionally, it is now a fatal error to issue a subsequent "use VERSION" declaration when another is in scope, when either version is 5.39 or above. This is to avoid complications surrounding imported lexical functions from builtin. A deprecation warning has also been added for any other subsequent "use VERSION" declaration below version 5.39, to warn that it will no longer be permitted in Perl version 5.44.

New "builtin::inf" and "builtin::nan" functions (experimental)

Two new functions, "inf" and "nan", have been added to the "builtin" namespace. These act like constants that yield the floating-point infinity and Not-a-Number value respectively.

New "^^" logical xor operator

Perl has always had three low-precedence logical operators "and", "or" and "xor", as well as three high-precedence bitwise versions "&", "^" and "|". Until this release, while the medium-precedence logical operators of "&&" and "||" were also present, there was no exclusive-or equivalent. This release of Perl adds the final "^^" operator, completing the set.

    $x ^^ $y and say "One of x or y is true, but not both";

"try"/"catch" feature is no longer experimental

Prior to this release, the "try"/"catch" feature for handling errors was considered experimental. Introduced in Perl version 5.34.0, this is now considered a stable language feature and its use no longer prints a warning. It still must be enabled with the 'try' feature.

See "Try Catch Exception Handling" in perlsyn.

"for" iterating over multiple values at a time is no longer experimental

Prior to this release, iterating over multiple values at a time with "for" was considered experimental. Introduced in Perl version 5.36.0, this is now considered a stable language feature and its use no longer prints a warning. See "Compound Statements" in perlsyn.

"builtin" module is no longer experimental

Prior to this release, the builtin module and all of its functions were considered experimental. Introduced in Perl version 5.36.0, this module is now considered stable its use no longer prints a warning. However, several of its functions are still considered experimental.

The ":5.40" feature bundle adds "try"

The latest version feature bundle now contains the recently-stablized feature "try". As this feature bundle is used by the "-E" commandline switch, these are immediately available in "-E" scripts.

"use v5.40;" imports builtin functions

In addition to importing a feature bundle, "use v5.40;" (or later versions) imports the corresponding builtin version bundle.

CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property

This vulnerability was reported directly to the Perl security team by Nathan Mills "the.true.nathan.mills@gmail.com".

A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker controlled buffer overflow in a heap allocated buffer.

CVE-2023-47039 - Perl for Windows binary hijacking vulnerability

This vulnerability was reported to the Intel Product Security Incident Response Team (PSIRT) by GitHub user ycdxsb <https://github.com/ycdxsb/WindowsPrivilegeEscalation>. PSIRT then reported it to the Perl security team.

Perl for Windows relies on the system path environment variable to find the shell ("cmd.exe"). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute "cmd.exe" within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory.

An attacker with limited privileges can exploit this behavior by placing "cmd.exe" in locations with weak permissions, such as "C:\ProgramData". By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

reset EXPR now calls set-magic on scalars

Previously "reset EXPR" did not call set magic when clearing scalar variables. This meant that changes did not propagate to the underlying internal state where needed, such as for $^W, and did not result in an exception where the underlying magic would normally throw an exception, such as for $1.

This means code that had no effect before may now actually have an effect, including possibly throwing an exception.

"reset EXPR" already called set magic when modifying arrays and hashes.

This has no effect on plain "reset" used to reset one-match searches as with "m?pattern?".

[GH #20763 <https://github.com/Perl/perl5/issues/20763>]

Calling the import method of an unknown package produces a warning

Historically, it has been possible to call the "import" or "unimport" method of any class, including ones which have not been defined, with an argument and not experience an error. For instance, this code will not throw an error in Perl 5.38:

    Class::That::Does::Not::Exist->import("foo");

However, as of Perl 5.39.1 this is deprecated and will issue a warning. Note that calling these methods with no arguments continues to silently succeed and do nothing. For instance,

    Class::That::Does::Not::Exist->import();

will continue to not throw an error. This is because every class implicitly inherits from the class UNIVERSAL which now defines an "import" method. In older perls there was no such method defined, and instead the method calls for "import" and "unimport" were special cased to not throw errors if there was no such method defined.

This change has been added because it makes it easier to detect case typos in "use" statements when running on case-insensitive file systems. For instance, on Windows or other platforms with case-insensitive file systems on older perls the following code

    use STRICT 'refs';

would silently do nothing as the module is actually called strict.pm, not STRICT.pm, so it would be loaded but its import method would never be called. It will also detect cases where a user passes an argument when using a package that does not provide its own import, for instance most "pure" class definitions do not define an import method.

"return" no longer allows an indirect object

The "return" operator syntax now rejects indirect objects. In most cases this would compile and even run, but wasn't documented and could produce confusing results, for example:

    # note that sum hasn't been defined
    sub sum_positive {
        return sum grep $_ > 0, @_;
        # unexpectedly parsed as:
        #   return *sum, grep $_ > 0, @_;
        # ... with the bareword acting like an extra (typeglob) argument
    }
    say for sum_positive(-1, 2, 3)

produced:

    *main::sum
    2
    3

[GH #21716 <https://github.com/Perl/perl5/issues/21716>]

Class barewords no longer resolved as file handles in method calls under "no feature "bareword_filehandles""

Under "no feature "bareword_filehandles"" bareword file handles continued to be resolved in method calls:

    open FH, "<", $somefile or die;
    no feature 'bareword_filehandles';
    FH->binmode;

This has been fixed, so the:

    FH->binmode;

will attempt to resolve "FH" as a class, typically resulting in a runtime error.

The standard file handles such as "STDOUT" continue to be resolved as a handle:

    no feature 'bareword_filehandles';
    STDOUT->flush; # continues to work

Note that once perl resolves a bareword name as a class it will continue to do so:

    package SomeClass {
        sub somemethod{}
    }
    open SomeClass, "<", "somefile" or die;
    # SomeClass resolved as a handle
    SomeClass->binmode;
    {
        no feature "bareword_filehandles";
        SomeClass->somemethod;
    }
    # SomeClass resolved as a class
    SomeClass->binmode;

[GH #19426 <https://github.com/Perl/perl5/issues/19426>]

New Modules and Pragmata

• Term::Table 0.018 has been added to the Perl core.

  This module is a dependency of Test2::Suite.

• Test2::Suite 0.000162 has been added to the Perl core.

  This distribution contains a comprehensive set of test tools for writing unit tests. It is the successor to Test::More and similar modules. Its inclusion in the Perl core means that CPAN module tests can be written using this suite of tools without extra dependencies.

Updated Modules and Pragmata

• Archive::Tar has been upgraded from version 2.40 to 3.02_001.
• attributes has been upgraded from version 0.35 to 0.36.
• autodie has been upgraded from version 2.36 to 2.37.
• B has been upgraded from version 1.88 to 1.89.
• B::Deparse has been upgraded from version 1.74 to 1.76.
• Benchmark has been upgraded from version 1.24 to 1.25.
• bignum has been upgraded from version 0.66 to 0.67.
• builtin has been upgraded from version 0.008 to 0.014.

  builtin now accepts a version bundle as an input argument, requesting it to import all of the functions that are considered a stable part of the module at the given Perl version. For example:

      use builtin ':5.40';
      

  Added the load_module() builtin function as per PPC 0006 <https://github.com/Perl/PPCs/blob/main/ppcs/ppc0006-load-module.md>.

• bytes has been upgraded from version 1.08 to 1.09.
• Compress::Raw::Bzip2 has been upgraded from version 2.204_001 to 2.212.
• Compress::Raw::Zlib has been upgraded from version 2.204_001 to 2.212.
• CPAN::Meta::Requirements has been upgraded from version 2.140 to 2.143.
• Data::Dumper has been upgraded from version 2.188 to 2.189.
• DB_File has been upgraded from version 1.858 to 1.859.
• Devel::Peek has been upgraded from version 1.33 to 1.34.
• Devel::PPPort has been upgraded from version 3.71 to 3.72.
• diagnostics has been upgraded from version 1.39 to 1.40.
• DynaLoader has been upgraded from version 1.54 to 1.56.
• Encode has been upgraded from version 3.19 to 3.21.
• Errno has been upgraded from version 1.37 to 1.38.

  The "osvers" and "archname" baked into the module to ensure Errno is loaded by the perl that built it are now more comprehensively escaped. [GH #21135 <https://github.com/Perl/perl5/issues/21135>]

• experimental has been upgraded from version 0.031 to 0.032.
• Exporter has been upgraded from version 5.77 to 5.78.
• ExtUtils::CBuilder has been upgraded from version 0.280238 to 0.280240.
• ExtUtils::Manifest has been upgraded from version 1.73 to 1.75.
• ExtUtils::Miniperl has been upgraded from version 1.13 to 1.14.
• Fcntl has been upgraded from version 1.15 to 1.18.

  The old module documentation stub has been greatly expanded and revised.

  Adds support for the "O_TMPFILE" flag on Linux.

• feature has been upgraded from version 1.82 to 1.89.

  It now documents the ":all" feature bundle, and suggests a reason why you may not wish to use it.

• fields has been upgraded from version 2.24 to 2.25.
• File::Compare has been upgraded from version 1.1007 to 1.1008.
• File::Find has been upgraded from version 1.43 to 1.44.
• File::Glob has been upgraded from version 1.40 to 1.42.
• File::Spec has been upgraded from version 3.89 to 3.90.
• File::stat has been upgraded from version 1.13 to 1.14.
• FindBin has been upgraded from version 1.53 to 1.54.
• Getopt::Long has been upgraded from version 2.54 to 2.57.
• Getopt::Std has been upgraded from version 1.13 to 1.14.

  Documentation and test improvements only; no change in functionality.

• Hash::Util has been upgraded from version 0.30 to 0.32.
• Hash::Util::FieldHash has been upgraded from version 1.26 to 1.27.
• HTTP::Tiny has been upgraded from version 0.086 to 0.088.
• I18N::Langinfo has been upgraded from version 0.22 to 0.24.

  It now handles the additional locale categories that Linux defines beyond those in the POSIX Standard.

  This fixes what is returned for the "ALT_DIGITS" item, which has never before worked properly in Perl.

• IO has been upgraded from version 1.52 to 1.55.

  Fixed "IO::Handle/blocking" on Windows, which has been non-functional since IO 1.32. [GH #17455 <https://github.com/Perl/perl5/issues/17455>]

• IO-Compress has been upgraded from version 2.204 to 2.212.
• IO::Socket::IP has been upgraded from version 0.41_01 to 0.42.
• IO::Zlib has been upgraded from version 1.14 to 1.15.
• locale has been upgraded from version 1.10 to 1.12.
• Math::BigInt has been upgraded from version 1.999837 to 2.003002.
• Math::BigInt::FastCalc has been upgraded from version 0.5013 to 0.5018.
• Module::CoreList has been upgraded from version 5.20230520 to 5.20240609.
• Module::Metadata has been upgraded from version 1.000037 to 1.000038.
• mro has been upgraded from version 1.28 to 1.29.
• NDBM_File has been upgraded from version 1.16 to 1.17.
• Opcode has been upgraded from version 1.64 to 1.65.
• perl5db.pl has been upgraded from version 1.77 to 1.78.

  Made parsing of the "l" command arguments saner. [GH #21350 <https://github.com/Perl/perl5/issues/21350>]

• perlfaq has been upgraded from version 5.20210520 to 5.20240218.
• PerlIO::encoding has been upgraded from version 0.30 to 0.31.
• PerlIO::scalar has been upgraded from version 0.31 to 0.32.
• PerlIO::via has been upgraded from version 0.18 to 0.19.
• Pod::Checker has been upgraded from version 1.75 to 1.77.
• Pod::Html has been upgraded from version 1.34 to 1.35.
• Pod::Simple has been upgraded from version 3.43 to 3.45.
• podlators has been upgraded from version 5.01 to 5.01_02.
• POSIX has been upgraded from version 2.13 to 2.20.

  The "mktime" function now works correctly on 32-bit platforms even if the platform's "time_t" type is larger than 32 bits. [GH #21551 <https://github.com/Perl/perl5/issues/21551>]

  The "T_SIGNO" and "T_FD" typemap entries have been fixed so they work with any variable name, rather than just the hardcoded "sig" and "fd".

  The mappings for "Mode_t", "pid_t", "Uid_t", "Gid_t" and "Time_t" have been updated to be integer types; previously they were "NV" floating-point.

  Adjusted the signbit() on NaN test to handle the unusual bit pattern returned for NaN by Oracle Developer Studio's compiler. [GH #21533 <https://github.com/Perl/perl5/issues/21533>]

• re has been upgraded from version 0.44 to 0.47.
• Safe has been upgraded from version 2.44 to 2.46.
• SelfLoader has been upgraded from version 1.26 to 1.27.
• Socket has been upgraded from version 2.036 to 2.038.
• strict has been upgraded from version 1.12 to 1.13.
• Test::Harness has been upgraded from version 3.44 to 3.48.
• Test::Simple has been upgraded from version 1.302194 to 1.302199.
• Text::Tabs has been upgraded from version 2021.0814 to 2024.001.
• Text::Wrap has been upgraded from version 2021.0814 to 2024.001.
• threads has been upgraded from version 2.36 to 2.40.

  An internal error has been made slightly more verbose ("Out of memory in perl:threads:ithread_create").

• threads::shared has been upgraded from version 1.68 to 1.69.
• Tie::File has been upgraded from version 1.07 to 1.09.

  Old compatibility code for perl 5.005 that was no longer functional has been removed.

• Time::gmtime has been upgraded from version 1.04 to 1.05.
• Time::HiRes has been upgraded from version 1.9775 to 1.9777.
• Time::Local has been upgraded from version 1.30 to 1.35.
• Time::localtime has been upgraded from version 1.03 to 1.04.
• Time::tm has been upgraded from version 1.00 to 1.01.
• UNIVERSAL has been upgraded from version 1.15 to 1.17.
• User::grent has been upgraded from version 1.04 to 1.05.
• User::pwent has been upgraded from version 1.02 to 1.03.
• version has been upgraded from version 0.9929 to 0.9930.
• warnings has been upgraded from version 1.65 to 1.69.
• XS::APItest has been upgraded from version 1.32 to 1.36.
• XS::Typemap has been upgraded from version 0.19 to 0.20.

Changes to Existing Documentation

We have attempted to update the documentation to reflect the changes listed in this document. If you find any we have missed, open an issue at <https://github.com/Perl/perl5/issues>.

Additionally, the following selected changes have been made:

perlapi

• Corrected the documentation for "Perl_form", "form_nocontext", and "vform", which claimed that any later call to one of them will destroy the previous returns from any. This hasn't been true since 5.6.0, except it does remain true if these are called during global destruction. With that caveat, the return of each of these is a fresh string in a temporary that will automatically be freed by a call to ""FREETMPS"" in perlapi or at at places such as statement boundaries.
• Several internal functions now have documentation - the various "newSUB" functions, newANONLIST(), newANONHASH(), newSVREF() and similar.

perlclass

•

Added a list of known bugs in the experimental "class" feature.

perlfunc

•

The documentation for "local", "my", "our", and "state", has been updated to include examples and descriptions of their effects within a statement.

perlguts

•

A new section has been added which describes the experimental reference-counted argument stack build option ("PERL_RC_STACK").

perlclib

•

Extensive guidance has been added for interfacing with the standard C library, including many more functions to avoid, and how to cope with locales and threads.

perlhacktips

• Document we can't use compound literals or array designators due to C++ compatibility. [GH #21073 <https://github.com/Perl/perl5/issues/21073>]
• Document new functions sv_mark_arenas() and sv_sweep_arenas() (which only exist on "DEBUGGING" builds)
• Added brief documentation for some tools useful when developing perl itself on Windows or Cygwin.

perllol

•

Removed indirect object syntax in "Dumpvalue" example

perlre

•

Removed statement suggesting "/p" is a no-op.

perlref

•

Documented ref assignment in list context (as part of the "refaliasing" feature)

perlop

•

The section on the empty pattern "//" has been amended to mention that the current dynamic scope is used to find the last successful match.

perlport

• The "-S" file test has been meaningful on Win32 since 5.37.6
• The "-l" file test is now meaningful on Win32
• Some strange behaviour with "." at the end of names under Windows has been documented

perlvar

•

Added documentation for an alternative to "${^CAPTURE}"

New Diagnostics

New Errors

• Cannot use __CLASS__ outside of a method or field initializer expression

  (F) A "__CLASS__" expression yields the class name of the object instance executing the current method, and therefore it can only be placed inside an actual method (or method-like expression, such as a field initializer expression).

• get_layers: unknown argument '%s'

  (F) You called PerlIO::get_layers() with an unknown argument. Legal arguments are provided in key/value pairs, with the keys being one of "input", "output" or "detail", followed by a boolean.

• UNIVERSAL does not export anything

  (F) You asked UNIVERSAL to export something, but UNIVERSAL is the base class for all classes and contains no exportable symbols.

• Builtin version bundle "%s" is not supported by Perl

  (F) You attempted to "use builtin :ver" for a version number that is either older than 5.39 (when the ability was added), or newer than the current perl version.

• Invalid version bundle "%s"

  (F) A version number that is used to specify an import bundle during a "use builtin ..." statement must be formatted as ":MAJOR.MINOR" with an optional third component, which is ignored. Each component must be a number of 1 to 3 digits. No other characters are permitted. The value that was specified does not conform to these rules.

• Missing comma after first argument to return

  (F) While certain operators allow you to specify a filehandle or an "indirect object" before the argument list, "return" isn't one of them.

• Out of memory during vec in lvalue context

  (F) An attempt was made to extend a string beyond the largest possible memory allocation by assigning to vec() called with a large second argument.

  (This case used to throw a generic "Out of memory!" error.)

• Cannot create an object of incomplete class "%s"

  (F) An attempt was made to create an object of a class where the start of the class definition has been seen, but the class has not been completed.

  This can happen for a failed eval, or if you attempt to create an object at compile time before the class is complete:

    eval "class Foo {"; Foo->new; # error
    class Bar { BEGIN { Bar->new } }; # error
      

  Previously perl would assert or crash. [GH #22159 <https://github.com/Perl/perl5/issues/22159>]

New Warnings

• Forked open '%s' not meaningful in <>

  (S inplace) You had "|-" or "-|" in @ARGV and tried to use "<>" to read from it.

  Previously this would fork and produce a confusing error message. [GH #21176 <https://github.com/Perl/perl5/issues/21176>]

• Attempt to call undefined %s method with arguments ("%s"%s) via package "%s" (Perhaps you forgot to load the package?)

  (D deprecated::missing_import_called_with_args) You called the import() or unimport() method of a class that has no import method defined in its inheritance graph, and passed an argument to the method. This is very often the sign of a misspelled package name in a use or require statement that has silently succeeded due to a case insensitive file system.

  Another common reason this may happen is when mistakenly attempting to import or unimport a symbol from a class definition or package which does not use "Exporter" or otherwise define its own "import" or "unimport" method.

Changes to Existing Diagnostics

• Name "%s::%s" used only once: possible typo

  This warning now honors being marked as fatal. [GH #13814 <https://github.com/Perl/perl5/issues/13814>]

• Out of memory in perl:%s

  There used to be several places in the perl core that would print a generic "Out of memory!" message and abort when memory allocation failed, giving no indication which program it was that ran out of memory. These have been modified to include the word "perl" and the general area of the allocation failure, e.g. "Out of memory in perl:util:safesysrealloc". [GH #21672 <https://github.com/Perl/perl5/issues/21672>]

• Possible precedence issue with control flow operator (%s)

  This warning now mentions the name of the control flow operator that triggered the diagnostic (e.g. "return", "exit", "die", etc).

  It also covers more cases: Previously, the warning was only triggered if a low-precedence logical operator (like "and", "or", "xor") was involved. Now it is also shown for misleading code like this:

      exit $x ? 0 : 1;  # actually parses as: exit($x) ? 0 : 1;
      exit $x == 0;     # actually parses as: exit($x) == 0;
      

• Use of uninitialized value%s

  This warning is now slightly more accurate in cases involving "length", "pop", "shift", or "splice":

      my $x;
      length($x) == 0
      # Before:
      #  Use of uninitialized value $x in numeric eq (==) at ...
      # Now:
      #  Use of uninitialized value length($x) in numeric eq (==) at ...
      

  That is, the warning no longer implies that $x was used directly as an operand of "==", which it wasn't.

  Similarly:

      my @xs;
      shift @xs == 0
      # Before:
      #  Use of uninitialized value within @xs in numeric eq (==) at ...
      # Now:
      #  Use of uninitialized value shift(@xs) in numeric eq (==) at ...
      

  This is more accurate because there never was an "undef" within @xs as the warning implied. (The warning for "pop" works analogously.)

  Finally:

      my @xs = (1, 2, 3);
      splice(@xs, 0, 0) == 0
      # Before:
      #  Use of uninitialized value within @xs in numeric eq (==) at ...
      # Now:
      #  Use of uninitialized value in numeric eq (==) at ...
      

  That is, in cases where "splice" returns "undef", it no longer unconditionally blames its first argument. This was misleading because "splice" can return "undef" even if none of its arguments contain "undef".

  [GH #21930 <https://github.com/Perl/perl5/issues/21930>]

• Old package separator "'" deprecated

  Prevent this warning appearing spuriously when checking the heuristic for the You need to quote "%s" warning.

  [GH #22145 <https://github.com/Perl/perl5/issues/22145>]

New Platforms

Serenity OS

Out of the box support for Serenity OS was added.

Platform-Specific Notes

Windows

Eliminated several header build warnings under MSVC with "/W4" to reduce noise for embedders. [GH #21031 <https://github.com/Perl/perl5/issues/21031>]

Work around a bug in most 32-bit Mingw builds, where the generated code, including the code in the gcc support library, assumes 16-byte stack alignment, which 32-bit Windows does not preserve. [GH #21313 <https://github.com/Perl/perl5/issues/21313>]

Enable "copysign", "signbit", "acosh", "asinh", "atanh", "exp2", "tgamma" in the bundled configuration used for MSVC. [GH #21610 <https://github.com/Perl/perl5/issues/21610>]

The build process no longer supports Visual Studio 2013. This was failing to build at a very basic level and there have been no reports of such failures. [GH #21624 <https://github.com/Perl/perl5/issues/21624>]

Linux

The hints file has been updated to handle the Intel oneAPI DPC++/C++ compiler.

MacOS/Darwin

Don't set "MACOSX_DEPLOYMENT_TARGET" when building on OS X 10.5. [GH #21367 <https://github.com/Perl/perl5/issues/21367>]

VMS

Fixed the configure "installation prefix" prompt to accept a string rather than yes/no.

Fixed compilation by defining proper value for "perl_lc_all_category_positions_init".

Increased buffer size when reading config_H.SH to fix compilation under clang.

Oracle Developer Studio (Solaris, Oracle Linux)

Due to an apparent code generation bug, the default optimization level for the Oracle Developer Studio (formerly Sun Workshop) compiler is now "-xO1". [GH #21535 <https://github.com/Perl/perl5/issues/21535>]