Smolder-1.52

Security Advisories (1)

CVE-2024-58041 (2026-02-24)

Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions. Smolder 1.51 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Smolder::DB::Developer uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.

Changes for version 1.52

Improved how smolder_smoke_signal handle port number
Improved how Smolder::Conf determine share_dir
Fixed another broken list to access project graphs
Cherry-picked from mcartmell/smolder:
- 9971951: set smtphost to localhost
- d3792b2: inline css for emails
- ff25b49: various css changes
- 0fd15ee: correct some columns
- d54d92d: tweaks to db creation
- a706e8a: change input type to password on adding new users
Merged markstos/smolder-as-cgi
- Add a CGI-based dispatcher -- Mark Stosberg, Sven Dowideit
- Add smolder_create_database -- Mark Stosberg
Merged mumblingMac/v1.5.2:
- Modifed subject line in smoke report e-mail to display more detail
  - P. Leonard, K. McDaniel
- Fixed problem where the AutoRedirectToProject configuration directive would redirect to a broken link -- K. McDaniel
- Fixed broken link(s) for progess graphs on project listing pages
  - K. McDaniel
- Fixed broken link to the full report within the smoke report e-mail(s)
  - P. Leonard, K. McDaniel
- Fixed auto completion for platform and architecture fields when submitting a new smoke report -- P. Leonard
- Fixed RT #55514 by removing references of developer_X and public_X within the URLs -- P. Leonard
- Fixed RT #84077 by enabling the skip field to be charted on the progress graphs -- K. McDaniel
Merged maddingue/master:
- fix 'Use of qw(...) as parentheses is deprecated' warnings
Merged converter/master:
- Fix broken URL paths containing "developer_projects" which result in CGI::Application errors for missing action handlers.
- Add support for UrlBase configuration option. Specifies base URL to be used in href attributes when Smolder is behind a proxy.
Merged Whiteknight/master:
- Some small fixes for readability. "Recieve" -> "Receive". "everytime"...
Merged trammell/master:
- "it's" means "it is"; "its" is possessive
Merged avar/1.51-fixes:
- Add --log_level option to specify LogLevel