Perl 5.42.0 Released

The Perl development team has officially released Perl v5.42.0, introducing a blend of modern language features, thoughtful refinements to long-standing behavior, and a round of performance and security enhancements. This release marks a significant update from v5.40.0, continuing Perl’s tradition of evolution with care for stability and backward compatibility.

Among the most visible enhancements in Perl 5.42.0 is the improved support for the CORE:: namespace. Developers can now treat built-in functions like chdir as first-class subroutine references—something that previously led to errors when attempting constructs like &CORE::chdir or taking a reference to it.

Another addition aimed at easing developer pain is the new source::encoding pragma. Designed to catch common errors early, this pragma ensures source files are explicitly marked as ASCII-only or UTF-8, with automatic activation when using version declarations from v5.41.0 onward. This feature helps reduce encoding-related bugs, especially in mixed-environment deployments.

Perl’s evolving object system also sees a practical boost. Classes defined with use feature 'class' can now specify scalar fields with a :writer attribute, joining the previously available :reader. This enables idiomatic getter/setter behavior with minimal boilerplate, continuing Perl’s push toward more ergonomic class definitions.

One of the more exciting additions is the introduction of the any and all list-processing operators as experimental keywords. Inspired by their namesakes in List::Util, these core-native constructs allow short-circuiting evaluations, making them ideal for efficient list checks—e.g., determining if all items in a list satisfy a condition. Unlike their module counterparts, these operators are compiled directly into the core for better performance and no subroutine overhead.

In another nod to encapsulation and modularity, Perl now supports lexical method declarations via my method, along with the new ->& operator for invoking these private methods. Together, they enable truly private, lexical-scoped methods that are invisible outside their declaration context—a major win for writing secure and maintainable classes.

Not all changes are about moving forward — some are about recognizing what still works. The use of apostrophes (') as package separators, a legacy syntax from early Perl, had been deprecated and removed in earlier versions. After community feedback, it's now reinstated by default, with a dedicated apostrophe_as_package_separator feature flag to enable or disable its usage as needed.

Similarly, the long-contentious switch and smartmatch (~~) features—first introduced in Perl 5.10 and marked for removal in this release—have been granted an indefinite reprieve. These constructs now require explicit enabling via feature flags, but their presence in the language is once again secure, offering developers more time and flexibility to adapt or migrate.

Perl 5.42.0 expands Unicode support to Unicode 16.0, including changes introduced in Unicode 15.1. Developers working with internationalized or multilingual data can now rely on the most up-to-date character properties and classifications.

A minor but welcome syntax fix completes the introduction of the exclusive-or operator ^^, which was added in Perl 5.40.0. The new version now includes the missing assigning variant ^^=, rounding out the logical operator set.

The release includes a number of behind-the-scenes optimizations. Constant-folded strings are now automatically shared using Perl’s internal copy-on-write mechanism, dramatically reducing memory usage for large, repeated strings. Code like:

now allocates just one string buffer, instead of eleven.

The performance of tr/// (character translation) has also been improved. When translating only ASCII characters, the speed is now consistent regardless of whether the string is internally encoded as UTF-8.

Additional improvements target the built-in indexed function: when used in a foreach loop to unpack index-value pairs from a list, the interpreter now avoids building temporary data structures, operating directly on the original list.

Several micro-optimizations have also landed, including more efficient stringification of integer scalars, faster single-argument reverse operations, and new peephole optimizer logic for substr($x, 0, ...) patterns, which now use a dedicated OP_SUBSTR_LEFT for better performance.

Two important vulnerabilities have been addressed in this release.
CVE-2024–56406 fixes a heap buffer overflow in the tr/// operator, which could allow denial-of-service or even arbitrary code execution in scenarios involving crafted non-ASCII translation sets. The fix is backportable and applies to older, unsupported Perl versions as well.

CVE-2025–40909 resolves a race condition in Perl’s threading system that affected file operations performed after thread cloning. The issue involved unsynchronized changes to the working directory, which could result in unintended file paths being accessed. This fix eliminates the chdir behavior from the child thread clone path, improving security and predictability.

One behavior change from Perl 5.40.0 has been rolled back: references from nested functions to their containing functions — originally introduced to restore debugger support — have been removed due to unintended memory leaks caused by circular references. While this means debugger visibility into lexical scopes may be reduced again, it resolves stability and memory usage issues.