Changes for version 2.2.0 - 2026-09-16
- SECURITY
- PR #1836: Fix path traversal in Dancer2::Handler::File, which served files from outside public_dir; see GHSA-6xw8-v24c-m783 (David Precious)
- PR #1836: A halting on_hook_exception handler no longer lets the route the hook refused run anyway; see GHSA-v527-r4px-7vx7 (David Precious)
- GH #1822: Strip CR and LF from response header names, as was already done for header values (David Precious)
- GH #1823: AutoPage no longer serves a layout as a page on case-insensitive filesystems (David Precious)
- BUG FIXES
- GH #1781: Fix directory detection heuristic (Jason A. Crome)
- GH #1784: Fix UTF-8 handling in Serializer::JSON for readonly values (Russell @veryrusty Jenkins)
- GH #1790: Fix infinite recursion into blessed objects in JSON Serializer (Russell @veryrusty Jenkins)
- PR #1791: Send correct error codes in send_file (Anton Lundin)
- PR #1797: Fix path()/dirname() DSL keywords dropping their first argument (Mike Weisenborn)
- PR #1801: Fix failing CI (Jason A. Crome)
- PR #1804: Make session ID generation always use Crypt::URandom and harden validate_id against invalid session IDs (David Precious)
- GH #1824: Encode each response content assignment on its own merits, not just the first (David Precious)
- GH #1825: Serializer::Mutable now ignores content type parameters such as charset when choosing a format (David Precious)
- GH #1826: uri_for_route accepts a route parameter of 0, and refuses an empty one with a clearer message (David Precious)
- GH #1827: Hooks are compiled exactly once however many times to_app is called (David Precious)
- GH #1828: A NUL byte in a static file request no longer warns once per request (David Precious)
- GH #1829: dancer2 gen -g (and -r) no longer dies after writing the application (David Precious)
- GH #1830: dancer2 gen names the application directory after the dashed distribution name (David Precious)
- GH #1831: dancer2 gen appends a relative, matchable pattern to MANIFEST.SKIP (David Precious)
- ENHANCEMENTS
- None
- DOCUMENTATION
- DEPRECATED
- PR #1821: Remove Data::Dumper serializer from Dancer2 core, along with from_dumper/to_dumper keywords, tests (David Precious)
- MISC
- GH #1834: Rename share/.gitignore so git stops applying it to this distribution's own share/ tree (David Precious)
- GH #1835: Add a characterization test suite under t/unit, t/integration and t/e2e (David Precious)
- With thanks to Curtis "Ovid" Poe, whose generated test suite from PAAD for Dancer2 found the defects fixed above
Documentation
Define the process by which outdated, broken, or unused code is removed from Dancer2
A guide to building web applications with Dancer2
Dancer2 Configuration Reference
Example-driven quick-start to the Dancer2 web framework
A non-exhaustive guide to put your Dancer2 app into production
A guide to extending Dancer2 via engines and plugins
Dancer2 DSL Keyword Reference
Migrating from Dancer to Dancer2
A curated list of recommended Dancer2 plugins
Quickly install Dancer2 and boostrap a new application
Writing tests for Dancer2
A step-by-step guide to get you dancing
Dancer core and community policy and standards of conduct
Dancer2 command line interface
Modules
Lightweight yet powerful web application framework
Dancer2 CLI application
Create new Dancer2 application
Display Dancer2 version
Config reader for Dancer2 App
Config reader for files
Config utility helpers
Core libraries for Dancer2 2.0
encapsulation of Dancer2 packages
A cookie representing class
Dancer2's Domain Specific Language (DSL)
Class for dispatching request to the appropriate route handler
Class representing fatal errors
Instantiate components by type and name
helper for rendering HTTP status codes for Dancer2
Manipulate hooks with Dancer2
Class to ease manipulation of MIME types
Interface for accessing incoming requests
Class representing file upload requests
Response object for Dancer2
Delayed responses
Config reader role for Dancer2 core objects
Role for DSL
Role for engines
Role for Handlers
Role that represents the config of Dancer2 App
Role for application environment name
Role for application location "guessing"
Role for hookable objects
Role for logger engines
Role for Serializer engines
Role for session factories
Role for file-based session factories
Role to provide commonly used responses
Role for template engines
Dancer2's route handler
Top-layer class to start a dancer app
class to represent any session object
class to handle common helpers for time manipulations
Type::Tiny types for Dancer2 core.
File utility helpers
Class for handling the AutoPage feature
class for handling file content rendering
Capture dancer logs
a place to store captured Dancer2 logs
Console logger
Test::More diag() logging engine for Dancer2
file-based logging engine for Dancer2
Test::More note() logging engine for Dancer2
Blackhole-like silent logging engine for Dancer2
base class for Dancer2 plugins
Serializer for handling JSON data
Serialize and deserialize content based on HTTP header
Serializer for handling YAML data
in-memory session backend for Dancer2
YAML-file-based session backend for Dancer2
Template toolkit engine for Dancer2
Template::Tiny engine for Dancer2
Useful routines for testing Dancer2 apps