I'm looking at pushing a trixie fix for Archive-Tar CVE-2026-42496 in
src:perl via a point release.

As seen in https://github.com/Perl/perl5/issues/24452 the fix makes
Module-CPANTS-Analyse fail its test suite.

 not ok 13 - symlinks not listed in MANIFEST is not ignored for a non-local distribution

 #   Failed test 'symlinks not listed in MANIFEST is not ignored for a non-local distribution'
 #   at t/analyse/manifest.t line 84.

An easy way to see this is just building libmodule-cpants-analyse-perl_1.02-1 in forky or sid.

This has been fixed upstream in 1.03 with

https://github.com/cpants/Module-CPANTS-Analyse/commit/fed1a10a9d9170bce71777745d504cd427692e2d

which should works with and without the Archive-Tar fix.

Please consider supplying a point release update of
libmodule-cpants-analyse-perl with this patch to avoid a regression
in stable.

We believe that the bug you reported is fixed in the latest version of
libmodule-cpants-analyse-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146144@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libmodule-cpants-analyse-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 31 Aug 2026 16:01:08 +0200
Source: libmodule-cpants-analyse-perl
Architecture: source
Version: 1.02-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1146144
Changes:
 libmodule-cpants-analyse-perl (1.02-1+deb13u1) trixie; urgency=medium
 .
   * Add 0001-Use-relative-rather-than-absolute-symlink-in-t-analy.patch.
     Backport fix for interoperability with Archive::Tar >= 3.08.
     Patch taken from upstream Git as included in 1.03.
     (Closes: #1146144)
Checksums-Sha1:
 4f3509a9edbf7e51c787e4d1c6e82dbdd4564ab8 3221 libmodule-cpants-analyse-perl_1.02-1+deb13u1.dsc
 d26e1e9e2907068ed42108d91d7ca4fcd98cb456 5288 libmodule-cpants-analyse-perl_1.02-1+deb13u1.debian.tar.xz
Checksums-Sha256:
 b59392eab075c6ab4931e1c6201682eb4640de4e36953f11f42cbeb2c5ff7beb 3221 libmodule-cpants-analyse-perl_1.02-1+deb13u1.dsc
 f8147f1daadf9a4c0adc066bdce09411dcbb733d777711e1eda7d526dbc0af64 5288 libmodule-cpants-analyse-perl_1.02-1+deb13u1.debian.tar.xz
Files:
 30e70edba6fc1976945fe3b19e4f08a3 3221 perl optional libmodule-cpants-analyse-perl_1.02-1+deb13u1.dsc
 8bb4a816f0b14ef270a0ee98cb4948e6 5288 perl optional libmodule-cpants-analyse-perl_1.02-1+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXSCVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgbw+hAAtONLW1TXybUCC1BHFgOE9UcuAAxzIvSZdoT2aKRMsft0LTAJ3yYBdkIF
RU0lndtBYxX9cR6bmSyqYE5fn9l6O76YNMiCLvY2xMYufBlSUR0pJR57kAhzQTNT
2IsWlIZUDY0PNec6IboIyAdea+pyNNjegNAoOjSXZPQZV6OyqNZYmWrd/8bq7I2v
3NSTaf8/7r+jklxFBC10kyzTEKxuC7h2YKBdk8h+V/a8dW2XK2PFTtNUKxvFiCYT
acOR+yX1ScIg+9OyP7Y6Podk5e3si/KDhAftIKytmOU20GTMp+2NPRAz5ZPXe9Nr
0Bf2xq3CjpWVdw++3dtVCjYhZzT3x4wen3RFUWkj0GtgIEB6uylF14omz684ngiw
iHxC4DwQvH8QamUcj9Y1rPHiv6mcC9CnylniEd8TakAInN7OuG8UCGqqVMu75b4x
vY47071ABwuM1u50IXvZ2cQVICXLrDuExm9cEXRO3LiVegoeBB01T2MhEefGvqbu
90DAM8kPnOdIvYjaODREDtDg3dCoQmy6sTmVkPrtX4pyszqnanrhstyk3OfdAkUD
ZwQeHnfT0XP/sy35/EI0KIlXywn2ia76UfFiY/ClbZNYIYdspYFJjndt4vNl5zpV
J17V1CU2W6kqNNwvHlmM1ys8YwMPe938zGnK9fOetnHsAWmY79g=
=Kzwp
-----END PGP SIGNATURE-----