CPANscan

App::karr is the engine behind karr, a command line kanban system that keeps your board inside Git by storing cards, config, logs, and id metadata in refs under refs/karr/* rather than as files in the working tree. Task cards are plain Markdown with YAML frontmatter and the tool reads and writes them directly to refs so Git remains the transport and source of truth and you avoid file-level merge conflicts for shared task state. There are commands to materialize and import a temporary gitignored tasks/ view for interoperability and grepping, and lower-level modules such as App::karr::Git, App::karr::BoardStore, and App::karr::Task are provided so you can automate or inspect boards from Perl. The installed karr binary shows a board summary by default, auto-discovers repositories by walking upward for refs/karr/*, and also ships official Docker images tuned to avoid creating root-owned project files. If you want a lightweight, Git-first kanban workflow that keeps tasks versioned alongside your repository and accessible to scripts, App::karr is designed for that use case.

Data::JSEmail converts between Email::MIME objects and the JSON mail format defined by RFC 8621 (JMAP Mail), making it easy to turn Perl email messages into the JMAP create/update payloads and to rebuild MIME trees from JMAP bodyStructure and blob references. It understands headers and header arrays, preserves raw header text where needed, extracts text and HTML bodies and attachments as bodyValues or part/blob references, assembles recursive bodyStructure trees, validates content IDs, handles charset choices for 7-bit and UTF-8 content, and provides helpers for dates, addresses (including grouped addresses), message IDs and URLs. The API includes a make() routine with configurable header precedence and a defaults callback so callers can control fallback values, and it exports utilities for standard header defaults. Recent updates clarified licensing and added documentation and a README, and earlier releases improved RFC 8621 compliance and added bodyStructure assembly and header handling to match Cyrus JMAP behavior.

Text::JSContact is a Perl module that converts contact data back and forth between legacy vCard files and the modern JSContact JSON format defined by the RFCs 9553 and 9555, making it easy to bridge older vCard-based systems and newer JSON contact workflows. It performs bidirectional mappings for common fields like names, emails, phone numbers, addresses, organizations and titles and also handles more advanced items such as anniversaries, notes, online services, media, calendars, crypto keys, directory membership and relationship data. The module follows the standards closely and ships with extensive test coverage including RFC 9555 test vectors and CardDAV integration checks, so it is suitable for migrations, CardDAV server clients or any Perl application that needs reliable vCard/JSContact interoperability. The distribution is licensed under the same terms as Perl itself and recent updates clarified licensing and added basic module documentation.

Text::JSCalendar is a lightweight Perl utility for converting calendar data between traditional iCalendar (RFC 5545) and the newer JSCalendar format, making it easier to parse, generate and interoperate calendar feeds and CalDAV data in Perl applications. It can parse vCalendar text into Perl event structures and emit iCal text from event objects, and includes handy utilities such as cached timezone lookup via DateTime::TimeZone, event normalization to remove default-valued fields, and event comparison. If you need to import, export, compare or normalize calendar events in a Perl project or bridge iCalendar and JSCalendar ecosystems, this module provides the core conversions and helpers to do that.

Net::DAVTalk is a lightweight Perl helper for talking to WebDAV servers, originally built to support CalDAV and CardDAV clients but useful for any DAV work. It handles connection setup, Basic or Bearer (OAuth2) authentication, .well-known discovery to find principal and home-set URLs, and sends DAV methods like PROPFIND, MKCALENDAR, MKCOL and DELETE through a configurable HTTP::Tiny-compatible user agent with SSL options and custom headers. Responses are parsed from XML into structured Perl hashes and the module provides handy utilities for namespace management, path conversion between full and relative forms, property queries, UUID generation and user agent control. By default Request throws on errors while the newer SafeRequest API returns a consistent result hash containing payload, http_response and any error so callers can handle failures without exceptions. The module is actively maintained and recent updates added SafeRequest and clarified licensing to match Perl's terms.

Net::CardDAVTalk is a compact Perl client library for talking to CardDAV servers, originally written to map CardDAV operations to an older FastMail API and to serve as an example implementation and test helper for suites like Cassandane. It exposes simple methods to create, update, delete and list addressbooks and contacts, fetch single or multiple cards (including multiget and prop requests), perform sync operations with syncToken, and move contacts between collections while returning metadata like etags. Recent releases moved the API to use JSContact hashrefs and delegate vCard↔JSContact conversion to Text::JSContact, and added Net::DAVTalk and Text::JSContact as dependencies, so callers now pass and receive plain Perl hashrefs rather than VCard objects. If you need a readable, test-friendly CardDAV client for scripting or test automation this module is a good fit, especially when you want examples of CardDAV interactions or integration with FastMail-style servers.

Net::CalDAVTalk is a Perl client for talking to CalDAV servers that presents calendar and event data as easy-to-use Perl/JSON-style structures. It handles discovery via .well-known and SRV, manages calendars and events (list, create, update, delete), supports multi-get and range queries, can produce free/busy results, supports sync-token based polling, and can export calendars as iCalendar files. The module includes Cyrus and Apple CalDAV namespace support, a timezone cache for speed, and a pluggable logger. It was written for FastMail and is tied to an early FastMail API and to Cassandane testing, so some operations are a bit specific to that environment and a few queries are implemented inefficiently or have limited property parsing. If you need a Perl toolkit to script or test CalDAV servers and do not require a polished, generic SDK, this module provides a practical, feature-rich starting point.

Mail::JMAPTalk is a compact, low-level Perl client for communicating with JMAP servers that wraps HTTP::Tiny and handles JSON encoding and decoding for you. It gives you simple methods to make JMAP method calls, call batches of methods, upload and download binary blobs, and authenticate either with basic auth or with the non-standard JMAPAuth token flow, while leaving object-specific JMAP logic to higher-level code. The module returns Perl data structures mirroring the JSON responses, will report errors on unexpected or invalid replies, and can print full request and response traces if you set DEBUGJMAP. Recent updates clarify the licensing and include a LICENSE file, switch to the core MIME::Base64, and make File::LibMagic optional so uploads without an explicit MIME type fall back to application/octet-stream, making the module easier to install and integrate into scripts or custom JMAP clients.

CPAN::Meta is a small Perl class for reading, validating, converting and writing a CPAN distribution's metadata such as META.json or legacy META.yml. It exposes the standard fields and maps them to convenient methods so you can inspect name, version, authors, license, resources, provided packages, optional features and build or runtime prerequisites, compute an effective set of requirements, and decide whether particular files or packages should be indexed. You can load metadata from files or strings, serialize it back to JSON or YAML, request down-conversion to older spec versions, and get deep, unblessed copies for safe manipulation. This is the go-to tool for authors and packaging tools that need to parse, validate or transform CPAN meta information. Recent releases emphasize distribution-only metadata, fix compatibility with newer CPAN::Meta::Requirements, and include minor documentation cleanups.

Text::VCardFast is a Perl module that quickly parses and generates vCard data by converting vCard text into a structured Perl hash and back again, providing vcard2hash and hash2vcard functions. It offers both a pure-Perl and a faster XS (C) implementation and handles common vCard features and RFC-compliant decoding including RFC 6868 escapes and Unicode propagation. The parser exposes options to control multi-valued fields, multi-valued parameters, bare parameter keys, and early exit after a single card so you can tailor output for middleware or bulk processing workloads. If you need low-latency handling of many or large vCards this module is much faster than older CPAN alternatives and is suitable for use in servers or tools that import, export, or transform contact data.

Alien::OpenMP is a lightweight helper that detects and returns the compiler and linker flags needed to build C code with OpenMP using the same compiler Perl was built with. It follows Perl's configured toolchain so XS modules and Inline::C code inherit the correct ABI and linker settings rather than switching compilers based on environment variables. The module supports GCC reliably and has experimental support for Clang, with extra handling on macOS to add include and library paths for an external libomp runtime when needed. It verifies at install time that omp.h and the runtime work, and exposes simple methods like cflags, lddlflags, openmp_version and version, plus built‑in support for Inline::C integration, so it is useful whenever you need a straightforward, portable way to enable OpenMP in Perl-linked C code.

CPANSA::DB is a small, focused module that packages the CPAN Security Advisory reports as a ready-to-use Perl data structure so tools can consult a local copy of known CPAN security issues. It exposes a single subroutine, db, which returns a hash reference containing the advisory records, and it is primarily consumed by CPAN::Audit but can be used by any script that needs offline access to CPAN vulnerability data. Each release is published on GitHub and distributed with a GPG signature and GitHub attestation so you can verify the archive you download, and a JSON export of the same data is also provided for non-Perl consumers. The data is updated regularly with new reports and CVE mappings, making the module a convenient way to embed an authoritative, versioned snapshot of CPAN security advisories into audit or monitoring workflows.

Punk::Passkey brings WebAuthn passkey support to the Punk web stack by offering simple helpers to produce browser credential options and to verify registration and authentication responses. It issues single-use, time-limited challenges stored in the session, returns the PublicKeyCredentialCreationOptions and PublicKeyCredentialRequestOptions structures for navigator.credentials, and verifies incoming attestation and assertion bytes while keeping origin checks tied to the application configuration rather than request headers. The module includes a hardened parsing layer that accepts only the CBOR and COSE forms WebAuthn actually uses and converts public keys and signatures into forms Crypt::JWS can work with, so you store the raw COSE key bytes and the code re-validates algorithm allowlists on every login. Attestation statements are read but not validated by default, with an optional coderef hook if you want to perform full attestation checks, and all verification failures return the same generic failure while logging detailed reasons for operators. Counter handling treats a nonincreasing sign count as an informational clone signal rather than an automatic rejection and provides hooks for applications to record credential use and respond to clone events. This is the initial release of Punk::Passkey and includes database migration scripts for credential storage.

Test::Snapshot makes it easy to capture and re-use expected test outputs by storing them in automatically named files and comparing your current results against those snapshots with a single helper, is_deeply_snapshot. You call it with the value you produced and a short test description and the module derives a filename from the test script name, any surrounding subtest names, and that description, treating a missing file as if it contained undef. Snapshots are written in a human-friendly Data::Dumper format to keep diffs small and readable, and you can opt in to automatic updates by setting TEST_SNAPSHOT_UPDATE so failures still update the stored snapshots for you to inspect under source control. This module is distinct from Test::Snapshots for executables and, as of the latest release, is compatible with Test2::V0, making it a simple choice for tests that need stable, reviewable expected outputs.

Punk::Observe is a single-node OpenTelemetry backend for receiving, storing, querying and visualising traces, metrics and logs in one place rather than a client library. It accepts OTLP over HTTP (protobuf or JSON), authenticates ingest with hashed keys, appends incoming data to a write‑ahead log and stores each signal in formats tuned to its shape so a single query language can span metrics, traces and logs without manual trace id copying. The distribution includes a PSGI ingest app, a storage engine with immutable segments, compression and rollups, a resumable query executor that refuses overly expensive or unsupported scans with actionable messages, a live tail over server‑sent events, and a C-backed UI that renders waterfalls, flamegraphs and charts (Plotly is vendored) while alert evaluation is intended to be driven by the host scheduler. Important operational choices are explicit: timestamps use 64‑bit nanoseconds and cross-perl string handling, retention deletes whole two‑hour blocks rather than single records, cardinality is capped and excess series are folded into an overflow series, and durability has configurable fsync policies. The module deliberately does not support gRPC ingest, clustering, backend tail sampling, PromQL compatibility, or percentiles over downsampled ranges, and it expects to be mounted into a host Punk application with a required admin guard. This is the initial 0.01 release providing the engine, receiver and plugin for self-hosted observability.

Finance::Quote is a mature Perl library that pulls stock, mutual fund and bond quotes from dozens of exchanges and web services around the world, returning a simple table of standard fields such as price, volume, currency, date and dividend info so you can integrate live market data into scripts or applications. You create a quoter object, call fetch with a method name and symbols, and the module consults one or more exchange-specific backends and optional currency conversion modules to produce the results, with configurable timeouts, required-label checks and failover behavior. Currency conversion is pluggable and some backends require API keys, and the module includes handy utilities for date/time normalization, CSV parsing and number scaling. The recent 1.71 release fixes NZX JSON mapping and updates IndiaMutual NAV parsing to an 8-column format with Plan and Option fields and adds SIF support while removing some Morningstar modules. Be aware that you cannot control the internal failover order and results are presented as a two-dimensional hash, which some users find less convenient than nested references.

DateTime is the canonical Perl object for representing and manipulating calendar dates and times, providing constructors like new, from_epoch and now, rich accessors for year/month/day/hour/minute/second and nanoseconds, and locale-aware formatting via strftime and CLDR patterns. It understands time zones including a special "floating" zone, handles leap seconds, offers duration-aware math and subtraction that produce DateTime::Duration objects, and overloads arithmetic and comparison so you can add durations and sort datetime objects naturally. The module is careful about tricky edge cases such as ambiguous or non-existent local times around daylight saving transitions and documents recommended practices like doing calculations in UTC or using floating time for simple date math, and it deliberately does not attempt free-form date parsing so you should use DateTime::Format::* modules for input parsing. Recent documentation updates clarify that truncate can raise a fatal error when truncating to a unit produces a local time that does not exist because of a midnight DST transition, and that rfc3339 output does not include nanoseconds. If you need a robust, well-tested date/time core for a Perl application that must handle time zones, locales, leap seconds and various calendar math, DateTime is the right choice.

PDL::Fit::Levmar brings the Levenberg-Marquardt nonlinear least-squares solver into Perl's PDL environment so you can fit models that are nonlinearly dependent on parameters using a high performance C library. It wraps the liblevmar code and supports analytic or numeric Jacobians, box, linear and inequality constraints, parameter fixing, broadcasting and single or double precision runs, and it returns optimized parameters, a covariance matrix and detailed diagnostics. Model functions may be provided as Perl subs for convenience or as pure C or in a small "lpp" description language that is translated to and compiled as C on first use for much better speed. Some advanced constraint options require building with LAPACK and BLAS, threading is reportedly reentrant though not heavily tested, and there are a few known quirks with workspace and some broadcasting cases in the bundled levmar-2.6 code. If you need a robust, fast Levenberg-Marquardt fitter integrated with PDL and want the option to trade ease of use for compiled performance, this module is highly relevant.

Git::Native is a Perl interface to libgit2 that lets you work with Git repositories from Perl code without forking the git executable, using FFI::Platypus and Moo-based classes to open, init, clone, read and write objects, and build commits directly in-process. It hands back Git::Native::Repository objects for operations like open, open_ext, init and clone, and provides conveniences such as creating blobs, building trees, validating reference names, and adjusting libgit2's config search paths. Because it talks to libgit2 it is typically faster and more self-contained than shelling out to git and is a good fit for scripts, services or test suites that need programmatic Git access. A few limitations are noted by the author: cloning currently only supports unauthenticated URLs and not bare clones, opening can fail due to libgit2's ownership checks in some container or CI setups, and changing the config search path is process-global and only affects repos opened after the change. If you want to avoid repeated git subprocesses and prefer an in-process Git API from Perl, Git::Native is worth considering.

Stats::LikeR is a high-performance Perl toolkit that brings many of R's familiar data-frame operations, statistical tests and modeling tools into Perl, implemented in XS for speed and numerically validated against R and SciPy where possible. It understands four common table shapes (array-of-arrays, array-of-hashes, hash-of-arrays and hash-of-hashes) and gives you fast, memory-conscious primitives for reshaping and joining data (concat/rbind, merge, melt, pivot_table, aoh2hoa, hoa2aoh, aoh2hoh), grouped aggregation (agg, group_by), row filtering and column assignment (filter, assign, map_cell), binning and ranking (qcut, rank, quantile), missing-value handling and interpolation (dropna, fillna, ffill, bfill, interpolate), I/O for delimited files and .xlsx and LaTeX output (read_table, write_table), plus a large suite of statistics from basic summaries to advanced inference and models (mean/median/sd/skew/kurtosis, t_test, wilcox_test, chisq_test, fisher_test, anova/aov, oneway_test, kruskal_test, glm, lm, coxph, survfit, logrank_test), diagnostic and effect-size tools (auc/roc/bedroc, cramers_v, cohen_d, smd, vif, eta_squared), distribution and utility functions (pnorm/qnorm, pt/qt, pchisq/qchisq, pbinom, density, hist, sample, runif/rnorm/rbinom) and helpers for table housekeeping (vals, colnames, rownames, nrow/ncol, view). It includes an interactive help function h() and aims to match R behavior closely while being tuned for performance, so it is a good fit if you want R-like analytics inside Perl scripts or pipelines. Note that some routines follow R conventions exactly so ANOVA here is sequential (type I) and term order matters, aov assumes normality, and predict has limits around automatic factor re-expansion, all of which are documented in the module.

Git::Libgit2 is a thin, low-level Perl bridge to the libgit2 C library built with FFI::Platypus and Alien::Libgit2, intended for callers who need direct access to libgit2's API from Perl. It exposes init/shutdown, version and error helpers, raw OID conversion, a broad set of object/repo/revwalk/remote/diff and config bindings, plus many libgit2 constants so you can call the C surface almost verbatim; check_rc converts negative libgit2 return codes into rich exceptions. This module deliberately mirrors the C ABI, so callers must manage lifetimes and buffers the same way C code would and should consider Git::Native if they want an idiomatic, RAII-style Perl wrapper. Recent releases add safer probing for struct layouts (fetch_options_prune_offset) to avoid subtle cross-version memory bugs and a new cert_hostkey_offsets helper to read host-key hashes from certificates used in transport callbacks.

Alien::Libgit2 is a helper module that makes the libgit2 C library available to other Perl modules by either using a suitable system installation or building a bundled copy. It prefers a system libgit2 discovered via pkg-config when the version is 1.9.3 or newer and otherwise builds libgit2-1.9.3 from the included source with CMake so installs work even on air-gapped machines. The module exposes the compiler and linker flags needed by XS consumers and the dynamic library information needed by FFI-based modules so they can link against libgit2 without manual configuration. Building the bundled copy requires cmake, a C compiler, pkg-config and optional OpenSSL and libssh2 headers for HTTPS and SSH support. You can force a system or bundled install via ALIEN_INSTALL_TYPE and common users of this module include Git::Libgit2 and Git::Native.

Dist::Zilla::PluginBundle::Author::GETTY is a ready-made Dist::Zilla configuration bundle that captures the author's preferred defaults for building, testing and releasing Perl distributions so you can get a sensible, feature-rich dist.ini with minimal fuss. It wires together versioning and changelog management, pod generation or task weaving, Git and GitHub (or Gitea/Forgejo) metadata and release hooks, optional Alien and XS support, Docker build/release helpers, install/release automation and a shared GitHub Action for CI, and exposes a simple set of options like author/authority, release_branch, tag_format, include_readme, no_github/no_cpan, xs/xs_alien/alien_build, docker_image/docker_tags and run_* hooks so you can tweak behaviour without handcrafting many plugins. The bundle also adds conveniences such as adoptme metadata, a generate_license mode that enforces a committed LICENSE file, and a version_finder to limit which files get $VERSION rewrites. Recent noteworthy updates include expecting LICENSE to be committed to the repo by default with an option to restore generated-license behavior, improved handling so bumped executables are committed with releases, and tighter Docker integration that requires Docker::API 0.104 so failed image builds emit useful logs.

Punk::TOTP is a compact Perl implementation of HOTP/TOTP one‑time passwords that helps you add time- or counter‑based two‑factor authentication to web apps, offering secret generation, RFC‑compatible otpauth:// provisioning URIs for QR codes, code generation and a verifier that is replay‑safe by design. It includes base32 encode/decode utilities, performs HMACs via File::Raw::Hash so you do not need heavyweight crypto dependencies at install time, and checks codes in a constant‑time window with configurable algorithm, digits, period and skew while refusing malformed input early. Because verification requires the shared secret, you must store secrets (and a last_counter value for replay protection) securely; the module documents that requirement and provides mechanisms to update counters on successful logins. Recent releases fixed security issues around failed‑attempt tracking and identifier comparisons and added server‑side attempt windows and optional schema provisioning, and the latest change ensures default challenge pages include CSRF fields and are sent with no‑store cache headers. If you need a straightforward, standards‑compliant TOTP/HOTP toolkit for Perl without pulling in external crypto libraries, Punk::TOTP is a practical choice.

Amazon::Credentials is a small Perl utility for discovering and returning AWS credentials from a variety of places so your script does not have to hardcode keys. It searches configurable sources in order, including environment variables, container endpoints (ECS, Fargate, Lambda, EKS pod identity), EC2 instance metadata (IMDSv2 by default), OIDC web-identity tokens (EKS IRSA and GitHub Actions), and local AWS config/credentials files, and it can also fetch SSO role credentials or run an external credential_process. You control the lookup order, timeouts, caching behavior and logging, and there is a simple CLI for ad hoc use. The module takes security seriously by storing credential values inside closures rather than as plain object fields so dumps and serializers do not reveal secrets, and it offers options to minimize how long credentials live in memory while reminding you that Perl cannot guarantee immediate memory zeroing. It does not automatically resolve profiles that require assuming a role via other profile credentials, and it has not been tested on Windows. Recent 1.3.x work focused on packaging and build improvements while an earlier 1.3.0 release made a notable security change by replacing on-disk encryption with closure-based in-memory protection.

String::License scans a text string for license statements and returns a normalized name or an SPDX license expression, making it easy to extract or standardize licensing metadata from source files or other documents. You create a String::License object with the string to inspect and can supply a naming helper to control the output format; by default it produces SPDX-style names but you can plug in custom naming schemes. The primary method as_text yields either an SPDX expression or a short descriptive label, so the module is useful for automated license checking, metadata generation, or cleaning up inconsistent license notices. Note that initializing naming schemes can be relatively expensive, so reuse of a naming object speeds repeated processing. The code is based on the KDE licensecheck script and is distributed under the GNU Affero General Public License.

Sim::OPT is a Perl framework for optimization and parametric exploration of simulation models that use text-file inputs and outputs. It favors problem decomposition by running overlapping block-coordinate searches that can be executed sequentially or in parallel, so you can use Gauss-Seidel or Jacobi style updates when searching across parameter subspaces. The distribution bundles modules to morph model parameters, build metamodels from sparse multidimensional data, convert 2D parallel coordinates into AutoCAD instructions, and to work specifically with ESP-r building performance simulations. Workflows are controlled with a simple configuration file that declares search blocks, iteration counts and starting points, and the tool can either launch simulations or operate on pre-simulated results while supporting factorial, star and DOE-style searches plus options to randomize search order. Installation is via cpanm and a command-line wrapper called opt is provided along with annotated examples to help you get started. Sim::OPT is dual licensed with an open-source core under GPL v3, runs on Linux, and the initial h2xs-generated release 0.507 was packaged in December 2025.

Crypt::JWS::OpenSSL is a Perl module for creating, inspecting, and verifying compact signed JSON Web Tokens using OpenSSL-backed cryptography. It supports HMAC algorithms (HS256, HS384, HS512) plus RSA and ECDSA variants including RS*, PS* and ES* and accepts secrets as raw shared keys, PEM-encoded keys, or JWK structures. Typical workflows use encode to produce a signed JWT from a header and claims, decode_unverified to extract header and claims and obtain a reusable verifytoken, and verify to check the signature once you have the appropriate public key or secret. The module records failure reasons in last_error by default and can be set to throw exceptions via throw_errors, it also reports availability of RSA padding modes and allows you to supply your preferred JSON backend. This is the initial 0.001 release published on 2026-08-30.

Punk::Queue is a durable, multi-process job queue for Perl with a C core that stores jobs as rows in a database and lets worker processes claim, run and record them atomically for high throughput. It ships with SQLite and PostgreSQL backends, pools DB connections safely across forks, and gives a compact API to register task bodies, enqueue jobs with priorities, delays, parents and dedupe keys, and to dequeue and perform work in workers. The system includes retries with randomized exponential backoff, layered timeouts, per-job logging that survives retries, repair routines for crashed workers and orphaned jobs, simple lease and counted locks, broadcast messages to workers, and list/stats/history endpoints suitable for an admin UI. Because the queue guarantees at-least-once delivery, every task must be written idempotently so reruns do no harm. Recent changes simplified the admin UI to ordinary page loads instead of a vendored SPA and vendored FontAwesome, plus a number of stability and portability fixes in the C layer and supervisor logic.

String::Copyright is a small Perl utility that scans a block of text for copyright lines and rewrites them into a consistent, human readable form. It provides a copyright() function that returns normalized copyright statements and lets you control scanning with threshold, threshold_before and threshold_after options to stop parsing after a number of noncopyright lines. You can also supply a custom format callback to render the output in your preferred style. The module works on decoded Perl strings rather than raw bytes so input must be decoded to the correct encoding before use. It recognizes ASCII and several common misdecoded forms of the copyright sign and will try to normalize them while emitting a warning if misdecoding is detected. This module is handy for tidying license headers or extracting copyright information from source files and other text.