This file documents the revision history for Perl extension HTTP::Body.

1.23_01   2026-10-26 03:43:44+01:00 Europe/Berlin (TRIAL RELEASE)
	- SECURITY: fixes for five issues reported by the CPAN Security Group
	  (CPANSec), with patches by CPANSec:
	  - CVE-2026-116132: the temporary file of an upload that is still
	    incomplete at DESTROY-time is now always deleted
	  - CVE-2026-116134: a multipart part's header block is limited to
	    $HTTP::Body::MultiPart::max_header_size bytes (32768) and
	    $HTTP::Body::MultiPart::max_header_lines lines (100)
	  - CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in urlencoded
	    bodies are decoded instead of being dropped
	  - CVE-2026-116133: a multipart body without a boundary or with a
	    malformed delimiter line no longer takes quadratic time; a malformed
	    delimiter line now croaks, and padding or an epilogue after the
	    close delimiter is accepted
	  - CVE-2026-116131: urlencoded bodies are limited to
	    $HTTP::Body::UrlEncoded::max_params fields and multipart bodies to
	    $HTTP::Body::MultiPart::max_parts parts (1000 each)
	- SECURITY: CVE-2026-116285: the chunk size line of a chunked body is
	  matched in linear instead of quadratic time
	- SECURITY: a chunked body is now framed independently of where the
	  reads feeding add() fall; a read that split a chunk could leave the
	  parser never reaching 'done', hanging a server that reads until done
	- RT#105021: temp-file write errors in MultiPart and OctetStream are
	  reported (croak) instead of silently truncating the stored body
	- RT#123615: a NUL byte in a multipart filename is stripped
	- RT#84004: the temp file of an aborted upload is cleaned up (see
	  CVE-2026-116132 above)
	- INCOMPATIBLE: add() now croaks when one of the new limits is exceeded.
	  Raise the variable, or set it to 0 to disable that limit, if your
	  forms need more. See NOTES in HTTP::Body.
	- Moved repository from Shadowcat git to GitHub (libwww-perl/HTTP-Body)
	- Updated all metadata resources to point to GitHub
	- Fixed prerequisites: moved Digest::MD5 to test deps, changed HTTP::Headers to HTTP::Message
	- Added README.md for GitHub
	- Updated support section in documentation

1.23      2024-03-30 04:27:56+01:00 Europe/Berlin
	- Changing default behavior of upload handling to stop taking over the upload extension
	- Adding configuration options for changing this behavior back or add custom File::Temp arguments
	- Updating documentation.

1.22      2015-01-29 04:51:51+01:00 Europe/Berlin
        - Fix for the fix..... don't ask

1.21      2015-01-29 04:48:58+01:00 Europe/Berlin
	- Fix for failing test if Plack is not installed

1.20      2015-01-28 16:20:59+01:00 Europe/Berlin
        -new method 'part_data' which preserves multipart meta information just in cause
          you have a form upload with unexpected charsets, etc.

1.19
        - Release for cleanup of dzil

1.18      2013-12-06 10:05:33 America/New_York
        - Added configurable basename regexp, test added with fixed regexp for next release
          (Torsten Raudssus [GETTY])
        - Added .gitignore

1.16    Wed, 3 Oct 2012 15:18:47 CET
        - Added support for application/json (Gareth Kirwan [GBJK])

1.15    Mon, 5 Dec 2011 02:59:02 CET
        - Added missing requirement (Torsten Raudssus [GETTY])

1.14    Tue 26 Oct 2010 19:42:00 CET
        - removed benchmark test data and benchmark script for release (Torsten Raudssus [GETTY])

1.12    Sat 19 Mar 2011 19:05:17 CET
        - Fixed the t/08 test

1.11    Tue 26 Oct 2010 14:10:00 UTC
        - Added param_order capability (Torsten Raudssus [GETTY])

1.10    Fri 8 Oct 2010 15:50:55 UTC
        - Patch for test failure ( thanks KENTNL/MITHALDU! )

1.09    Thu 19 Aug 2010 19:08:55 UTC
        - remove blib for PAUSE indexing.

1.08    Thu 19 Aug 2010 18:08:42 UTC
        - Temp files now preserve the suffix of the uploaded file. This makes
          it possible to feed the file directly into a mime-type-determining
          module that may rely on this suffix as part of its heuristic. (Dave
          Rolsky)
        - Fix for RT#54443 Xforms buffering incorrectly (Simon Elliott)
        - Move to Dist::Zilla

1.07    2010-01-24 20:40:00
        - Up IO::File dependency.

1.06    2010-01-09 19:21:00
        - Added $body->cleanup(1) flag to enable auto-deletion of temporary files
          during DESTROY. (Vany Serezhkin)
        - Fixed parsing of multipart bodies with boundaries that contain commas.
          (Tomas Doran, http://rt.cpan.org/Public/Bug/Display.html?id=41407)
        - Dropped YAML, we now use Perl as a serialization format in our tests. We call this PAML ;)

1.05    2008-12-01 17:15:00
        - Removed useless eval + require in new().

1.04    2008-06-23 16:00:00
        - Added tmpdir() accessor to specify an alternate directory for temp files.
          (jgoulah)

1.03    2008-04-07 08:20:00
        - Set body value for XForms data. (Daniel Ruoso)

1.02    2008-02-27 17:30:00
        - Fixed issue with urlencoded test on Windows.

1.01    2008-02-23 11:30:00
        - Fixed performance issue with urlencoded regex.

1.00    2008-02-23 11:00:00
        - Added support for chunked requests if no $length value is passed to new().
        - Added support for XForms submissions. (Daniel Ruoso)
        - Fixed urlencoded parser to handle spaces after semicolons and equal signs
          in the value. (Tom Heady, http://rt.cpan.org/Ticket/Display.html?id=31055)
        - Fixed multipart test to properly clean up temporary files.

0.9   2007-03-27 14:00:00
        - Fixed bug where empty fields in multipart/form-data were ignored.
          (Ton Voon)
        - Fixed bug where an uploaded file with the name "0" was ignored.
          (Ton Voon)
        - Small performance improvements to urlencoded parser.

0.8   2007-03-23 18:40:00
        - Some browsers such as MSIE send extra data after the body content.
          We now properly ignore anything beyond Content-Length.

0.7   2007-03-23 10:00:00
        - Fixed parsing an empty (zero-length) file using multipart.
          http://rt.cpan.org/NoAuth/Bug.html?id=25392

0.6   2006-01-06 00:00:00
        - Fixed buffer bug in OctetStream, reported by Daisuke Murase
          <typester@cpan.org>.
        - Fixed YAML prereq, reported by Jess Robinson
        - Added tests, Ben Trott <ben@sixapart.com>.

0.5   2005-11-17 00:00:00
        - Updated for PAR compatibility

0.4   2005-11-09 01:00:00
        - Version bump to 0.4 so CPAN.pm installs the right version.

0.03  2005-10-27 20:00:00
        - removed use of List::Util first due to memory leakage.
          http://rt.cpan.org/NoAuth/Bug.html?id=13891

0.2   2005-10-07
        - fixed POD

0.01  2005-09-07
        - first release
