CPANscan

CPANSA::DB packages the CPAN Security Advisory feed as a ready-to-use Perl data structure and exposes a single db method that returns a hash reference of all advisory reports. It is used by CPAN::Audit but can be used by any Perl program that needs a local, programmatic snapshot of CPAN security advisories. Releases are distributed on GitHub and include a JSON equivalent, GPG signatures, and GitHub attestations so you can verify the archive came from the official source before trusting the data. Use this module when you want an easy, verifiable way to load CPAN advisory data into your Perl code.

HTTP::API::Core is a lightweight, composable foundation for building JSON HTTP API clients in Perl. It centralizes base URL and default header handling, provides convenience methods for common HTTP verbs, and makes JSON encoding and decoding straightforward while letting you configure timeouts and a conservative automatic retry policy with exponential backoff and jitter. The module includes pagination helpers for next-url, page-number, and cursor styles, normalizes common rate-limit headers into a simple rate-limit object, and returns structured errors with useful metadata so callers can decide how to handle failures. Lifecycle hooks let you inject authentication, tracing, or custom headers before requests and inspect responses or errors afterward. The transport layer is pluggable so you can supply a code reference or an object that implements a request method. This 0.01 release also marks a namespace rename from the pre-release HTTP::API::Client project and intentionally keeps higher-level concerns like logging and metrics out of the core so you can build your own service-specific clients on top.

App::cpm is a fast command-line CPAN installer for Perl that emphasizes stable, predictable installs by preparing dependency builds first and doing the final installation step separately. It installs requested distributions and their runtime dependency closure, supports cpanfile input and reading module lists from STDIN, and speeds work with parallel build flow and optional prebuilt caches. The tool aims to be more reliable than ad hoc installers when you have large dependency graphs or CI workflows. Recent releases added installer customization and an experimental config option and now include GitHub artifact attestations for release tarballs so you can verify provenance. Use cpm when you want a quick, reproducible way to fetch and install CPAN modules.

Crypt::OpenSSL::PKCS12 is a Perl wrapper around OpenSSL's PKCS#12 functions that makes it easy to load, inspect, extract and create .p12/.pfx bundles from Perl code. You can open a PKCS12 file or binary string and get the end-entity certificate, CA chain and private key as PEM, verify the file MAC, dump human-readable or structured info, and create PKCS12 files or raw DER strings for storage or transport. It implements a useful subset of the OpenSSL PKCS12 API, mirrors many openssl pkcs12 options, and requires a system OpenSSL and Perl 5.14 or newer. Recent updates add OpenSSL 4.0 compatibility and important security fixes, but note that changepass() cannot rekey PBES2-encrypted bundles on OpenSSL 3.x/4.x due to an upstream limitation, so re-creating the bundle is the recommended workaround.

Regexp::Compare provides a simple predicate is_less_or_equal($a,$b) that tells you whether every string matched by one regular expression is also matched by another, which is handy for spotting duplicate or redundant regex rules when optimizing blacklist or pattern sets. You pass the regexes as strings, so include inline modifiers like (?i:pat) rather than using /pat/i syntax. The module works well for straightforward patterns and quick redundancy checks, but it does not handle many advanced Perl regex features. It cannot reliably compare expressions that use Perl code or backreferences, it may fail for locale-specific constructs, it ignores global regex-related variables, character class comparison is simplified and can be incorrect in edge cases, EBCDIC platforms are unsupported, and some unusual but legal constructs can cause it to die.

Lingua::famibeib is the top-level Perl module for working with famibeib, a constructed language, and it provides the entry point to a small ecosystem for parsing and manipulating famibeib text, sentences, and words. Most users will work with the companion modules Lingua::famibeib::Text for text handling and parsing, Lingua::famibeib::Sentence for sentence-level operations, and Lingua::famibeib::Word for word-level analysis and transformations. The distribution supports parsing number words, verb and modifier handling, prefix queries and improved prefix logic for common particles, and has explicit support for foreign words and experimental name generation. It integrates with common identifier and language interfaces so it can be used alongside other Lingua and Data::Identifier tools. Recent updates added a formal word interface implementation and expanded the set of known classes to include word, modifier, and prefix, making the module more extensible for tooling and generation tasks.

WebDyne is the core runtime and rendering engine for the WebDyne framework that turns ".psp" pages into complete HTML either inside a web runtime like Apache/mod_perl, PSGI, or PAGI or from standalone scripts and tooling. It exposes simple script-facing helpers (html and html_sr) for rendering templates with parameters or writing directly to a filehandle, and it integrates features useful for web apps such as embedded Perl in HTML, compile-time parsing and caching, templating, filters, CGI-style parameter access, and a request abstraction that unifies standalone, PSGI, and PAGI execution. The module is suitable both for running full WebDyne applications under a server and for offline generation, diagnostics, or test utilities via the bundled wdrender helper. Recent maintenance has focused on stability and testing, including normalizing boolean wrapper options so diagnostic dumps are consistent across environments and improving PAGI test diagnostics and wrapper test resilience.

Data::Identifier provides a single, format‑independent object for working with identifiers such as UUIDs, OIDs, URIs and many well known types (GTIN, IBAN, DOI, Wikidata IDs and more), letting you normalize, compare, convert and generate identifiers without tying your code to one specific string format. It stores both the raw value and its type, can produce alternate representations (uuid, oid, uri, sid, ise), convert identifiers into other objects or packages, generate secure random identifiers, and offer human-friendly metadata like displayname and tagname; it also supports optional registration to deduplicate frequently used identifiers for better runtime performance. Validation and normalization are applied where feasible, but not all invalid values are guaranteed to be rejected, and some advanced features are marked experimental or opt‑in for performance reasons. The module has recently fixed displayname calculation from Data::TagDB::Tag objects and includes a workaround for a bug in I18N::LangTags::List, making name handling more reliable in current Perl releases.

App::Yath::Script is the startup engine for the yath test harness script, providing the BEGIN-time and runtime entry points (do_begin and do_runtime) that discover project and user configuration (.yath.rc and .yath.user.rc), determine which versioned harness implementation to run (App::Yath::Script::V#), inject development library paths into @INC, and delegate actual execution to the selected version module. It implements a clear version selection policy that accepts an explicit V# on the command line, scans versioned rc files or symlinks walking up from the current directory, checks for a local working-copy V# module, and finally falls back to the highest installed V# in @INC while reserving V0 for explicit validation only, with user-level rc able to override project-level choices. The module also exposes small but useful utilities for scripts and tooling, including retrieving the current script and module names, re-execing the script while preserving include paths, normalizing and resolving filesystem paths, finding files by searching upward through parent directories, and converting module names to file paths. Recent changes modernize version detection to use versioned rc filenames and symlink targets and ensure @INC hooks survive the module's self re-exec cycles, which helps development workflows that rely on custom include hooks.

JQ::Lite is a pure-Perl, jq-compatible JSON query engine that lets you run familiar jq-style filters and traversals without installing the jq binary or any XS modules. You can use it as a library from Perl code with a simple new/run_query API or as the bundled jq-lite command line tool and REPL, making it useful in minimal containers, restricted servers, CI pipelines, legacy systems, or air-gapped environments. It supports jq-like dot notation, array flattening and indexing, select() predicates, pipe-style chaining, map and transformation helpers, grouping and aggregation functions, string and path utilities, and a long list of built-in helpers so most common jq workflows work the same way. The implementation requires only core JSON::PP or optional faster JSON::XS variants and aims for stable CLI packaging and predictable behavior. The recent 2.50 release documents a stable library API, clarifies public versus internal boundaries, and adds structured exceptions and integration guidance to make embedding JQ::Lite in other applications and distributions safer and easier.

URI::Encode is a small, easy-to-use Perl module for percent-encoding and decoding URIs that provides both an object-oriented API and simple functional helpers. By default it preserves reserved characters so links remain human-friendly and clickable in plain text, and it converts input to UTF-8 before encoding; options let you force encoding of reserved characters or prevent double-encoding of already-percent-encoded data. It is handy when preparing URLs for HTTP clients or embedding links in email and is a portable alternative to faster XS-based encoders like URI::Escape::XS. The module depends on Encode and has seen fixes for correct decoding of lower-case percent sequences and for double-encoding behavior, with a recent cleanup removing use of the special $' variable.

Test::JSON::Schema::Acceptance lets Perl projects run the official JSON Schema Test Suite to confirm that a JSON Schema validator implements the specification correctly and interoperates with other implementations. You give it a small adapter callback that validates either Perl data structures or JSON strings and it will run the suite for a chosen draft (draft3 through draft2020-12, v1, or a custom test directory), handle remote resources when needed, mark individual tests as TODO or skip, and produce per-file pass/fail summaries and diagnostic output. It is primarily useful to library authors and integrators who need automated acceptance testing against the canonical test data rather than to general application developers. Recent releases updated the bundled test data and removed a dependency on Ref::Util to simplify installation.

Syntax::Highlight::Basic is a lightweight, pure-Perl library for turning source code into highlighted output that is easy to embed in web pages or terminals. It builds simplified runtime data from Vim syntax files and then tokenizes code into Vim-compatible highlight groups so you can produce HTML with Pygments-style CSS classes, HTML with inline styles, or ANSI terminal color escapes. You create an instance with optional syntax_dirs to supply custom language data, then call highlight($code, $language, \%opts) to get formatted output and choose format and wrapping. The module includes a fallback tokenizer if no specific language is provided and is geared toward projects that need a simple, portable highlighter without external dependencies.

Media::AssetView helps you organize media repositories by building a parallel Views hierarchy of symlinks from a simple Assets layout so you can browse or serve the same files grouped by attributes like character, product, type or whether AI was used. You keep your actual media in assets/ following a compact naming convention and run the exportable create_views_symlinks function to populate views/ directories without duplicating files. That function is not exported by default and returns an enveloped array with HTTP-like status codes, a reason string and optional payload and metadata so callers can detect success or failure programmatically. This is useful for teams or automation that need to curate, filter or present large photo, audio and video collections using filesystem-level views.

Net::OAuth is a low-level Perl library for composing, signing, parsing and verifying OAuth 1.0 protocol messages, giving you classes for the common request and response types and helpers to serialize to or from Authorization headers, URLs, CGI/Catalyst parameter hashes and POST bodies. It focuses on message construction and signature handling rather than managing tokens or providing a full service provider or consumer framework, so most users building clients will start with Net::OAuth::Client which wraps the usual request-token, authorize and access-token flow. The module supports PLAINTEXT, HMAC-SHA1, HMAC-SHA256 and RSA-SHA1 signatures and handles OAuth 1.0a features and UTF-8 encoding rules; messages can be inspected and manipulated via simple accessors and exported as URL query strings, form bodies or authorization headers. Recent maintenance releases emphasize security and interoperability, notably fixing resource-exhaustion and downgrade behaviors, pinning RSA-SHA1 padding and hash choices to maintain RFC 5849 compatibility, switching to Crypt::SysRandom for nonces, and updating tests and documentation, so it is a safe and practical choice when you need direct control over OAuth message handling in Perl.

MIDI::RtMidi::FFI is a thin Perl FFI binding to the RtMidi C library that gives Perl programs low-latency realtime MIDI input and output across platforms such as ALSA, JACK, CoreMIDI and Windows Multimedia. It exposes RtMidi's C API so you can enumerate and open ports, create virtual ports (not on Windows), send and receive raw MIDI messages, and hook a callback or obtain a nonblocking filehandle for integration with event loops. Higher-level conveniences are available via the companion MIDI::RtMidi::FFI::Device class and message encoding/decoding is handled through MIDI::Stream for easier construction and parsing of MIDI events. The module requires librtmidi 4.0.0 or later and while it is functional it is described as alpha software so you should expect occasional instability; the recent 0.13 update added device methods connected_to() and connected_to_name() to report what remote endpoint a port is linked to and included documentation and dependency cleanup.

Litavis is a high-performance CSS preprocessor and compiler written in portable C and exposed to Perl via XS, designed to replace the pure-Perl Crayon with a focus on speed and correctness. It provides familiar preprocessing features such as nested selectors and parent references, variables, mixins and map variables, and it evaluates a range of color functions at compile time while preserving source order and offering cascade-aware deduplication and optional property sorting. You can parse individual files or whole directories, accumulate inputs across parses, emit minified or pretty-printed output, write directly to files and reset state between builds. The engine is packaged as reusable C header files so other XS modules can embed it and the module exports an include_dir helper to locate those headers. The recent 0.05 release includes Windows and Colouring::In::XS related fixes and more robust header discovery, improving cross-platform reliability.

Eshu is a fast XS-based tool that automatically fixes indentation and can produce syntax-highlighted HTML for a wide range of languages including C, Perl, JavaScript/TypeScript, Python, Go, Rust, Java, PHP, Ruby, Lua, Bash, SQL, YAML, JSON, XML/HTML and POD. It offers per-language routines and a generic dispatcher to reformat strings, single files or entire directories while preserving code content and handling language-specific constructs, and it supports configurable tabs or spaces and indent widths. The highlighter emits HTML with token classes you can style, and the distribution includes a command-line program for in-place fixes, diffs and CI checks plus a vim plugin for editor integration. Eshu auto-detects languages by extension, skips very large or binary files, and returns structured results, making it a practical choice for developers who want fast, consistent indentation fixes and portable syntax highlighting across many source types.

Object::Proto is a high-performance object system for Perl that stores objects as compact arrays and maps property names to slot indices at compile time, giving you fast, blessed objects that still respond to isa and can and run normal package methods. You declare classes and typed attributes with the object keyword or Object::Proto::define, get generated accessors and support for positional or named constructors, and can use built-in or custom type checks with optional XS-level registration for minimal overhead. The module offers rich attribute modifiers such as required, readonly, default, lazy with builders, triggers, weak references, private attributes, clearer and predicate helpers, and reader/writer aliases, plus inheritance including multiple parents, roles, method modifiers, prototype chains, locking, freezing, cloning, singletons, and optional function-style accessors for maximum speed. BUILD and DEMOLISH hooks are supported for initialization and cleanup. If you need compact, fast objects with expressive attribute features and fine control over mutability and memory behavior, Object::Proto is a strong fit.

PDF::Make is a comprehensive Perl toolkit for creating, reading, and editing PDF files that offers both a recommended high-level, chainable Builder API for common document tasks and a low-level XS API for direct, fine-grained control of PDF internals. With the Builder you can generate pages, manage fonts and layout, add wrapped text, images, outlines and tables of contents with simple chainable calls, while the Document/Page/Canvas API exposes raw PDF objects and content streams for advanced needs. The distribution also includes parsers and readers for importing and extracting text, tables, annotations and form data, support for standard fonts and embedded JPEG/PNG images, interactive features like links and AcroForms, document features such as layers, watermarks and redaction, plus security options including encryption and digital signatures. It is designed to be feature-rich yet self-contained at runtime apart from Object::Proto for the Builder layer, so it is suitable whether you need quick programmatic PDF generation or full control over PDF structure and serialization.

Kubernetes::REST is a focused Perl client that makes the Kubernetes API easy to use from Perl by returning typed IO::K8s objects instead of raw hashrefs and by automatically building resource URLs from object metadata. It provides simple, familiar operations for listing, getting, creating, updating, patching and deleting resources, plus higher level conveniences such as idempotent ensure, batch ensure_all and ensure_only with pruning, streaming watch and log support, and pod port‑forward, exec and attach when your HTTP backend offers duplex I/O. The HTTP layer is pluggable so you can use the default LWP backend, HTTP::Tiny, or supply an async backend, and the client can load the cluster resource map from OpenAPI or accept custom mappings for CRDs. It handles kubeconfig and in‑cluster credentials, preserves raw bytes for pod logs while decoding object data as UTF‑8, and exposes building blocks for async wrappers. A recent noteworthy change adds patch_status and update_status to write through the /status subresource, addressing the case where the API server strips status from writes to the main endpoint and letting you update object status correctly for CRDs and built‑in kinds.

Net::Async::MCP is an IO::Async-based, non-blocking client for the Model Context Protocol that lets Perl programs talk to MCP servers via three interchangeable transports: in-process (direct MCP::Server calls), stdio (subprocess over stdin/stdout), and streamable HTTP. It exposes an async Future-based API (usable with Future::AsyncAwait) to perform the MCP handshake, list and call tools, fetch prompts and resources, and open subscriptions while surfacing server-initiated notifications and input requests back to the application. The client supports configurable protocol version, client capabilities, per-request headers, timeouts and stall timeouts for HTTP, and provides high-level helpers so a caller rarely sees low-level JSON-RPC details. If you need to integrate a Perl service with MCP-compatible model servers, handle long-running tool calls, or respond to server prompts from an async event loop, this module is relevant. The recent 0.004 release improves reliability across transports, adds an on_subscription_end event to notify when a subscription stream ends, and fixes streaming, pagination, header handling and input_required round trips so subscriptions and notifications work robustly over HTTP and stdio.

DBI is the standard database interface for Perl that gives your scripts a consistent, portable way to talk to many different databases by delegating the actual work to driver modules. It supplies a familiar set of operations like connect, prepare/execute, fetch, placeholders and bind values, plus helpers for common patterns such as selectrow or selectall, transaction control with AutoCommit/commit/rollback, quoting and metadata queries. DBI is intentionally a thin, stable layer that handles driver loading, error handling, tracing and callbacks while letting DBD::* drivers implement engine specifics, so some advanced features depend on your driver. It is mature, well documented and widely supported by the Perl community and tooling, making it a good choice whenever you need database access from Perl.

Punk::OAuth2 brings OAuth2 and OpenID Connect support to Punk web applications by providing the client-side authorization code flow with PKCE, signed single-use state, OIDC nonce handling, and id_token verification so you can add "Log in with Google" or similar to your app with confidence. The distribution's behavior lives in Punk::Plugin::OAuth2 and supplies convenient presets for Google, GitHub, and generic OIDC discovery, plus keywords and helpers to build login routes and manage refreshes while keeping sessions lightweight by default. The package also includes optional server and resource-server components for issuing and validating tokens, and most of the protocol and crypto work is implemented in XS for performance with Crypt::JWS used for signature checks. If you are building a Punk application that needs standard OAuth2/OIDC authentication or a compact OAuth2 server or resource checker, this module is directly relevant; if you are not using the Punk framework it will be less useful. This is the initial 0.01 release which introduces the full client flow, presets, helpers, and the accompanying server and checker tools.

MIDI::Stream is a small realtime toolkit for converting between raw MIDI byte streams and higher-level MIDI events, providing a decoder to parse incoming bytes into events and an encoder to turn performance or system events into bytes for MIDI hardware or other software. The classes are stateful and intended to represent a single MIDI port or device, so you should use one instance per stream to avoid running-status confusion, message collision, or tempo inaccuracies since there are no merge facilities. The module supports event callbacks for reacting to parsed messages and the recent 0.006 update fixes callback cancellation bugs and adds regex support for event-name matching when registering callbacks. Note that a prior 0.005 release introduced an incompatible encoder option named "concat" that changes whether multiple messages are concatenated or returned as an array, so review the change log when upgrading.

rainbarf is a small Perl utility that renders compact, eye-catching resource usage charts for inclusion in tmux or GNU screen status lines, letting you see CPU, memory and battery trends at a glance. It generates a tiny visual bar you can drop into your terminal multiplexer configuration so you have continuous, unobtrusive monitoring of system resources while you work. This makes it a good fit for developers and sysadmins who want lightweight, real-time indicators in their terminal workflow without switching to a separate monitoring tool.

GD is the standard Perl wrapper around the libgd graphics library that lets you create, edit and output bitmap images from Perl code. It provides an object model for images, fonts, polygons and a simpler GD::Simple layer, and supports drawing primitives like lines, rectangles, arcs and filled polygons, color and alpha control, brushes and patterned fills, text rendering with built-in bitmap fonts and TrueType via stringFT when libgd is built with FreeType, and animated GIF assembly. You can create images from scratch or load common formats and write PNG, JPEG, GIF, BMP, TIFF, WebP, HEIF and AVIF and other formats depending on your libgd build, and the module exposes copying, resizing, resampling, rotation, many interpolation methods and a range of image filters such as blur, emboss, negate and pixelate. It supports truecolor images and palette images, alpha blending and saving of alpha channels, and offers utilities for color allocation and palette management. The exact feature set depends on the installed libgd version so some older or optional behaviors may be deprecated or unavailable, but for most web and script-based image tasks GD gives a low-level, scriptable way to generate and manipulate bitmaps directly from Perl.

Mojolicious::Plugin::BarefootJS plugs the BarefootJS server runtime into Mojolicious so you can do server-side rendering with BarefootJS inside a Mojolicious app. The plugin registers a "bf" controller helper that lazily creates a per-request BarefootJS runtime backed by BarefootJS::Backend::Mojo and lets you render compiled BarefootJS templates as native Mojolicious templates. It is the right choice when you want tight integration of BarefootJS SSR with Mojolicious, while BarefootJS::Backend::Xslate is provided for non-Mojolicious or PSGI hosts. Recent updates make the build manifest load lazily and cache by mtime and size so starting the server before the first build no longer breaks stash seeding and manifest rewrites are picked up without restarting the server.

BarefootJS::Backend::Xslate lets the BarefootJS runtime render its templates using Text::Xslate with Kolon syntax, making it easy to use Kolon ".tx" templates that call the runtime as a bf object. You can pass a prebuilt Text::Xslate instance or give template paths and options and the backend will build a type=>'html' Xslate that auto-escapes interpolations while supporting helpers that return raw markup via mark_raw. The module exposes the operations the runtime needs such as render_named, encode_json and materialize, lets you override the JSON encoder, and requires no special function map because the compile-time @barefootjs/xslate adapter emits calls as bf methods. It is framework agnostic so it runs under PSGI/Plack or standalone and is actively maintained with frequent releases.

BarefootJS is a small, actively maintained server-side runtime for rendering JSX/TSX that have been compiled into marked templates and client JavaScript, designed to plug into any Perl web stack. It does not do template rendering itself but provides the runtime API the compiled templates call at render time and delegates environment-specific tasks such as JSON marshalling, raw-string handling, JSX children materialisation, and named-template rendering to a pluggable backend. That lets you drive different template engines and frameworks from the same runtime, with ready-made backends for Text::Xslate and Mojolicious and a core that only depends on Perl core modules. If you need to serve compiler-produced JSX/TSX templates from a Perl app and want to keep rendering decoupled from your framework, BarefootJS gives you a lightweight, backend-agnostic way to do that, and the project shows frequent releases and active maintenance.