| PERLDELTA(1) | Perl Programmers Reference Guide | PERLDELTA(1) |
perldelta - what is new for perl v5.44.0
This document describes differences between the 5.42.0 release and the 5.44.0 release.
This adds a major new ability to subroutine signatures, allowing callers to pass parameters by name/value pairs rather than by position.
sub f ($x, $y, :$alpha, :$beta = undef) { ... }
f( 123, 456, alpha => 789 );
Originally specified in PPC0024 <https://github.com/Perl/PPCs/blob/main/ppcs/ppc0024-signature-named-parameters.md>.
This feature is currently considered experimental, and is described in further detail in "Signatures" in perlsub.
Perl version 5.22 introduced reference aliases, allowing a "foreach" loop iteration variable to create new aliases to references. Perl version 5.36 introduced "foreach" loops with multiple variables, consuming more than one input list item on each iteration. New in this version, the two features may now be used together, allowing multiple iteration variables where any of them are permitted to be reference aliases.
use v5.44;
use feature qw( refaliasing declared_refs );
my %hash = (
one => [1],
two => [2, 2],
);
foreach my ( $key, \@items ) ( %hash ) {
say "The $key array contains: @items";
}
Currently both the "refaliasing" and "declared_refs" features remain experimental.
Experimentally, the "/xx" pattern modifier can allow bracketed character classes (e.g., "[a-zA-Z]" to extend across multiple lines and to contain comments, and to warn you of potential cases where a portion of a pattern inadvertently has been treated as a comment instead of what you intended. This behavior is enabled by use feature "enhanced_xx". See "/x and /xx" in perlre.
See <https://www.unicode.org/versions/Unicode17.0.0/>.
Perl now uses the getentropy() system call to fetch random bytes suitable for seeding the internal PRNG. Previously Perl would read raw bytes from the /dev/urandom device. Perl now seeds itself in this order (and falls through upon failure):
Note that the internal PRNG is still unsuitable for security applications. See "rand EXPR" in perlfunc for a discussion of security.
Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. On 32-bit builds, this can lead to an integer overflow of the size of the buffer leading to out-of-bounds writes.
If you call "pack" or "unpack" to operate on a structure whose computed size is too large to fit in memory, an integer overflow could happen that would result in a buffer overflow. This usually happens as a result of embedding a large number as the repeat count for an item.
The trie optimization in the regex engine could overflow in an alternation with more than ~65k branches. This could cause both false positives and false negatives on such regular expressions.
Before Unicode, Perl accepted any "\w" character in an identifier or other name, except the first character couldn't be a digit. Later, Unicode created two properties that described this. Even later, they found those properties to be insufficient, and created two new similar properties. These are the ones that perl has intended to use since: "\p{XID_Start}" and "\p{XID_Continue}". (The "X" stands for "eXtended" and indicates these are the more modern versions.)
(And even later, long after Perl identifier rules were formed using the above properties, Unicode added recommendations to further restrict legal identifier names. These were added to counter cases where, for example, programmers snuck code past reviewers using characters that look like other ones. The two properties are "Identifier_Status" and "Identifier_Type". See <https://www.unicode.org/reports/tr39/>. Perl currently doesn't do anything with these, except to furnish you the ability to use them in regular expressions.)
We soon discovered that there were 14 characters that match "XID_Start" and "XID_Continue" that don't also match "\w". To avoid breaking code that had long relied on "\w", we chose to not add those to the list of acceptable identifier characters.
It turns out that there are about 160 characters that match "\w" but not the Unicode "XID" properties. Thus they are illegal according to Unicode. Those are now explicitly forbidden in both Perl identifiers and regular expression group names. Previously, it was likely that their use in identifiers wouldn't work anyway; they could be accepted initially as legal, but other code would later reject them, but with a message that had nothing to do with the underlying problem. However group names in regular expression patterns could contain illegal continuation characters and have a higher probability of not being caught. That is now changed.
Only programs that do "use utf8" can be affected, and then only characters that appear in the 2nd or later positions of the name. The characters that an identifier name can begin with are unchanged.
130 of the now unacceptable characters are 5 sets of 26 Latin letters that are enclosed by some shape, such as CIRCLED LATIN CAPITAL LETTER N. Another 8 are generic modifiers that add shapes around other characters; 5 are modifiers to Cyrillic numbers; and 16 are Arabic ligatures and isolated forms. The other two are GREEK YPOGEGRAMMENI and VERTICAL TILDE.
Using an unescaped "#" or literal vertical space is now deprecated in a regular expression bracketed character class that is compiled with the "/xx" modifier. These still work, but deprecation warnings will be generated unless turned off or the constructs are cured as follows.
m/ [ % \# ( ) ] /xx
This fixes CVE-2026-9538, CVE-2026-42496, and CVE-2026-42497.
This fixes CVE-2026-7010 and CVE-2026-7017.
This fixes CVE-2025-15649, CVE-2026-48961, CVE-2026-48962, and CVE-2026-48959.
This fixes CVE-2026-12087.
This fixes CVE-2026-57433.
We have attempted to update the documentation to reflect the changes listed in this document. If you find any we have missed, open an issue at <https://github.com/Perl/perl5/issues>.
Additionally, the following selected changes have been made:
perlapi
perlexperiment
perlxs
The following additions or changes have been made to diagnostic output, including warnings and fatal error messages. For the complete list of diagnostic messages, see perldiag.
This warning was issued in the reverse order (right-to-left) when both operands of a binary operator are uninitialized values. This is now fixed to be consistent with evaluation order of operands.
In this case the "\xc1" is all that is needed to make the sequence invalid. Whatever comes after it is irrelevant (in this case, "\x27"), and including it in the message might lead the reader to think that it somehow does matter.
The names of variables whose names begin with a caret and are longer than two characters are now wrapped in braces, just as they have to be in the source code.
Therefore, using an undefined "${^_FOO}" will now correctly warn with "Use of uninitialized value ${^_FOO}", instead of the earlier "Use of uninitialized value $FOO" (with a literal "Ctrl-_" after the dollar sign).
[GH #24135 <https://github.com/Perl/perl5/issues/24135>]
Since Perl 5.39.1, calling "import" with arguments on a package without such a method has triggered a deprecation warning. In Perl 5.43.6, this deprecation was promoted into an error. This broke a significant amount of code while providing very little advantage over the warning. This fatal error has been converted back to a warning, with its deprecation status removed. There are no longer any plans to make this fatal in the future. The category for this warning is "missing_import" and it is enabled by default.
New Errors
(F) A "my", "our" or "state" keyword was used with the exception variable in a "catch" block:
try { ... }
catch (my $e) { ... }
# or catch (our $e) { ... }
# or catch (state $e) { ... }
This is not valid syntax. "catch" takes a bare variable name, which is automatically lexically declared. [GH #23222 <https://github.com/Perl/perl5/issues/23222>]
(F) You have used "goto LABEL;" or "goto EXPR;" in an attempt to jump into the body of a loop or other block construct from the outside. As of Perl 5.44, this throws an exception.
In most cases where this message now appears, an error would have occurred anyway, but the text would not have been helpful in finding the problem.
New Warnings
(W qw) qw() lists contain items separated by whitespace; contrary to what some might expect, backslash characters cannot be used to "protect" whitespace from being split, but are instead treated as literal data.
Note that this warning is only emitted when the backslash is followed by actual whitespace (that "qw" splits on).
Tests were added and changed to reflect the other additions and changes in this release. Furthermore, these changes were made:
It is for a misleading warning message in an edge case for reading malformed UTF-8 in XS-APItest/t/utf8_warn00.t. (Several instances of the same failure occur.)
Check for updates to these on cpan.
An open source project has been created to modify the official perl to work on z/OS in ASCII mode. See <https://github.com/zopencommunity/perlport>.
This would help with sizing allocations such that SvLEN is more accurate and not trying to shrink string buffers to save size when the intended saving is unrealistic.
It also now uses "Perl_expected_size", compared against the current buffer size, and does not try to do a reallocation if the requested memory saving is unrealistic.
Historically, "Perl_newSVsv_flags" and "Perl_sv_mortalcopy_flags" would pass a new SV head and the original SV to "Perl_sv_setsv_flags". However, the latter contains many branches of no relevance to a fresh SV, so they now make use of the new function to streamline the process.
"Perl_newSVsv_flags" is now essentially a NULL pointer check and wrapper around the new function, so has been moved into sv_inline.h.
(The assumption in this change is that SvOK(sv) is a valid indicator of whether the string buffer contents are "live" or not.)
See [GH #23967 <https://github.com/Perl/perl5/issues/23967>] for an example of where such a copy was noticeable.
This also extends the sv_numeq API to support "SV_FORCE_OVERLOAD".
This change shouldn't affect any "XS" module code that is using the test macros correctly, though might cause confusion to code that attempts to analyse "SvFLAGS" bits directly outside of the helper macros.
When this occurred, the relevant scalars returned by "keys %hash" would not be in the original, expected UTF-8 encoding.
The original encoding is now captured and propagated. [GH #24266 <https://github.com/Perl/perl5/issues/24266>] [GH #24290 <https://github.com/Perl/perl5/pull/24290>]
The numerical values are now carried across, and flags on the key variable reflect the original data type.
Note: This now preserves the form of constant keys supplied to tied hashes in list assignments. [GH #24302 <https://github.com/Perl/perl5/issues/24302>]
[GH #23676 <https://github.com/Perl/perl5/issues/23676>]
[GH #23676 <https://github.com/Perl/perl5/issues/23676>]
In previous versions of Perl, the exception message thrown by a "method" subroutine with a signature when it does not receive an appropriate number of arguments to match its declared parameters failed to account for the implied $self parameter, causing the numbers in the message to be 1 fewer than intended.
This has now been fixed, so messages report the correct number of arguments including the object invocant.
# Two-variable for loop over a list returned from a method call:
for my ($x, $y) (Some::Class->foo()) { ... }
for my ($x, $y) ($object->foo()) { ... }
and
# Two-variable for loop over a list returned from a call to a
# lexical(ly imported) subroutine, all inside a lexically scoped
# or anonymous subroutine:
my sub foo { ... }
my $fn = sub {
for my ($x, $y) (foo()) { ... }
};
use builtin qw(indexed); # lexical import!
my sub bar {
for my ($x, $y) (indexed(...)) { ... }
}
These have been fixed. [GH #23405 <https://github.com/Perl/perl5/issues/23405>]
"INTERFACE" is now compatible with ISO/IEC 9899:2024 ("C23"), which is the default language version used by GCC 15. Previously, it generated code that failed to compile as C23.
Secondly, "INTERFACE" now supports Perl package names as C types (i.e. "Foo::Bar" gets auto-converted to "Foo__Bar").
[GH #23192 <https://github.com/Perl/perl5/issues/23192>]
"CORE::__CLASS__" would work as expected when used as a bareword or aliased:
use feature qw(class);
class Foo {
BEGIN { *cls = \&CORE::__CLASS__; }
method bar() {
my $class1 = CORE::__CLASS__; # ok
my $class2 = cls; # ok
}
}
But when called with an ampersand ("&CORE::__CLASS__()") or through a reference ("my $ref = \&CORE::__CLASS__; $ref->()"), it would return unrelated strings. These runtime calls have been fixed to throw an error of the form "&CORE::__CLASS__ cannot be called directly" instead of silently returning incorrect results.
[GH #23737 <https://github.com/Perl/perl5/issues/23737>]
Previously, calling the parse_subsignature() API function with an empty signature would cause a "Syntax error" failure, requiring code which calls it to detect the special case and take appropriate steps. This is now fixed, returning the same optree that the parser would yield for a regular empty signature during normal parse time.
[GH #17689 <https://github.com/Perl/perl5/issues/17689>]
$ perl -CA -s -e 'printf "%vx\n", $_ for $foo, $ARGV[0]' -- -foo=é é
c3.a9
e9
Here $foo would end up containing the two-byte UTF-8 representation of "LATIN SMALL LETTER E WITH ACUTE", but $ARGV[0] would contain a single codepoint corresponding to U+00E9.
This has been fixed: If "-CA" is in effect, options parsed by "-s" are treated as UTF-8, too. In the example above, $foo and $ARGV[0] now both contain chr(0xE9). [GH #23377 <https://github.com/Perl/perl5/issues/23377>]
@{ $cond ? $h{foo} : $h{bar} } = ...;
the first branch would correctly autovivify $h{foo} to an array ref, but the second branch might incorrectly autovivify $h{bar} to a hash ref. [GH #18669 <https://github.com/Perl/perl5/issues/18669>].
sub wrap { goto \&an_xsub_which_returns_no_values }
$ret = wrap();
[GH #24212 <https://github.com/Perl/perl5/issues/24212>]
class Foo {
field @bar = ();
}
Foo->new();
Error message: "perl: inline.h:194: Perl_av_new_alloc: Assertion `size > 0' failed."
This has been fixed. [GH #24246 <https://github.com/Perl/perl5/issues/24246>]
None
"WELL VOLUNTEERED!" echoed across conference rooms and IRC channels. Matt S. Trout's battle cry that transformed reluctant volunteers into community leaders.
With profound sadness, we announce Matt's passing. Since the early 2000s, Matt shaped Perl through sheer force of will: IRC operator, PAUSE administrator, Shadowcat Systems co-founder, architect of DBIx::Class. His opinions came wrapped in profanity and delivered at maximum volume. He suffered no fools and grew to sometimes realize he should apologize. Yet this same abrasive exterior protected fierce dedication to mentoring, developers he harangued into volunteering now lead the community themselves. Matt's deliberately mind-bending code pushed Perl forward. Every modern Perl developer touches his legacy daily.
Well volunteered, Matt. Rest in peace.
Perl 5.44.0 represents approximately 12 months of development since Perl 5.42.0 and contains approximately 270,000 lines of changes across 1,300 files from 71 authors.
Excluding auto-generated files, documentation and release tools, there were approximately 110,000 lines of changes to 860 .pm, .t, .c and .h files.
Perl continues to flourish into its fourth decade thanks to a vibrant community of users and developers. The following people are known to have contributed the improvements that became Perl 5.44.0:
Alexander Karelas, Aristotle Pagaltzis, Arne Johannessen, Bartosz Jarzyna, Branislav Zahradník, brian d foy, Chad Granum, Chris 'BinGOs' Williams, Chris Prather, Christian Hansen, Craig A. Berry, Dagfinn Ilmari Mannsåker, Dan Book, Dan Church, Daniel Dragan, Daniel Laügt, Daniel Tang, Dan Kogai, Dave Cross, David Mitchell, Dmitrii Kuvaiskii, E. Choroba, Ed J, Elvin Aslanov, Eric Herman, Eugen Konkov, Graham Knop, Harald Jörg, H.Merijn Brand, Igor Todorovski, James Cook, James E Keenan, James Raspass, Jörg Thomas, Karen Etheridge, Karl Williamson, Leon Timmermans, Lukas Mai, Marc Reisner, Masahiro Iuchi, Matthew Horsfall, Maxim Vuets, Max Maischein, Nicolas R, Olaf Alders, Paul Evans, Paul Marquess, Peter John Acklam, Philippe Bruhat (BooK), Ricardo Signes, Richard Leach, Robert Rothenberg, Ryan Carsten Schmidt, Samuel Smith, Samuel Young, Scott Baker, Sevan Janiyan, Shirakata Kentaro, Sisyphus, Stan Ulbrych, Stefan Adams, Štěpán Němec, Steve Hay, TAKAI Kousuke, Thibault Duponchelle, Toby Inkster, Tomasz Konojacki, Tom Wyant, Tony Cook, Unicode Consortium, Yitzchak Scott-Thoennes.
The list above is almost certainly incomplete as it is automatically generated from version control history. In particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker.
Many of the changes included in this version originated in the CPAN modules included in Perl's core. We're grateful to the entire CPAN community for helping Perl to flourish.
For a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.
If you find what you think is a bug, you might check the perl bug database at <https://github.com/Perl/perl5/issues>. There may also be information at <https://www.perl.org/>, the Perl Home Page.
If you believe you have an unreported bug, please open an issue at <https://github.com/Perl/perl5/issues>. Be sure to trim your bug down to a tiny but sufficient test case.
If the bug you are reporting has security implications which make it inappropriate to send to a public issue tracker, then see "SECURITY VULNERABILITY CONTACT INFORMATION" in perlsec for details of how to report the issue.
If you wish to thank the Perl 5 Porters for the work we had done in Perl 5, you can do so by running the "perlthanks" program:
perlthanks
This will send an email to the Perl 5 Porters list with your show of thanks.
The Changes file for an explanation of how to view exhaustive details on what changed.
The INSTALL file for how to build Perl.
The README file for general stuff.
The Artistic and Copying files for copyright information.
| 2026-07-13 | perl v5.44.0 |