From 969ed2bc64e3f9be1fac6955f52593be95e5a6c4 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 30 Apr 2026 01:34:08 +0200
Subject: [PATCH] perlPackages.Plack: 1.0050 -> 1.0053

Also disables Plack::Middleware::XSendfile due to CVE-2026-7381. The
feature can be enabled by setting PLACK_ENABLE_INSECURE_XSENDFILE=1
---
 ...ile-disable-by-default-CVE-2026-7381.patch | 31 +++++++++++++++++++
 pkgs/top-level/perl-packages.nix              |  7 +++--
 2 files changed, 35 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch

diff --git a/pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch b/pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch
new file mode 100644
index 000000000000..32244e52ac8c
--- /dev/null
+++ b/pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch
@@ -0,0 +1,31 @@
+diff --git a/lib/Plack/Middleware/XSendfile.pm b/lib/Plack/Middleware/XSendfile.pm
+index f2cd859..f96ccb5 100644
+--- a/lib/Plack/Middleware/XSendfile.pm
++++ b/lib/Plack/Middleware/XSendfile.pm
+@@ -10,7 +10,11 @@ use Plack::Util::Accessor qw( variation );
+ 
+ sub new {
+     my $class = shift;
+-    Carp::carp("Plack::Middleware::XSendfile is deprecated and will be removed in a future release");
++    unless (($ENV{PLACK_ENABLE_INSECURE_XSENDFILE} // '') eq '1') {
++        Carp::croak(
++          "CVE-2026-7381: Plack::Middleware::XSendfile is disabled by default. Set PLACK_ENABLE_INSECURE_XSENDFILE=1 to enable"
++        );
++    }
+     $class->SUPER::new(@_);
+ }
+ 
+diff --git a/t/Plack-Middleware/xsendfile.t b/t/Plack-Middleware/xsendfile.t
+index f1a02fa..248815e 100644
+--- a/t/Plack-Middleware/xsendfile.t
++++ b/t/Plack-Middleware/xsendfile.t
+@@ -6,6 +6,9 @@ use Plack::Builder;
+ use Plack::Test;
+ use Cwd;
+ 
++# CVE-2026-7381: Insecure feature disabled by default, but enable for tests
++$ENV{PLACK_ENABLE_INSECURE_XSENDFILE} = 1;
++
+ sub is_wo_case($$;$) {
+     is lc $_[0], lc $_[1], $_[2];
+ }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 80435757abc5..7a721c264822 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -28193,10 +28193,10 @@ with self;
 
   Plack = buildPerlPackage {
     pname = "Plack";
-    version = "1.0050";
+    version = "1.0053";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-1.0050.tar.gz";
-      hash = "sha256-0mUa3oLrv/er4KOhifyTLa3Ed5GGzolGjlbQGJ6qbtQ=";
+      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-1.0053.tar.gz";
+      hash = "sha256-QPxEA0wWTpr3DdCP++5AjCQwLsDbMQ0pAd9xdTuxZ9o=";
     };
     buildInputs = [
       AuthenSimplePasswd
@@ -28226,6 +28226,7 @@ with self;
       TryTiny
     ];
     patches = [
+      ../development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch
       ../development/perl-modules/Plack-test-replace-DES-hash-with-bcrypt.patch
     ];
     meta = {