CPANscan

Cavil::Matcher is a high-performance engine for finding license text and other keyword patterns in source code, designed to power the Cavil scanning tool. It tokenizes input and matches against compiled patterns stored as immutable, memory-mapped segments so you can add or remove patterns without rebuilding the entire cache and multiple worker processes can share one physical copy of the index. The module exposes a simple API to build an engine, parse human-readable pattern text (including limited $SKIP wildcards), add patterns, scan files for matches, and manage compiled segment files with load, attach and verify operations. It also provides streaming content hashing and a TF-IDF "bag of patterns" closest-match model for provenance-style queries, plus utilities to normalize text and compute an approximate token edit distance for legacy compatibility. Note that tokenization functions treat embedded NUL as a string terminator but the file-scanning path is NUL-tolerant for real source files. In the most recent 1.05 release the on-disk fingerprint index was removed so consumers must now keep the searchable fingerprint index in their own database, while the fingerprinting primitives remain unchanged.

App::PDFLibrarian is a command-line toolkit for researchers and LaTeX users who want to keep PDF copies of academic papers and their BibTeX metadata synchronized. It lets you import PDFs with embedded BibTeX, edit those embedded entries, export a combined .bib file, generate citation keys, replace or remove PDF files, rebuild internal links, and produce ISO4 journal abbreviations, so you can manage a searchable, versionable library of papers alongside your bibliography. The tools rely on common Linux utilities such as poppler and Ghostscript and are installed from CPAN. The module is practical if you need lightweight, file-centric BibTeX management and is distributed under the GPLv3.

PAGI::FastAPI is an asynchronous, FastAPI-inspired micro-framework for modern Perl that gives you non-blocking request handling on the PAGI spec, Type::Tiny driven validation for query, body and path parameters, a simple dependency injection style, and automatic OpenAPI 3.1 and Swagger UI documentation so you can build typed, documented HTTP APIs quickly. It includes route helpers for the usual verbs, WebSocket and Server-Sent Events streaming, middleware and CORS integration, pluggable authentication via dependencies or the companion PAGI::FastAPI::Security distribution, rate limiting, bot protection, CSRF helpers, response helpers for redirects and files, and a lightweight async queue facade. The recent 1.7.0 release adds proper RFC 7578 multipart/form-data parsing with form_data() and uploaded_files() context helpers, a $c->background API for fire-and-forget async tasks that continue after a response is sent, richer per-route OpenAPI metadata and Swagger UI customization options, plus a file response helper. Note that uploaded files and file_response currently read file contents into memory so you should plan request size limits accordingly. If you want a modern, type-safe, async-first framework for building Perl microservices with built-in docs and streaming support, this module is worth exploring.

Connector is a lightweight base class and adapter framework for accessing hierarchical configuration or similar structured data through a uniform get(KEY) style interface, letting different backends look and behave the same to your code. It is often used as a proxy to simple sources like YAML or Config::Std or to more complex systems such as LDAP or external processes, and it supports meta-connectors that combine multiple backends for redirection, cascading, or round-robin use. The interface includes methods to fetch scalars, lists or hashes, to set values, to inspect node metadata and to clean up resources, and it offers a die_on_undef option to control whether missing nodes trigger errors. Connector is intended as a base class for implementers rather than something you normally instantiate directly, and custom connectors must implement get_meta and at least one data getter to be efficient. Recent packaging updates include switching from Syntax::Keyword::Try to Feature::Compat::Try, raising the minimum Perl requirement to 5.014 and cleaning up dependency declarations, making it easier to use on modern Perl installations.

Alien::wasmtime is a helper module that finds or downloads the wasmtime WebAssembly runtime so other Perl modules can use it via FFI. It exposes a dynamic_libs method that returns the shared libraries you hand to FFI::Platypus and lets you override the downloaded version with the ALIEN_WASMTIME_VERSION environment variable. This distribution is aimed at module authors building FFI bindings rather than users who want a high level WebAssembly API, so if you want to call Wasm from Perl directly you should look at Wasm or Wasm::Wasmtime. Be aware that wasmtime and the wider Wasm ecosystem are still changing, so you may see occasional breakage, and this Alien currently prefers downloading a binary rather than probing system package managers.

SPVM::Resource::UV packages the libuv v1.52.1 C library as a build-time resource for SPVM projects, supplying the headers, sources, platform-specific compiler flags and link libraries needed to use libuv from SPVM native code. It makes it simple to register libuv with the SPVM builder so your module can add the required defines and libs, include uv.h and call into libuv to access its event loop, timers, async I/O, TCP/UDP and other cross-platform primitives. The resource targets C99 and includes Unix, Linux, macOS and Windows sources and flags, is distributed under the MIT license, and is maintained on GitHub by Yuki Kimoto.

Mojolicious is a modern, full-featured real-time web framework for Perl built on the Mojo toolkit. It provides RESTful routing, controller actions, Perl-style templates, content negotiation and signed cookie sessions, along with form validation, a static file server, an integrated command-line and a built-in HTTP server so you can prototype and deploy quickly. The framework exposes hooks and helpers for application-wide customization, a plugin system, bundled testing tools and a full HTTP user agent for calling other services. It ships with good documentation and sensible defaults while reminding you to replace insecure default secrets, making it a practical choice for building APIs, web services and interactive apps in Perl.

Geo::Elevation::HGT is a lightweight Perl utility for turning latitude and longitude into elevation values by reading HGT digital elevation tiles, by default pulled from the Mapzen/Amazon S3 terrain-tiles repository, or from a local folder or user-provided tile set. You call get_elevation_hgt with decimal-degree coordinates and it returns elevation in meters using bilinear interpolation by default and optional bicubic interpolation for slightly smoother peak estimates. The module streams gzipped or zipped HGT files, caches downloaded tiles if you provide a cache folder, and keeps tiles in memory so repeated lookups across a GPX track are very fast. Results reflect the underlying SRTM and similar DEM sources, which tend to smooth sharp peaks and may report values below commonly quoted summit elevations. The module has only core Perl dependencies, requires you to respect the data provider terms, and is handy for generating elevation profiles or enriching location data without heavy GIS toolchains.

JSON::Schema::Validate is a compact, dependency-light Perl validator for JSON Schema draft 2020-12 that emphasizes correctness and recursion safety while implementing the features most people need in production. It handles $ref, $dynamicRef and anchors, supports unevaluatedItems and unevaluatedProperties with proper annotation tracking, covers the usual keywords and combinators, includes builtin format validators for date/time, email, hostname, IP, URI, UUID and JSON Pointer and lets you register custom format or media handlers, and offers optional pruning of unknown object properties. The module provides a simple API to construct a validator from a decoded schema and call validate or is_valid, exposes structured error objects and tracing, and includes an optional compile mode that precompiles small closures for better steady-state performance. It can also generate a standalone JavaScript validator for client-side preflight checks while keeping the Perl engine as the source of truth. Recent releases fixed an internal compile node bug in v0.9.1 and tightened the IRI format validation in v0.9.0.

Perl::Critic::Policy::ProhibitUnusedImports is a Perl::Critic rule that helps you find and remove import lines that bring symbols into a file but are never actually used, reducing unnecessary dependencies and startup cost. It checks what each use statement imports and reports when none of those names appear later in the source, treating a plain use of a module as relying on that module's default exports and a use Module() form as importing nothing so the module name itself must be referenced. Common pragmas and modules that exist solely for side effects are exempt by default and you can add your own exceptions with the allow setting. Be aware that the policy may miss cases where names are introduced only at runtime by symbolic calls or eval, and that it may need to load a module to inspect its exports which runs top level code, so enabling this check requires Perl::Critic’s unsafe checks to be allowed. The rule is aimed at maintenance and performance improvements and is rated with low default severity.

Perl::Critic::Policy::ProhibitNoWarningsRedefine is a linting rule for Perl that stops you from turning off the "redefine" warning, a common but risky shortcut used when tests replace existing subs by hand because it can hide typos that install new, unused symbols and let tests pass incorrectly. The policy flags explicit no warnings 'redefine' and even a bare no warnings since that also suppresses the category, and it recommends using Test::MockModule instead because that checks the sub exists, scopes the mock, and restores the original at scope exit without disabling warnings. You can configure which warning categories are forbidden, the default is "redefine", and the policy is intended for test and maintenance code with high severity to help avoid subtle, hard‑to‑find bugs.

Perl::Critic::Policy::RequireFatalWarnings is a linting policy that insists Perl files turn Perl-raised warnings into fatal errors by using use warnings FATAL => 'all' instead of plain use warnings or no warnings at all, so problems like uninitialized values fail fast instead of getting buried in logs. It helps catch subtle bugs early in development and in long running programs by forcing execution to stop where Perl itself raises a warning. The policy can be told about equivalent modules that already enable fatal warnings for you so it does not produce false positives. Be aware that making warnings fatal in a module used by others can cause callers to die unexpectedly, which is why this rule is opt in for many distributions.

Lucy is a Perl interface to a high-performance, modular full‑text search engine that makes it easy to index and search large document collections with features such as incremental and near‑real‑time updates, Unicode-aware analysis, boolean and phrase queries, stemming, stoplists, customizable analyzers, result highlighting, and flexible sorting. It offers both a full-featured API for building complex indexing and query pipelines and a simpler Lucy::Simple wrapper plus tutorials for quick starts. Distributed search support exists via companion LucyX::Remote modules which are no longer shipped on CPAN but remain available from the project repository. The recent 0.8.0 release fixes several security issues and robustness bugs. Be aware that the main Lucy namespace is an API-unstable development branch, the library is not thread-safe, and some exceptions can leak memory. Lucy is distributed under the Apache 2.0 license.

Catalyst::Seal is a drop-in performance addon for Catalyst web apps that freezes the application at setup and compiles its runtime metadata into constant, fast paths so requests do far less work. You enable it by putting use Catalyst::Seal above use Catalyst in your app and nothing else changes in your code. At a high level it makes the application immutable, replaces repeated metaobject lookups and wrapper trampolines with constant or XS accessors, memoizes frequent action and encoding decisions, avoids rebuilding common structures like headers and canonical URIs, and skips or defers work that cannot change after setup. The net effect is a large reduction in per-request overhead and a several-fold increase in throughput in benchmarks, for example improving a simple app from about 6.6k to about 20.4k requests per second in the author’s tests. There is a hard kill switch via the CATALYST_SEAL environment variable and a debug flag to report what was sealed. This is the initial 0.01 release.

MIDI::Util is a compact collection of helper routines for creating, inspecting and playing MIDI from Perl, designed to sit alongside MIDI::Simple and make common tasks easier. It gives you setup_score to build a ready-to-use score with sensible defaults like tempo, channel, patch and optional lead-in, utilities to normalize note names and compute duration sizes and ticks, functions to inspect internal MIDI tables and produce reverse lookups, and simple ways to set time signatures and channel patches. It also computes timing in microseconds, converts a MIDI::Simple score into raw event arrays, and can generate timidity configuration snippets or drive timidity and fluidsynth for immediate playback. Nothing is exported by default so you import just the helpers you need. This module is useful if you generate MIDI programmatically, need quick utilities for debugging or transforming MIDI data, or want a straightforward path to play scores through software synths.

Perl::Critic::Policy::RequireQwForLiteralLists is a Perl::Critic rule that spots runs of plain quoted words used as a list and recommends replacing them with a qw() literal to make command-style argument lists shorter and easier to read. It emits a single low-severity violation per run and lets you configure how long a sequence must be before it triggers (min_run_length, default 3), so very short lists are left alone. The policy ignores cases where qw() would change meaning, for example interpolated strings, items containing whitespace or escapes, and hash initializers, and it will not detect a run that is split by an existing qw() fragment. This is a cosmetic maintenance rule intended to reduce punctuation noise and clarify intent in Perl list usage.

Perl::Critic::Policy::ProhibitUsageSubs is a Perl::Critic rule that helps prevent duplication of a script's command line documentation by flagging locally defined subroutines named usage, _usage, print_usage, usage_message, help or other names you configure that return usage text. It encourages you to document the interface once in POD and call Pod::Usage or pod2usage to display it, which avoids the common problem of a hand-rolled usage sub getting out of sync with the real documentation. The policy reports actual sub declarations with the configured names but permits calls to pod2usage and imported usage functions and does not flag forward declarations. The list of names is configurable and the rule focuses on maintainability and documentation quality while noting that it can only detect problems by name so unrelated functions using the same name may be reported.

Perl::Critic::Policy::ProhibitUseLib is a lint rule for Perl::Critic that flags fragile uses of the lib pragma such as use lib "$FindBin::Bin/../lib" or hardcoded paths, because those hand-written @INC additions break when scripts move and can load the wrong or stale modules. It encourages using FindBin::libs which walks up from the script and finds the correct lib directory automatically. The policy detects configured pragma names (defaulting to lib and lib::relative), leaves no lib alone, and only reports explicit use statements so other ways of mutating @INC are not caught. It is a medium severity rule aimed at improving maintenance and portability. This is the initial 1.000 release.

Music::Scales is a small Perl library that generates musical scales from a given keynote and scale name, returning note names, semitone offset maps, MIDI note numbers, or PDL-style note strings so you can plug scale data straight into MIDI, analysis or notation code. It understands a wide range of modes and scale types from common ones like major, minor, harmonic and melodic minor, pentatonic and blues through chromatic, whole-tone and several exotic scales, and it accepts abbreviated scale names for convenience. You can request ascending or descending variants where applicable, get enharmonic spellings chosen to match the key or force sharps or flats, and quickly test whether a name is a valid scale. The module exports simple functions for these tasks and is handy for music scripting and prototyping, though the author notes a few remaining enharmonic edge cases and lists additional scale types and microtone support as future work.

MooX::Tag::TO_HASH is a Moo role that gives you a simple, declarative way to turn Moo objects into plain Perl hashes for serialization or inspection. You mark attributes with the to_hash option when you declare them and then call the TO_HASH method on an instance to get a hash of only those fields. You can rename keys and control inclusion with flags such as if_exists which includes a key only if the attribute was set, if_defined which requires a defined value, and no_recurse which prevents the module from walking into nested arrays, hashes, or objects. Attributes inherited from parent classes or roles are handled automatically. If your class needs to tweak the produced hash you can implement a _modify_hashr or modify_hashr method to edit the hash in place. Previously recommended use of method modifiers to change the output is discouraged because it can behave incorrectly with inherited roles. This module is a lightweight, configurable choice when you need predictable, attribute-level control over how Moo objects are converted to hashes for JSON, APIs, debugging, or persistence.

Playwright is a Perl client that lets you control modern browsers via Playwright by talking to a small Node.js proxy server, exposing Playwright concepts as familiar Perl objects like Browser, Page, BrowserContext, ElementHandle and Locator so you can navigate pages, query and interact with the DOM, run JavaScript, handle events and await asynchronous operations from Perl code. The module can auto-check and help install required node dependencies but you may need to set NODE_PATH or use nvm to ensure a recent Node.js is available. It adapts Playwright naming to Perl by providing select/selectMulti and related helpers, wraps evaluate calls so script bodies behave like function bodies and translates ElementHandle arguments into DOM nodes for you. Advanced features include connecting to remote playwright_server instances or Chrome CDP endpoints, saving videos and downloads via saveAs, issuing arbitrary HTTP requests through an APIRequestContext, and helpers for timeout management and test-style workflows. The project is actively maintained and the recent 1.621 release updates compatibility with a newer Playwright version, refreshes the video API example and improves guidance about NODE_PATH.

SimpleFlow is a compact, pure-Perl workflow manager and logger that makes long shell pipelines easier to run, debug and reproduce. You express each step with a single task() call and SimpleFlow checks inputs and outputs, times the command, captures stdout, stderr, exit code and signal, logs a structured record and skips work that is already done unless you force overwrite. It supports dry runs, quiet logging, running commands without a shell by passing cmd as an array ref, optional stale-file checking like make or snakemake, and a POSIX-only timeout that kills a whole process group if a step hangs. task() always returns a detailed hashref so callers can inspect outcomes, and say2() prints a timestamped message to both STDOUT and a log file. Note that SimpleFlow runs the command you give it via system, so keeping the commands themselves portable across platforms is your responsibility.

EV::WebKit is a Perl module for driving a real, in-process WebKitGTK 6.0 (GTK4) browser from the EV event loop, providing asynchronous, callback-driven automation for navigation, DOM queries and manipulation, JavaScript execution, screenshots and PDF export, downloads and uploads, cookie management, request/response interception, and device fingerprinting including optional network-level impersonation via a local proxy. It exposes lightweight element handles, supports frame addressing, user scripts and styles, a visible minimal chrome mode or headless use under xvfb, and integrates cleanly with other EV-based code because it bridges WebKitGTK into EV via EV::Glib. The implementation is pure Perl over GObject Introspection with a small optional compiled web-process extension for extra features. It requires WebKitGTK/GTK4/JavaScriptCore/libsoup typelibs and an X display or xvfb to run and may need container privileges or sandbox tweaks for WebKit’s bubblewrap. In the 0.02 release fingerprint profiles now apply inside Worker and SharedWorker scopes and a new fonts option lets you control the font set the page can see.

Syntax::Operator::Equ adds tidy, undef-aware equality operators to Perl so you can test strings or numbers while treating undef as its own distinct value rather than as the empty string or zero. It provides the infix operator equ for string equality and === for numeric equality, both of which return true when both sides are undef, false when exactly one side is undef, and otherwise behave like normal eq or == without producing uninitialized-value warnings. For older Perls that lack custom infix support you can still use the same tests via wrapper functions is_strequ and is_numequ or via XS::Parse::Infix and Syntax::Keyword::Match, and the wrappers are written so they are usually inlined for good performance. Note that this behavior has been adopted into Perl itself as PPC0030 and appears in core from Perl 5.45.3 onward, so the module remains useful on earlier releases but is redundant on that and later core versions.

Proxy::Impersonate is a small EV-driven local forward proxy that lets a client like EV::WebKit present the connection fingerprint of a real browser to upstream servers by terminating TLS on localhost and re-originating each request through Curl::Impersonate so the origin sees the chosen browser's TLS and HTTP/2 fingerprints. It is designed to be used as an HTTP/HTTPS proxy for tooling that cannot itself reproduce a browser handshake and provides per-request hooks to rewrite, mock, or block requests and to observe or modify response headers while still verifying the real origin certificate upstream by default. It is not a full browser replacement: HTTP/3, WebSockets and streaming uploads are out of scope, request bodies are buffered, and some header-order and HTTP/2 priority nuances are not reproduced exactly. Because WebKitGTK cannot be told to trust a custom CA the proxy uses a local self-signed cert and expects the client to accept it on the localhost hop. In the recent 0.02 release upstream responses are now decompressed before being forwarded so pages served with encodings the client cannot decode (for example zstd) render correctly and the module now requires Curl::Impersonate 0.02.

Curl::Impersonate is a Perl HTTP client that drives a patched libcurl (libcurl-impersonate via Alien::curlimpersonate) so your requests carry a real browser's TLS (JA3/JA4) and HTTP/2 connection fingerprint, making it useful when you need connections to look like specific browsers. It is an HTTP client rather than a full browser so it does not execute JavaScript and currently does not cover HTTP/3 or WebSockets. You can use it synchronously or concurrently with a curl_multi-based Multi interface that supports streaming responses, backpressure, and event-loop integration, and it verifies TLS by default while allowing options like timeouts, proxies, header control and redirect behavior. Note that a proxy that terminates TLS will present its own fingerprint unless you tunnel with CONNECT. Installing the module builds libcurl-impersonate at install time so a C/C++ toolchain plus cmake, ninja, go and patch are required. Recent releases added a decode option to let libcurl decompress response bodies for you.

Cpanel::JSON::XS is a fast, C-backed JSON encoder/decoder for Perl maintained as a cPanel fork of JSON::XS that focuses on correctness and Unicode handling. It offers both simple functional helpers and a configurable object interface to control encoding details such as UTF-8/ASCII/Latin1 output, pretty printing, canonical key sorting, handling of blessed objects, big-number support, relaxed parsing extensions, incremental parsing for streams, and BOM detection. The module aims to preserve round-trip integrity, is thread-safe, interoperates with JSON::MaybeXS, and provides security-conscious defaults while letting you opt into more lenient behavior. Recent notable updates include making non-reference top-level values accepted by default for compatibility with the broader Perl JSON ecosystem while keeping an option to require array or object top-levels for stricter security, and a 2026 fix that prevents an infinite loop when sorting malformed UTF-8 hash keys. Use Cpanel::JSON::XS when you need a high-performance, well-tested JSON layer in Perl that handles Unicode and edge cases reliably.

App::Netdisco is an open source, web-based network management application that inventories and maps your switches and routers by collecting SNMP data into a PostgreSQL database and presenting it via a built-in web UI and backend daemon. Network engineers can use it to locate a host by MAC or IP and see the switch port it sits on, change port state or VLAN and PoE settings, run discovery and polling jobs, and produce inventory and topology views for troubleshooting and reporting. It installs on a standard Perl/Postgres stack and can be run in a self-contained user environment or via provided container images, with command-line tools for deployment, discovery and job control and a DBIx::Class API for integrations and plugins. The project is actively maintained and recent releases modernized the frontend libraries, improved SNMP support (including better Cisco WLC handling), and added performance and API refinements, so it is a good fit if you need an open, extensible tool to discover, track and control layer‑2/3 network devices.

SPVM::Go brings Go-style concurrency to SPVM by providing lightweight goroutines and channels so you can run many concurrent tasks and pass data between them with a familiar Go-like API. You spawn tasks with Go->go, create buffered channels with Go->make, use select-like primitives and wait or sleep with timeout-aware methods for IO and timers. The runtime integrates libuv to drive timers, socket IO and channel waits so goroutines suspend without busy waiting and the process consumes almost no CPU while idle, making it practical to run thousands of goroutines in a single process. Several scheduler operations must be invoked from the main thread and IO timeouts raise Go::Error::IOTimeout exceptions. The distribution also provides helpers such as Go::Select, Go::Sync::WaitGroup and Go::Context and respects the SPVM_GO_DEBUG environment variable for debugging. If you need scalable, low-CPU asynchronous concurrency in SPVM, this module is a good fit and recent work focused on replacing polling with a libuv-backed event loop to improve efficiency and robustness.

Syntax::Keyword::Assert provides a simple assert keyword for Perl so you can write inline checks that die with a clear, user-friendly message when a condition fails but disappear with zero runtime cost when you disable them before loading the module. Assertions are enabled by default and can be turned off by setting $ENV{PERL_ASSERT_ENABLED} to a false value in a BEGIN block, in which case the asserts are removed at compile time so there is no performance penalty in production. You can pass an optional custom message that is evaluated lazily only on failure so expensive diagnostics are not computed when assertions pass. The keyword is lexically scoped and can be imported into other modules via import_into for toolkits, and it can be explicitly unimported so the name reverts to a normal function call. Error messages have been improved over time to include common operators and isa checks. Recent updates added lazy-evaluated messages and custom message support, and the latest release documents unimport behavior and adds compatibility with modern Perl releases.