XML-Parser-2.57

[Bruce Dubbs]

New minor version.

2.57 2026-04-07

Fixes:

• Fix PE parsing regression that broke XML::Twig DTD round-tripping: defer parameter entity parsing activation to when a declaration handler is registered, preventing PE references from being consumed by the empty sub-parser instead of reaching the Default handler
• Add regression tests for post-root character data routing and add ppport.h for XS backward compatibility macros
• Add NULL check after XML_ParserCreate_MM to prevent segfault on memory allocation failure
• Replace deprecated indirect object syntax in LWPExternEnt.pl (new URI(...) -> URI->new(...), etc.) for forward compatibility with Perl 5.36+ where 'use v5.36' disables the indirect feature. Also add 'use strict' to the file

Improvements:

• Add downstream CI testing for XML::XPath, XML::DOM, and XML::Twig to catch breakage in major consumers before release

Maintenance:

• Convert t/char_end_doc.t to Test::More; all 57 test files now consistently use Test::More
• Expand CLAUDE.md with project conventions for generated files, releases, and testing
• Add test coverage for load_encoding, xml_escape edge cases, and ContentModel API
• Add test coverage for element_index, position_in_context, specified_attr, and setHandlers
• Add test coverage for recognized_string, default_current, and original_string introspection methods
• Add test coverage for context-tracking API (context, current_element, in_element, within_element, depth)
• Add test coverage for parse_start/ExpatNB non-blocking parser API
• Replace indirect object syntax in test files (t/decl.t, t/parament.t, t/external_ent.t)
• Add test coverage for IO control character rejection in external entity paths

2.56 2026-04-02 (by Todd Rinaldo)

Fixes:

• Skip original_string test when expat lacks XML_CONTEXT_BYTES, fixing false test failures on platforms where libexpat is compiled without XML_CONTEXT_BYTES (e.g. DragonFlyBSD system expat)

2.55 2026-04-01 (by Todd Rinaldo)

Fixes:

• Fix struct-return ABI mismatch in XML_ExpatVersionInfo() by parsing the version string instead of using the struct return, which was corrupted when Perl and libexpat used different struct return conventions (-fpcc-struct-return vs -freg-struct-return)
• Revert defaulthandle char routing and standalone string changes that broke downstream CPAN modules (XML-Twig, XML-DOM, XML-XPath)
• Increase deep_nesting test depth from 600 to 2048 to actually exercise the st_serial_stack reallocation code path
• Update expat download URL from SourceForge to GitHub in the "expat not found" error message

Improvements:

• Add AddressSanitizer CI job for XS memory safety to catch heap buffer overflows and use-after-free bugs

Maintenance:

• Modernize last 4 print-ok test files (astress, namespaces, stream, skip) to Test::More with descriptive test names
• Remove obsolete .travis.yml (project uses GitHub Actions)

[Bruce Dubbs]

Now version 2.56.

[pierre]

It has been reported on discord (thanks vlad557776) that a lot of recent commits to the XML-Parser source have been done by an AI (Claude) and a bot! See ​https://github.com/cpan-authors/XML-Parser/commits/main/

Note that this is a decision of the maintainers of the package since the last line of README.md is

The project started making use of Claude Code <https://claude.ai/code> in January 2026

But I fear if this kind of automation is generalized, we'll get overwhelmed with new versions of everything!

[Douglas R. Reno]

Replying to pierre:

It has been reported on discord (thanks vlad557776) that a lot of recent commits to the XML-Parser source have been done by an AI (Claude) and a bot! See ​https://github.com/cpan-authors/XML-Parser/commits/main/

Note that this is a decision of the maintainers of the package since the last line of README.md is

The project started making use of Claude Code <https://claude.ai/code> in January 2026

But I fear if this kind of automation is generalized, we'll get overwhelmed with new versions of everything!

This has been unfortunately had an impact elsewhere already as well. The lead developer of Vim is now heavily using Claude during his changes as well. The kernel developers are also using AI tools heavily during their work and this has lead to a couple of noticable problems with the 6.18 and 6.19 series of kernels, such as 6.19.2 (​https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.19.2) which fixed boot failures caused by 6.19.1, and the change was not properly verified or tested.

It's something that we'll need to keep an eye out for, as in my experience with VIM and XML-Parser, a lot of the time AI is used without validating what it is writing. Scary times :(

I know Gentoo is postponing updates on this as well as the other Perl modules by the author, but even if we decide not to update in the future, we still need to monitor the changes anyway for anything security or significantly related to stability...

[Bruce Dubbs]

Now version 2.57.

[Bruce Dubbs]

Moved this ticket to BLFS at commit b4defc453e.