CPANscan

HTML::Defang is a Perl library for safely cleaning HTML and CSS by removing executable content and neutralising XSS vectors while keeping safe markup intact. It uses a whitelist approach and a custom parser designed to handle real world, messy HTML the way browsers do, and it can strip or comment out scripts, embedded objects, dangerous attributes, URLs and CSS declarations. The module is highly customizable through callbacks that let you inspect or modify tags, attributes, URLs, style rules and plain content, and attribute values are passed as references so you can alter output in place. Options let you fix mismatched tags, return body-only content, delete defanged fragments instead of commenting them out, and control how already-defanged names are handled. Typical uses are sanitising user-supplied HTML in web apps, email rendering or any system that must accept rich content safely. A recent and important fix makes title, textarea, noembed and noframes content be treated as opaque raw text, closing an XSS bypass where a literal end tag plus active markup could be smuggled inside what previously looked like a harmless comment.

DBIx::QuickDB lets you spin up throwaway database servers quickly for testing and local development, supporting PostgreSQL, MySQL/MariaDB, SQLite and more via pluggable drivers. You can create named databases at compile-time as convenient constants or build them at runtime and get DBI-ready handles, control startup/teardown, point to an existing data directory or let QDB create and clean temporary ones, and preload schema SQL per driver. The API is simple: DBIx::QuickDB->build_db(...) creates or returns an instance and check_driver helps you probe available backends, while environment variables such as QDB_TMPDIR and DB_VERBOSE let you tune temp paths and server logging. Recent releases have hardened pooling and cloning, sanitizing and PID-tagging instance directories to avoid cross-process collisions, improved watcher behavior so servers are reaped cleanly and errors report clearer diagnostics, and added retries and safer teardown on Windows and slow hosts, making ephemeral databases far more reliable in parallel or forked test runs. If you need reliable, configurable ephemeral databases for tests or development, DBIx::QuickDB is a lightweight, production-hardened choice.

Mojolicious::Plugin::Fondation::OpenAPI is a plugin for Fondation-based Mojolicious apps that produces an OpenAPI 3.0.3 spec from DBIx::Class metadata and enforces it at runtime. It adds the openapi generate command to create share/openapi.json and a client validators.js file, supports backend selection and per-column schema overrides in your config, and integrates the generated spec with Mojolicious::Plugin::OpenAPI so requests are validated and Swagger UI is available in development. You can disable client-side validators with no_validator_js and hide internal tables via openapi_exclude in a plugin's fondation_meta. The module depends on Fondation::Model::DBIx::Async and Mojolicious::Plugin::OpenAPI and notes a known compatibility issue on Perl 5.40 caused by Net::IDN::Encode which may require a prebuilt package on some systems. Run openapi generate before building assets so the spec and validators are committed with your application.

Mojolicious::Plugin::Fondation::Menu is a plugin for Mojolicious applications that provides declarative, database-backed menu management with support for navbars and breadcrumbs, letting you ship menu definitions from each plugin via share/menus.json and synchronize them into a central menu table with a simple "menu sync" command. It stores menu entries with titles, links, icons, grouping, nesting, ordering and optional visibility conditions such as group or permission checks, and exposes helpers to fetch and render menus or breadcrumbs and to evaluate menu visibility, along with an auto-generated REST API and fine-grained menu permissions. If you need consistent, reusable menus across a modular Mojolicious app this module handles storage, rendering and access control for you, and the recent 0.03 release simplifies error handling and standardizes problem reporting for cleaner failure responses.

Mojolicious::Plugin::Fondation::Workflow is a Fondation plugin that makes it easy to use the Workflow state‑machine framework inside Mojolicious applications by exposing a simple controller helper to create and fetch workflow instances and by wrapping raw Workflow objects in a friendly proxy with convenience methods for state, actions, execution and history. It supports both database persistence via Workflow::Persister::DBI and file‑based persistence for wizard‑style workflows, lets you declare workflows in YAML with extra Fondation UI metadata for a Bootstrap renderer, and integrates with other Fondation plugins so workflow history can link to a user record when Fondation::User is present. The plugin is tolerant of missing database configuration so file-backed flows still work, and recent changes in 0.02 added a Workflow action, updated tests and dependencies, and moved result rows onto a common base to simplify models. If you need workflow/state machine behavior with built‑in persistence options, UI metadata and tight integration into the Fondation stack this plugin is likely a good fit.

Mojolicious::Plugin::Fondation::User is a plug-and-play user management module for Mojolicious apps built on the Fondation stack. It supplies a DBIx::Class users table with schema, Result and ResultSet classes, automatic password hashing via Crypt::Passphrase using Argon2 in the async DB worker so the event loop stays free, and a REST controller with OpenAPI-generated routes to list, create, read, update and delete users at /api/user and /api/user/:id. The password field is never returned in API responses. Convenient ResultSet helpers include active, created_today and latest, and a with('groups') option will prefetch many-to-many group relationships in one query and embed full group objects in JSON output. A Bootstrap-based HTML UI is provided by Fondation::User::UI::Bootstrap and translations for API notifications are included in English and French. This module is a good fit if you want a ready-made, secure user model and API that integrates with Fondation::Model::DBIx::Async and Fondation::OpenAPI.

Mojolicious::Plugin::Fondation::Perm is a small Mojolicious plugin that provides permission management for applications built on the Fondation stack, letting you centralize access rules and enforce them from controllers and templates. It integrates with Fondation’s schema layer and exposes helpers to perform common permission checks and produce consistent error responses so you can keep authorization logic out of application code. Recent updates simplified error handling by replacing the internal _render_error with unified calls to $c->problem() and refreshed dependencies for smoother integration.

Mojolicious::Plugin::Fondation::MigrationDBIx adds a simple db command set to Mojolicious apps that use DBIx::Class via Fondation::Model::DBIx::Async, letting you generate migration SQL from your schema, apply and roll back migrations, and load fixture data shipped by plugins. It provides commands to bootstrap a Schema class, prepare migration files and copy fixture directories, install or step upgrades and downgrades, show status, and populate data sets. The plugin detects the database driver from your DSN, integrates with DBIx::Class::DeploymentHandler to generate upgrade and downgrade SQL on the fly, and discovers fixtures by copying share/fixtures from loaded plugins into the application for versioned fixture loading. A schema_drift helper reports differences between prepared migration files and the live schema and logs a warning without stopping the app. Recent updates improved fixture handling by resolving belongs_to dependencies between fixture sets and expanded testing to cover MySQL and PostgreSQL for more robust cross-database behavior.

Mojolicious::Plugin::Fondation::Group adds ready-made group management to Fondation-based Mojolicious apps by creating groups and user_group pivot tables, supplying RESTful endpoints for CRUD and membership operations, and automatically linking many-to-many relations with users and permissions when the matching plugins are loaded. You can request related users or permissions in list and read responses via the with query parameter or the with method in code, which performs a single-query prefetch and embeds the related objects in the JSON output. If you do not request those relations they are omitted from responses. This plugin is ideal if you want out-of-the-box group CRUD, membership handling, and JSON serialization that integrates with Fondation::User, Fondation::Perm, and the Fondation schema result base.

Punk is a modern, opinionated MVC web framework for Perl that compiles your routes, guards, handlers and helpers into a frozen PSGI app at startup to minimize per-request overhead. It provides a compact DSL for defining HTTP routes, WebSocket and Server-Sent Events endpoints, scoped guards, static mounts, cookie sessions, single-use CSRF, CORS handling, OpenAPI mounting with request validation, view engines, database/model wiring and a plugin system. Configuration is YAML-driven with a built-in secret resolver so deployment settings can be kept separate from code, and a small CLI can scaffold a running app and inspect routes or environment. Punk also supports async handlers via futures and integrates with Hyperman for non-blocking WebSocket and SSE handling while remaining portable to ordinary PSGI servers. If you want a fast, minimal-overhead Perl framework that covers common web needs including APIs, realtime endpoints and sensible defaults for security and config, Punk is worth exploring. This is the initial public release, version 0.01 (2026-08-06).

Catalyst::Plugin::CSRFToken provides robust CSRF protection for Catalyst web applications by creating cryptographically strong tokens tied to the user session. It generates masked tokens you embed in forms or send in the X-CSRF-Token header and can automatically validate POST, PUT, DELETE and PATCH requests when enabled or be applied per-action with EnableCSRF, DisableCSRF or SingleUseCSRF attributes. Tokens are stored in the session, can be single-use or reusable, support optional HMAC signing via a configurable secret and expire after a configurable max_age. Each token is masked with fresh randomness on every call to reduce the risk of BREACH-style compression attacks and there are hooks to customize failure handling. Important upgrade note for 1.100 users: the on-the-wire token format changed and tokens issued by 1.001 or earlier are rejected, so plan to expire or drain sessions when deploying this release. The plugin requires Catalyst's Session support and is a practical choice when you need straightforward, configurable CSRF defense for both form and AJAX endpoints.

App::perlimports is a command-line tool that scans your Perl source and converts implicit or missing imports into explicit use statements so dependencies and function origins are clear. It automates the cleanup and maintenance of import lines, which is especially helpful when refactoring or auditing larger codebases and when you want to make module usage consistent and avoid subtle runtime surprises. The tool is free software distributed under the same terms as Perl and aims to make Perl code easier to read and maintain by making imports explicit.

Alien::hiredis is an Alien::Build wrapper that makes the minimal C Redis client library hiredis available to Perl builds so XS modules can find and link against it without manual C library installs. It can use a system-installed hiredis or install an isolated bundled copy for shared installs, which helps modules like Redis::hiredis and Protocol::Redis::XS build and run reliably across systems. The distribution bundles hiredis for convenience and isolates dynamic libraries to avoid linkage problems. Recent releases update the bundled hiredis to 1.4.1 to include security fixes while still supporting older nonbroken system versions. The module itself is released under the Artistic License 2.0 and the bundled hiredis is under a three-clause BSD license.

Mojolicious::Plugin::Fondation::Problem gives your Mojolicious app a consistent error interface by adding a $c->problem helper that emits RFC 9457 "problem" responses for API requests and renders a friendly HTML error page for browser requests. API responses use the application/problem+json format so clients get structured fields like status, title, detail, type, errors, and instance while HTML requests render a problem.html.ep template within the app layout when available. The plugin is mode aware and protects sensitive information in production by only returning status and title, while development mode includes full details to aid debugging. It automatically detects API calls via OpenAPI route markers, paths under /api/, or JSON Accept headers, so you get the right response format without extra boilerplate. If you maintain a Mojolicious app that serves both machine and human clients and want predictable, standards-compliant error handling with a simple helper, this module is a good fit.

Task::BeLike::PERLANCAR::Used is a "task" distribution that bundles the large set of Perl modules and command-line tools the author installs on a fresh Perl setup, so you can reproduce their working environment with a single installer invocation. It is meant to be used with cpanminus and the cpanm-perlancar helper to bootstrap a new perlbrew or system Perl and includes hundreds of libraries, utilities, App:: scripts and Dist::Zilla/Pod::Weaver plugins that span testing, CLI tooling, data handling, web clients and many small utilities. Expect a long install time and occasional dependency failures because this is effectively a curated personal collection rather than a minimal runtime profile. The author keeps it updated and recent releases fixed a POD-generation error caused by a missing Acme/CPANModules/PERLANCAR/Retired.pm file, so the task remains maintained and safe to use if you want to replicate or inspect the author's toolset.

RT::Extension::AwayMode is a small Request Tracker (RT) add-on that helps prevent tickets from being left waiting when an owner is out of office. Users can set an away flag on their Preferences page and optionally specify start and end dates, and while away they see a persistent banner in the web UI. If an away user posts a reply to a ticket they own, the extension reassigns the ticket to Nobody and adds an internal comment explaining the handoff so the rest of the team can see and take over work. It includes a simple, testable routine for evaluating away status and is intended for use with RT 6.0.3.

Sys::Virt is a Perl XS binding to the libvirt API that gives Perl programs a consistent way to manage virtual machines and related resources across different hypervisors. It lets you open local or remote connections, create and control domains, networks, storage pools, interfaces and node devices, inspect host capabilities and statistics, convert and validate domain XML, and subscribe to lifecycle and other events. The module supports authentication callbacks, TLS and a variety of libvirt URIs such as QEMU and Xen, and it exposes many helper methods and constants for tasks like CPU compatibility checks and memory tuning. Note that event callbacks return IDs that must be explicitly deregistered so the connection can be garbage collected, and the author cautions the XS layer should be audited for possible memory leaks. If you need to control libvirt from Perl, Sys::Virt provides the standard, feature rich interface and reports errors through Sys::Virt::Error objects.

SSVC is a Perl module that implements the Stakeholder-Specific Vulnerability Categorization framework so you can turn stakeholder-specific inputs into actionable vulnerability prioritization decisions. It ships implementations for common methodologies including CISA, CISA BOD 26-04, coordinator publication and triage, deployer and supplier, and it exposes introspection helpers so tools can enumerate decision points, allowed values and human labels. You create SSVC objects with the relevant decision point values, ask for the derived decision, serialize to JSON for interchange, and when using SSVC::CISA parse or emit the official compact vector string format. You can also register your own methodology classes to extend the system. Note that only the CISA implementation supports the official vector string grammar while other methodologies offer only a generic string representation.

Net::HTTPS::NB is a drop-in replacement for Net::HTTPS that is designed for non-blocking use, so you can perform TLS handshakes and read responses without tying up your program. It keeps the same high-level API as Net::HTTPS but never attempts multiple internal reads when you call read_response_headers or read_entity_body, and it adds a Blocking option to perform a non-blocking connect. When a handshake is incomplete you can call connected to check status and inspect the exported $HTTPS_ERROR which will be HTTPS_WANT_READ or HTTPS_WANT_WRITE to tell you whether to wait for readability or writability. read_response_headers returns an empty list if headers are not yet complete and read_entity_body returns -1 when no new data is available, which makes it easy to integrate with IO::Select or event loops. Use blocking(0) to make the socket non-blocking and blocking(1) to restore blocking mode. If you need a simple, Net::HTTPS-compatible client that works cleanly in non-blocking or event-driven programs, this module is a good fit.

String::RewritePrefix is a small utility for turning short identifiers into fully qualified names by substituting known prefixes, which is especially useful for plugin or mixin loading where you want to map bare names like "Plugin" to "MyApp::Plugin". You provide a mapping of prefixes to replacement strings or coderefs, and the module rewrites each input using the longest matching prefix so only one substitution is applied. You can call the class method directly or import a named rewrite routine into your namespace for convenience. The module supports dynamic prefix generation via coderefs and recent updates refreshed packaging and set the minimum supported Perl to v5.12.

Config::IniFiles is a mature Perl module for reading, editing and writing INI style configuration files in a straightforward, script friendly way. It offers both an object API and a tied hash interface so you can fetch and set sectioned key=value pairs, handle multi line values with here document or continuation lines, customize comment characters and case sensitivity, and use default or fallback sections. The module also supports stacking or importing another Config::IniFiles object so you can overlay site specific settings over shipped defaults, and it can write either full configuration files or compact delta files that record only changes. You can preserve and manipulate comments and trailing comments, control write permissions and encoding via filehandles, and inspect parse problems via the @Config::IniFiles::errors array. Be aware that rewritten output may not exactly preserve original formatting and that WriteConfig does not perform file locking, so you should manage concurrent writers yourself.

App::MARC::Count is a small, focused base class for a command-line marc-count utility that opens MARC XML files and counts the records they contain. It exposes a simple object API with new to construct the app and run to execute it, where run returns 0 for success and 1 for error. The module relies on MARC::File::XML and related utilities and includes an example showing how to prepare a MARC XML file and invoke the script to print the record count. The recent 0.05 release added support for compressed input files, making it easier to work with gzipped data. If you need a lightweight starting point to build or script record-counting for MARC XML collections, this module is a practical choice.

Dist::Starter is a small command line tool for quickly scaffolding a Perl distribution from a template. You run the provided diststarter script with a distribution name and it fills a template into a target directory, with options to select the template directory, output location, minimum Perl version, initial version and license, and to supply author metadata from your system GECOS, from git config, or from environment variables. Defaults are configurable via a run-control file so you can set your preferred template and values once and reuse them, and a dry-run mode prints the generated context as YAML so you can inspect what will be created before writing files. The distribution ships with a default template and is comparable to tools like Cookiecutter and Copier but focused on Perl projects. Note that this is an alpha release and some features such as easier template creation and extra script/share options are still TODO.

Net::API::REST is a compact framework for building RESTful APIs inside Apache/mod_perl applications that handles routing, path variable extraction and dispatch to endpoint handlers so you can express endpoints as simple subs or class methods. It provides request and response objects, CORS and OPTIONS preflight support, content type and method checking, network and access control hooks, and built‑in JWT encode/decode with optional encryption, while returning standard Apache2 HTTP status codes. The module supports multiple API versions, configurable methods, languages and content types, response compression, upload handling and post‑response callbacks and integrates with companion classes like Net::API::REST::Endpoint, Request, Response and JWT so you can focus on business logic rather than low level Apache plumbing. It is intended specifically for mod_perl/Apache2 environments and is actively maintained; the most recent release improves how the handler deals with exceptions returned by endpoint code.

API::Instagram is a Perl library that wraps Instagram's REST and Search APIs in a simple object oriented interface, making it easy to authenticate via OAuth2, build the authorization URL, exchange the returned code for an access token, and then fetch Instagram data such as the authenticated user feed, arbitrary users, media items, tags, locations, search results and currently popular media. It returns domain objects like API::Instagram::User and API::Instagram::Media so you can work with Instagram data in Perl idioms, offers a singleton convenience constructor and caches created objects by default with an option to disable that behavior, and is a good fit for Perl developers who want to embed Instagram access into web apps, bots or data-collection scripts without dealing with low-level HTTP calls.

Regexp::Pattern is a lightweight convention and helper for organizing and reusing regular expressions in Perl by placing named pattern definitions in Regexp::Pattern::* modules, each exposing a %RE hash that can contain plain regexes, documented examples, tags and dynamic generators that accept arguments. The module supplies a simple re() function to retrieve a pattern by name and a straightforward import mechanism to pull patterns into your own %RE with options for renaming, adding prefixes or suffixes, and filtering by tags so you can discover and compose useful building blocks without magic. Authors can include summaries, examples and metadata so tools or tests can validate patterns and users are encouraged to mark anchored or capturing patterns for clarity. Regexp::Pattern is a lower-overhead alternative to Regexp::Common and recent releases added flexible anchoring options including left-only and right-only anchoring.

Mail::BIMI is a Perl module for mail systems that want to retrieve, validate, and process Brand Indicators for Message Identification (BIMI). It ties into existing authentication checks by working with DMARC and SPF objects, fetches BIMI assertion records from DNS, downloads and verifies SVG brand indicators and Verified Mark Certificates, and produces a structured result plus Authentication-Results and optional BIMI headers for messages. The module includes configurable options, caching, DNS resolver support, and tools to validate records or indicators before publication, making it useful for mail servers or processing pipelines that need to enforce or report BIMI status. Recent updates improved X509 subject parsing to reduce warnings and expanded the trusted CA list to include ssl.com.

Fsdb is a mature suite of command-line tools and Perl libraries for treating plain text tables as lightweight, pipeline-friendly databases, making it easy to extract, join, sort, pivot and compute statistics on experimental or log data without a full database server. Fsdb files use a simple header to name columns and optionally give types, and the tools (dbcol, dbrow, dbsort, dbjoin, dbcolstats, dbmapreduce and many more) let you build compact shell or Perl pipelines to filter rows, compute means, histograms, percentiles, regressions, and other statistics, or to prepare data for graphing and mail merges. It is designed to handle medium-to-large datasets efficiently by streaming and using temporary files when needed, to exploit multiple cores via parallel sorts and merges, and to transparently read compressed files or HDFS paths. Fsdb emphasizes readable schemas and provenance by logging the pipeline operations in output comments, and it includes a Perl IO API for embedding pipelines in scripts. It is not a transactional, indexed database and is focused on single-user, text-based workflows, so very large or index-heavy workloads may be better served by a full DBMS, and users should be aware of normal floating-point limits for extreme numeric ranges. Fsdb is open source (GPLv2), installs with the standard Perl build tools, and requires a modern Perl (5.8+ with some features assuming 5.10+).

Object::Cache::Sqlite is a lightweight Perl module that provides a persistent, SQLite-backed object cache with automatic time-to-live expiration. It serializes Perl scalars and complex data structures using Cpanel::JSON::XS and stores them in a single database file that the module will create if needed. The API is simple: construct with a db_file, then set keys with either a relative TTL or an absolute Unix timestamp, get and delete values, inspect counts and keys, and remove expired entries with an optional VACUUM to reclaim space. This module is a good fit when you want an easy, disk-backed cache shared across processes or restarts without deploying a separate caching service.

Cucumber::TagExpressions is a small Perl library for working with Cucumber-style tag filters: it parses tag expression strings like "@smoke and not @wip" and returns an evaluator object you can use to test whether a scenario's tags match the filter. You call Cucumber::TagExpressions->parse($expr) to get an ExpressionNode and then call ->evaluate(@tags) to check membership, which makes it convenient to select or skip Gherkin scenarios in test runners and tooling. The module is MIT licensed and is a Perl port of the widely used tag-expressions library from the Cucumber ecosystem. Recent maintenance has focused on release and packaging fixes so the distribution and test runs behave reliably when installed from CPAN.