Review guide: 9 green PRs ready to merge (quick wins take ~5 min)

[toddr-bot]

Overview

There are currently 9 open PRs covering all known issues in this repository. This issue serves as a review guide with a conflict-aware merge order.

🎯 Quick Wins — Start Here

These PRs take under 3 minutes to review and have zero risk:

PR	What	Size	Risk
#24	Modernize CI matrix (drop yanked Docker images, add 5.34–5.40, add Windows)	1 file, +34/−12	None — CI only
#25	Three one-liner fixes: cpanfile dep, 3-arg open, URL casing	4 files, +39/−17	Trivial
#16	Fix eval "require $mod" code injection in digest-bench	3 files, +55/−18	Low — security fix in non-installed script

Suggested Merge Order

Some PRs modify the same files and will conflict if merged in the wrong order. The order below minimizes rebase friction — each PR applies cleanly when the ones above it are already merged.

Phase 1: Infrastructure (no conflicts with anything)

1. ci: modernize CI matrix and add Windows testing #24 — Modernize CI matrix and add Windows testing (1 file, trivial)
2. fix: packaging and code hygiene fixes #25 — Packaging: cpanfile fix, 3-arg open, URL casing (4 files, three one-liners)
3. fix: prevent code injection in digest-bench #16 — Fix code injection in digest-bench (3 files, straightforward)

Phase 2: Bug fixes

4. fix: encode UTF-8 flagged strings to bytes in Digest->add() #11 — Fix broken UTF-8 string handling (issue Broken handling of unicode strings [rt.cpan.org #54369] #2) — modifies Digest.pm new() (5 files, +172/−16)
5. fix: add AUTOLOAD DESTROY guard, document digest_file_ctx #26 — AUTOLOAD DESTROY guard, modernize Digest::file, document digest_file_ctx (5 files, +65/−18)

Phase 3: Test coverage

6. test: add edge case tests for Digest::base and fix b64digest arg forwarding #22 — Fix b64digest arg forwarding + edge case tests — modifies Digest/base.pm (4 files, +234/−13)

Phase 4: Features (depend on earlier PRs)

7. feat: add URL-safe base64 digest method (b64url_digest) #23 — URL-safe base64 (b64url_digest, RFC 4648) — conflicts with test: add edge case tests for Digest::base and fix b64digest arg forwarding #22 and fix: add AUTOLOAD DESTROY guard, document digest_file_ctx #26 if they haven't merged first. Touches base.pm, file.pm, t/base.t, t/file.t. (6 files, +104/−18)
8. fix: Add encoding option to Digest->new() for charset normalization #10 — Encoding option for Digest->new() (issue character-sets [rt.cpan.org #80306] #3) — conflicts with fix: encode UTF-8 flagged strings to bytes in Digest->add() #11 on Digest.pm new(). (5 files, +277/−13)

Phase 5: Docs

9. test: add dispatch tests and CLAUDE.md #19 — Add dispatch tests and CLAUDE.md (5 files, +194/−12)

Review Effort Summary

PR	Files	Lines Changed	Review Time	Category
#24	1	+34/−12	~1 min	CI
#25	4	+39/−17	~2 min	Packaging
#16	3	+55/−18	~2 min	Security
#26	5	+65/−18	~5 min	Bug fix
#23	6	+104/−18	~5 min	Feature
#11	5	+172/−16	~10 min	Bug fix
#19	5	+194/−12	~10 min	Tests
#22	4	+234/−13	~10 min	Tests + fix
#10	5	+277/−13	~15 min	Feature

Conflict Map

PRs that touch the same files (will need rebase if merged out of order):

Files	PRs	Notes
lib/Digest.pm new()	#10, #11	Both modify the return path in new(). Merge #11 first.
lib/Digest/base.pm b64digest area	#22, #23	#22 fixes forwarding, #23 adds adjacent method. Merge #22 first.
lib/Digest/file.pm exports + POD	#23, #26	#26 modernizes @ISA→use base, #23 adds new export. Merge #26 first.
t/base.t	#23, #25	#25 fixes open() call, #23 adds test. Low conflict risk.
t/file.t	#23, #26	Both add tests. Merge #26 first.
MANIFEST	#10, #11, #19, #22	All add entries. Trivial to resolve.

CI Status (2026-07-23)

PR	Status	Notes
#10	✅ all checks passing
#11	✅ all checks passing
#16	✅ all checks passing
#19	✅ all checks passing
#22	✅ all checks passing
#23	✅ all checks passing
#24	✅ all checks passing
#25	✅ all checks passing
#26	✅ all checks passing

All PRs are mergeable (no conflicts with main).

Notes

• All PRs are rebased on current main (v1.20 release).
• PRs fix: Add encoding option to Digest->new() for charset normalization #10 and fix: encode UTF-8 flagged strings to bytes in Digest->add() #11 address open issues character-sets [rt.cpan.org #80306] #3 and Broken handling of unicode strings [rt.cpan.org #54369] #2 respectively.
• Consolidated from 13 PRs to 9 in April 2026.
• Upstream (gisle/digest) dormant since 2014. Fork (Dual-Life/Digest) is the active maintenance point.

Cross-repo cleanup (2026-05-26)

Duplicate PRs on upstream (gisle/digest) have been closed:

• CVE-2016-1238: Digest may load an optional module from the current directory [rt.cpan.org #116512] #5 → fix: prevent code injection in digest-bench #16, uses barewords for file handles. we should fix this. #8 → feat: add URL-safe base64 digest method (b64url_digest) #23, Missing version info for module 'Digest' #9 → test: add edge case tests for Digest::base and fix b64digest arg forwarding #22, fix: Add encoding option to Digest->new() for charset normalization #10 → ci: modernize CI matrix and add Windows testing #24, fix: use 3-arg open in t/base.t #13 → fix: add AUTOLOAD DESTROY guard, document digest_file_ctx #26
• "local $@" error in Digest 0.17 [rt.cpan.org #85473] #4 (guillemj, "Stop using use vars") — addressed in 1.18 + fix: add AUTOLOAD DESTROY guard, document digest_file_ctx #26

---

🤖 Updated by Kōan — added review effort estimates and quick-win recommendations (2026-07-23)

[toddr-bot]

Update: April 15

• Orphan branches consolidated: Two pushed branches without PRs (fix-docs-and-autoload, modernize-digest-file) have been combined into a single PR: gisle/digest#13

  • Adds empty DESTROY to prevent AUTOLOAD from catching GC calls
  • Replaces @ISA with use base in Digest::file (consistent with 5.006 compat)
  • Documents digest_file_ctx in POD (was exported but undocumented)
  • Tests for all changes

• Total open PRs: 14 on this fork + 1 upstream = 15 total

• CI status: PR ci: fix broken test matrix and update actions #20 remains the only one with clean CI. All others show expected Docker image failures for Perl 5.8-5.24. Merging ci: fix broken test matrix and update actions #20 first is still the recommended path.

[toddr-bot]

CI update — All 8 PRs (#10, #11, #16, #19, #22, #23, #25, #26) were failing CI because the old perl:5.8–perl:5.24 Docker images have been removed from Docker Hub. Cherry-picked the CI modernization from PR #24 into all 8 branches. They should all go green once CI re-runs.

This means PR #24 is no longer a prerequisite for the others — its CI fix is now included in every branch.