CPANscan

Crypt::Argon2 is a Perl wrapper around the Argon2 key derivation function that makes it easy to turn passwords into secure cryptographic keys or safely store password hashes. It supports all Argon2 variants (argon2id, argon2i and argon2d) and exposes simple functions to produce encoded password strings, verify passwords, get raw digests, and check whether an existing hash needs rehashing when your parameters change. You control time cost, memory cost, parallelism and output size, and the distribution includes an argon2-calibrate helper to help pick sensible parameters for your environment. Recent releases added a way to report the optimized implementation in use, fixed an out‑of‑bounds read that became a CVE and corrected a Unicode handling bug in the pass functions, so it is both featureful and actively maintained. If you need modern, memory‑hard password hashing or key derivation from Perl and pair it with a good random salt source, this module is a practical choice.

Config::Perl::V parses the output of perl -V and returns a structured Perl data object so you can programmatically inspect both the usual %Config settings and the binary-specific details that perl prints but does not store in %Config. The module’s myconfig function returns a hashref with four main sections: build, which captures compile-time options, locally applied patches, build host and compile timestamp; environment, which by default collects PERL* environment variables but can be expanded via an option; config, which mirrors the variables reported by perl -V and Config::myconfig; and inc, the default @INC paths. You can also convert a saved perl -V text block into that same structure with plv2hash, get a compact summary with summary, and produce a reproducible MD5 signature of the summary with signature, which falls back to a zero string if Digest::MD5 is unavailable. This is useful for tooling, testing, or packaging systems that need to know the exact characteristics of the running perl binary, but note it does not detect uninstalled perls when only given -I paths on the command line.

OpenTelemetry is the Perl implementation of the OpenTelemetry API that gives Perl applications a standard, backend-agnostic way to create traces, manage context, and wire in logging and propagation tools for distributed observability. It provides a single entry point to get or set global components like tracer providers, logger providers, propagators and an error handler, plus convenience functions you can import with an otel_ prefix to work with contexts and spans. Instrumentation code uses this API to record performance and operational data but you will need an SDK such as OpenTelemetry::SDK to actually process or export those telemetry records. The module supports both method and functional styles and exposes lvalue accessors for global state, making it easy to swap providers at runtime while keeping instrumentation simple and consistent. Recent updates include fixes to span parent handling in the tracer and improvements to HTTP integrations so the user_agent attribute is only added when available, which reduces spurious warnings.

Cavil::Matcher is a high-performance pattern matcher used by the Cavil license scanner to turn source files into license and keyword hits. It keeps the proven token-hash prefix-tree approach of the prior engine but stores compiled patterns as immutable, memory-mapped segments described by a small manifest so you can add or remove patterns without rebuilding the whole cache and multiple workers on one host can share a single physical copy. The tokenizer and hashing are a frozen C++ core that preserves bit-for-bit compatibility with the old engine while the segment lifecycle and manifest handling are implemented in Perl. The module provides a simple engine API (init_matcher, add_pattern, find_matches) plus helper routines to parse pattern text into tokens (parse_tokens supports $SKIPn wildcards), normalize text into token/line/hash rows, and read raw file lines with a 1 MiB cap per physical line. There is also a streaming 128-bit hash API and a tf-idf "bag of patterns" model for closest-match queries, and the module deliberately reproduces the previous engine’s token-level edit-distance behavior (including an off-by-one quirk). Note that parse_tokens and normalize accept text and treat embedded NUL as end of input, while add_pattern/find_matches and the file reader are NUL-tolerant. This module is a good fit if you need scalable, incremental, and shareable pattern matching for license scanning or similar text-pattern tasks.

File::Unpack2 is a Perl module and command‑line unpacker that detects files by MIME type instead of trusting file name extensions and then recursively extracts a very wide range of archive and packaged formats (bz2, gz, zip, tar, cpio, rpm, deb, cab, lzma, 7z, rar, pdf, odf and more), including multiply wrapped archives. It produces a machine‑friendly JSON logfile describing each unpacked item, supports built‑in and external shellscript helpers for new MIME types, and offers controls for safe operation such as a maximum extracted file size, filesystem free‑space checks, jailed extraction options, exclude patterns, and configurable symlink handling. MIME recognition uses libmagic and shared‑mime‑info where available and can report stacked types like tar+bzip2 so helpers can unpack efficiently without unnecessary temporary files. Recent maintenance focused on robustness and safety with fixes for malicious archives, cleanup of temporary archives, a race condition that could corrupt the JSON log, and improved portability of tests.

Config::Model is a Perl framework for declaring the structure, constraints and migrations of application configuration so you can validate, upgrade and provide interactive editors without embedding all that logic in custom scripts. You express a configuration model as a declarative Perl data structure and the framework takes care of parsing and writing files through backends, validating values as they are edited, applying migrations and generating user interfaces including shell, curses or Tk front ends and a FUSE view. It is handy when you need a maintainable, reusable schema for system or application config, automated upgrade paths, on‑line help and auditable changes, and it integrates with the cme command and a GUI model editor to simplify building and running models. The project ships common backends for INI and Perl formats and supports Augeas for complex system files, and recent releases continue to polish validation and loader behavior, with the 2.166 update ensuring content checks run when fixes are applied and improving warning messages for undefined values.

Zonemaster::Backend is the server-side component that runs Zonemaster DNS zone tests asynchronously and exposes them over a JSON-RPC API so other tools or a web GUI can start tests, check progress and fetch results. It accepts single and batch test requests, schedules work to one or more test agent processes, and stores outcomes in a configurable database backend such as SQLite, MariaDB or PostgreSQL while providing command line helpers and integration for Docker and systemd. This module is useful if you need a scalable, queue-driven DNS testing service or want to embed Zonemaster testing into an automated workflow or web interface. Recent updates add an explicit schema version and GUI TLD URL support and fix a regression involving database handle reuse in child processes, so be aware that some upgrades require running the provided database migration.

Quote::LineProtocol is a small Perl helper that prepares and quotes measurement names, tag sets, field sets, and timestamps so they conform to the InfluxDB line protocol. It offers simple functions to quote a measurement, join and quote tags, format fields with automatic type guessing or explicit type/value hashrefs for floats, integers, unsigned integers, booleans, or strings, and to emit timestamps in ns, us, or ms precision with optional UTC. The module also documents a Telegraf-specific quoting mode you can enable via the QUOTE_TELEGRAF environment variable and it will skip keys with empty values. Recent updates added the ability to stringify blessed objects when building values and refreshed documentation and contact info.

Mojo::URL::Role::Auth is a tiny role for Mojo::URL that adds a single two-argument auth method to set URL userinfo, so after applying the role with with_roles('+Auth') you can call auth('username', 'password') and the URL will include credentials like https://username:password@example.com; it simply modifies the URL string rather than performing any HTTP authentication handshake. The module is minimal and focused, aimed at anyone who uses Mojo::URL and needs a quick, lightweight way to construct legacy basic-auth style URLs or to embed credentials for testing and scripting. It is distributed under the same license as Perl and recent minor updates adjusted contact info, runtime dependencies and a test path.

Scalar::ValueTags lets you attach small, propagated metadata items directly to Perl scalar values so that provenance, policy flags, or other annotations automatically follow a value as it is copied or combined. It works like Variable::Magic but tags the data rather than the container, and clients register a tags "type" that controls how tags are stored and merged so you can choose compact string sets, counted strings, append-only arrays, or unique reference-based sets depending on your needs. The API is simple: register a type, add or remove tags from a variable, read tags, and clear them, and the tags will be duplicated on assignment and merged when values are combined, which makes this useful for auditing, tracking data flow from external sources, or enforcing source-aware access rules. The module depends on the new scalar value magic in Perl core (Magic v2) so you should check value_tags_enabled before use and note that debugging facilities are minimal at present. The recent 0.004 release fixed a threading-related bug that broke threaded Perl builds.

Kwiki::Archive::Cvs is a plugin for the Kwiki wiki engine that stores page history by committing edits into a CVS repository, a direct adaptation of the original RCS-based archive module. It is intended for sites that prefer to keep wiki revisions under CVS and works by operating on a checked-out CVS sandbox placed in Kwiki's database directory, requiring a CVS client that supports the -Q option. Installation is straightforward: add Kwiki::Archive::Cvs to your plugins file and run the usual kwiki update, but be aware the module was marked deprecated in 2026 and was last updated to support newer Kwiki releases around 2008, so users should consider more modern, actively maintained version-control backends for new deployments.

Captcha::Cloudflare::Turnstile is a Perl module that makes it straightforward to integrate Cloudflare's Turnstile CAPTCHA into web applications by providing helpers to render the client widget and to verify responses on the server. It subclasses Captcha::reCAPTCHA::V3 and requires only your Turnstile secret key at construction with an optional sitekey and configurable form field name. Use scriptTag, widgetTag or the combined scripts method to inject the Turnstile JavaScript and widget into your form, and call verify to post the token to Cloudflare's siteverify endpoint and get the decoded JSON response; convenience methods verify_or_die and deny_by_score are provided but deny_by_score simply warns because Turnstile does not return a score. The module also exposes the Turnstile API URL and supports Cloudflare's dummy test keys for automated testing, though tests that exercise the client widget require running JavaScript.

SPVM::Go brings the Go language's goroutines and channels model into SPVM, letting you spawn lightweight concurrent tasks and communicate via buffered or unbuffered channels with familiar primitives like go, make, select, sleep and gosched. It integrates with the libuv event loop so waiting operations such as timers, socket I/O and channel reads/writes suspend without busy-waiting, keeping CPU usage minimal and enabling thousands of concurrent goroutines inside a single process. The distribution also provides helpers for select operations, wait groups, contexts, signal handling and time/duration utilities, and supports IO timeouts that raise specific exceptions when they occur. Note that some scheduling and sleep/IO methods must be called from the main thread and will raise exceptions otherwise. The module is actively maintained on GitHub and recent releases refactored and fully adopted libuv for timers and IO to improve scalability and reduce CPU overhead.

Protobuf is a Perl module that provides fast, low-overhead support for Google Protocol Buffers by binding to the upb C library. It lets you load descriptors or use generated message classes to create messages, serialize them to compact binary form, and parse binary data back into native Perl objects. The API includes helpers like DescriptorPool and Arena so it fits into standard protobuf workflows and emphasizes performance and compatibility with upb-based implementations. Choose this module when you need efficient protobuf serialization and deserialization in Perl for services, storage, or cross-language data interchange.

Google::gRPC is a high-performance gRPC client library for Perl that handles channel management, message framing, stream lifecycle, deadlines, status codes, and pluggable transport engines so Perl applications can talk to gRPC services such as Google APIs. It exposes focused components like a Client, Channel, Stream, Deadline, and Engine to make creating and managing gRPC connections straightforward, for example by instantiating Google::gRPC::Client->new with a target host and port. Recent work has improved portability and robustness by adding a native nghttp2 C/XS transport with a dynamic fallback to a pure-Perl Protocol::HTTP2 engine when libnghttp2 headers are not available, and the project now includes comprehensive POD documentation and test coverage to make adoption easier.

Google::Auth is a lightweight Perl library from Google that handles application default credentials and automatic project ID detection so your Perl programs can authenticate to Google APIs without custom credential plumbing. It provides a simple default($scopes, $options) entry point that returns the right credential type for the environment, whether that is a service account key, Compute Engine metadata tokens, or federated credentials, and it manages token refresh for you. Recent releases modernized the native crypto bindings for OpenSSL 3.0, expanded Workload Identity Federation and AWS IAM support, and fixed native memory handling issues in XS code to improve stability. The module is maintained by Google, documented via perldoc, and distributed under the Apache 2.0 license.

App::OrgUtils is a toolbox of small command-line utilities for working with Emacs Org‑mode files, offering scripts to list and count todos, headlines, tags, priorities and anniversaries, dump or inspect document structure, convert Org to HTML or plain text (including a Wordpress-targeted converter), sort or reverse headlines, and move or report on completed tasks. Built on Org::Parser, it is aimed at people who keep notes, task lists or calendars in Org files and want quick, scriptable ways to query, transform or export that data without writing their own parser. The distribution is script-focused and also serves as example code for integrating Org::Parser into other tools. The recent release makes parsing more robust by ignoring unknown drawers and settings by default so files with nonstandard metadata produce less noise.

Mail::Milter::Authentication is a Perl server framework that runs the authentication_milter service, providing the preforking process management and lifecycle hooks needed to apply email authentication standards from a single milter. It subclasses Net::Server::PreFork and supplies hooks for parent and child initialization, per-request processing, logging and debugging, and utilities for loading and managing modular protocol and handler components. The module also includes daemon control helpers such as start/stop/restart/status, PID and process discovery, panic email reporting, and convenience methods to inspect client details and queue IDs. Use this if you are deploying or developing an authentication milter in Perl and need a ready-made server backbone to load handlers that implement DKIM, SPF, DMARC, or other authentication logic.

POE::Component::Server::JSONUnix is a small event-driven server that listens on a Unix domain socket and speaks newline-delimited JSON, providing a simple local RPC or control endpoint for daemons, command line tools, and cron jobs. It is built on POE and exposes a pluggable command dispatch you can supply at spawn time, add at runtime, or expose by subclassing, and handlers may reply synchronously, raise errors, or answer asynchronously via a context object. The module includes handy built-ins like ping and commands and offers an ownership-based authentication handshake plus an optional per-command permission policy that can restrict access by user or group with group lookups cached per connection. It handles malformed requests and errors without disturbing other clients and will remove stale socket files on startup unless another process is actively listening.

Class::Factory is a small, practical base class for implementing the Factory Method pattern in Perl so you can map simple type names to implementation classes and create objects dynamically. You subclass it to define a common interface, then register or add types that the factory can build; add_factory_type brings a class in immediately while register_factory_type records a mapping and only loads the class when it is first requested. The module provides a standard new() constructor, helpers to list, remove or look up registered and loaded types and classes, and introspection methods so an instance can report which factory and type created it. You can override factory_log and factory_error to hook in your own logging or error handling. One important gotcha is that type mappings are stored under the class name used to register them, so register or add types on the original factory class to avoid surprises.

App::Test::Generator is a toolkit that helps Perl authors automatically create strong black‑box tests for routines and modules by turning formal input/output schemas or heuristically extracted signatures into ready‑to‑run Test::Most fuzzing harnesses. It combines randomized fuzzing, deterministic boundary cases, static corpus tests and optional property‑based checks via Test::LectroTest, and also bundles mutation testing, LCSAJ path metrics, a test‑quality dashboard, benchmark script generation, POD example round‑trip testing, and helpers to deploy CI workflows so you can run continuous fuzzing and mutation‑guided test generation in GitHub Actions. If you maintain CPAN modules or any Perl library and want to surface boundary errors, bad input handling, flaky behavior or surviving mutants without hand‑writing hundreds of cases, this module is directly relevant. The recent 0.44 release fixes side‑effect problems so generated runs no longer leave stray files, improves SchemaExtractor accuracy and robustness when inferring or respecting explicit POD types, and adds an end‑to‑end self‑fuzz test to validate the toolchain.

Data::Record::Serialize::Encode::table is a small Perl add-on that formats record data as a nicely aligned, human readable table and writes it to a file, a scalar, a GLOB, or any IO::Handle via the Data::Record::Serialize framework. It plugs into Data::Record::Serialize as an encoder and a sink and delegates the actual table layout to Term::Table, so you can control appearance with the usual Term::Table options like padding, width, and header behavior. You should not construct it directly but request it with encode => 'table' from Data::Record::Serialize and supply the required output parameter, which accepts a filename (use "-" for stdout), a scalar reference, a GLOB, or an IO::Handle; if you hand it an open handle it will not close that handle for you. There is an option to create the output directory automatically and any other Term::Table parameters are passed through unchanged. This is the initial 0.01 release.

Module::CoreList is a utility library and command-line tool that lets you look up which modules and versions shipped with specific Perl releases, helping you answer questions like whether a module is part of core, when it first appeared or was removed, and whether it has been deprecated. It offers a simple programmatic API for queries such as first_release, first_release_by_date, is_core, is_deprecated, removed_from and changes_between, plus a corelist command for quick checks from the shell. For power users it exposes data structures like %Module::CoreList::version, %delta, %released and %families and metadata about upstreams and bug trackers so you can script comparisons or audits of core module content. The module is actively maintained to follow new Perl releases and recent updates add data for the latest Perl versions, so it is a good choice if you need accurate, historical or current information about what shipped with any given Perl.

CPAN::Perl::Releases provides a static mapping from Perl release numbers to the CPAN authors/id path where that release's tarballs live, so you can look up where to download specific perl versions without scraping indices. Its perl_tarballs function takes a version string and returns a hashref of available archive types such as tar.gz, tar.bz2 or tar.xz pointing to their relative authors/id locations or undef if not found. The module also offers perl_versions to list all supported release numbers in order and perl_pumpkins to list the PAUSE IDs of Perl maintainers. The data is shipped with the module and is updated when new Perl releases are uploaded to CPAN, making this a simple, reliable helper for tools that need to locate Perl tarballs.

HTTP::Message is the core Perl class for representing an HTTP message as a set of headers plus a content body and is the base object used by higher level HTTP::Request and HTTP::Response classes. It provides constructors and parsing from strings, accessors for headers and raw content, efficient in-place content manipulation via content_ref, helpers for serializing or dumping messages, and support for multipart messages and message parts. The module also handles common content encodings and charset decoding for textual and XML media types and can apply or remove encodings like gzip, deflate, bzip2, brotli and base64 when the appropriate supporting modules are available. It delegates the wide range of header conveniences to HTTP::Headers and includes safeguards such as a configurable maximum decompressed body size to avoid unexpectedly large responses. The current release fixes a brotli decoding issue where responses could fail to decode when a maximum body size limit was set.

NBI::Slurm is a Perl toolkit that makes it easy to create, configure and submit jobs to SLURM on HPC clusters. It supplies NBI::Job to represent job scripts and NBI::Opts to declare queues, threads, memory, walltime and other SLURM options, and it includes command line utilities such as runjob, lsjobs and viewjobs so you can submit jobs, inspect output and track their status without writing raw sbatch scripts. The library wraps common tasks like generating SLURM headers, checking available queues and capturing command output so you can obtain job IDs and manage jobs programmatically. Recent updates added a slurm-status utility and improved support for job arrays to make monitoring and running array workloads simpler.

DBIx::QuickDB makes it trivial to spin up temporary database servers for testing and development so you can get a real PostgreSQL, MySQL/MariaDB/Percona, SQLite or optional DuckDB instance up and running in a disposable directory and connect to it with DBI. You can declare named databases at compile time that expose connectable constants or create them on the fly with build_db, and each instance can be tuned with a spec (autostart/autostop, bootstrap, cleanup, data directory, driver choice, SQL to preload, and more). It is designed for test suites and short-lived environments and will automatically manage startup, shutdown and optional cleanup of the data directory, so do not enable cleanup on any important persistent database. Environment variables like QDB_TMPDIR and DB_VERBOSE control temp locations and server output, and recent improvements added a no_disconnect_handles option for callers that keep live DBI handles and made teardown and Windows cleanup far more robust.

MooX::LazierAttributes provides a compact DSL for declaring Moo or Moose attributes so you can write far less boilerplate when building attribute-heavy classes. It exports an attributes() helper that turns concise array-style specifications into full has declarations and a set of small constants like is_ro, is_rw, lzy, bld and handy defaults such as lzy_array or dstr to reduce repetition when declaring read-only or read-write, lazy, typed, built or required attributes. The module understands Types::Standard and Type::Tiny constraints, accepts CODE-ref defaults and lazy builders, and includes support for extending parent attributes with a '+name' syntax. Recent notable improvements added attribute extension with '+', Type::Tiny support, defaulting to ro when omitted, and a coe constant for coercion, making it a simple way to keep attribute declarations clear and concise.

Eshu is an XS-powered tool that automatically fixes indentation and produces syntax-highlighted HTML for a wide range of programming and markup languages. It rewrites only leading whitespace while tracking language-specific nesting so your code content stays intact and the output is consistently formatted. You can call per-language methods from Perl or use the convenience dispatcher to detect language by filename, and there is a command-line tool and a vim plugin for editing workflows. The library supports many languages out of the box including C, Perl, JavaScript and TypeScript, Python, Go, Rust, Java, PHP, Ruby, Lua, Bash, SQL, YAML, JSON, XML/HTML, CSS and POD, and it offers options to use tabs or spaces and to set indent width. It also provides file and directory helpers that can run dry runs, produce diffs, write fixes back to disk, and skip binary or oversized files. The highlighting API returns HTML with span classes for tokens so it can be styled easily. Recent releases added an XS-backed highlighting pass and expanded language support to TypeScript, Python, Go, Rust, Java, PHP, Ruby, Lua, Bash, SQL, YAML and JSON.