[rpms/perl-YAML-Syck] rawhide: Update to 1.47

[rpms/perl-YAML-Syck] rawhide: Update to 1.47

[Paul Howarth]

            A new commit has been pushed.

            Repo   : rpms/perl-YAML-Syck
            Branch : rawhide
            Commit : 78ce1465a0fd0cf7b918675ae2d415ad77d5611e
            Author : Paul Howarth <paul@city-fan.org>
            Date   : 2026-07-14T10:22:25+01:00
            Stats  : +32/-4 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/perl-YAML-Syck/c/78ce1465a0fd0cf7b918675ae2d415ad77d5611e?branch=rawhide

            Log:
            Update to 1.47

- New upstream release 1.47
  Security:
  - Fix four libsyck memory-safety CVEs reachable from the default
    YAML::Syck::Load() path on untrusted input with no special flags (GH#213)
    - CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder
      caused by signed-char indexing of the decode table on !!binary input
    - CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared
      between the node and the anchors table
    - CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer
      newline scan during block-scalar parsing (incomplete-fix follow-on
      to CVE-2025-11683)
    - CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an
      anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input
  - Harden syck_base64dec() to bounds-check each read so it cannot run past a
    non-NUL-terminated input buffer (defense-in-depth for callers passing raw
    buffers; GH#213)
  Bug Fixes:
  - Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply
    nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512,
    matching Dump (GH#204)
  - Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in
    Dump so they roundtrip with ImplicitTyping instead of reloading as plain
    strings (GH#201)
  Maintenance:
  - CI: add an AddressSanitizer job that builds the XS with
    -fsanitize=address and runs the suite plus the CVE trigger inputs to catch
    libsyck memory-safety defects; de-pin the libasan version so it tracks the
    runner's GCC (GH#213)

---
diff --git a/perl-YAML-Syck.rpmlintrc b/perl-YAML-Syck.rpmlintrc
deleted file mode 100644
index 1c9d082..0000000
--- a/perl-YAML-Syck.rpmlintrc
+++ /dev/null
@@ -1,2 +0,0 @@
-# Name of bundled YAML library
-addFilter("spelling-error \('libsyck',")

diff --git a/perl-YAML-Syck.spec b/perl-YAML-Syck.spec
index 678f689..92b4721 100644
--- a/perl-YAML-Syck.spec
+++ b/perl-YAML-Syck.spec
@@ -6,7 +6,7 @@
 %endif
 
 Name:           perl-YAML-Syck
-Version:        1.46
+Version:        1.47
 Release:        1%{?dist}
 Summary:        Fast, lightweight YAML loader and dumper
 # gram.*: GPL-2.0-or-later
@@ -95,6 +95,36 @@ make test
 %{_mandir}/man3/YAML::Syck.3*
 
 %changelog
+* Tue Jul 14 2026 Paul Howarth <paul@city-fan.org> - 1.47-1
+- Update to 1.47
+  Security:
+  - Fix four libsyck memory-safety CVEs reachable from the default
+    YAML::Syck::Load() path on untrusted input with no special flags (GH#213)
+    - CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder
+      caused by signed-char indexing of the decode table on !!binary input
+    - CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared
+      between the node and the anchors table
+    - CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer
+      newline scan during block-scalar parsing (incomplete-fix follow-on
+      to CVE-2025-11683)
+    - CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an
+      anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input
+  - Harden syck_base64dec() to bounds-check each read so it cannot run past a
+    non-NUL-terminated input buffer (defense-in-depth for callers passing raw
+    buffers; GH#213)
+  Bug Fixes:
+  - Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply
+    nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512,
+    matching Dump (GH#204)
+  - Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in
+    Dump so they roundtrip with ImplicitTyping instead of reloading as plain
+    strings (GH#201)
+  Maintenance:
+  - CI: add an AddressSanitizer job that builds the XS with
+    -fsanitize=address and runs the suite plus the CVE trigger inputs to catch
+    libsyck memory-safety defects; de-pin the libasan version so it tracks the
+    runner's GCC (GH#213)
+
 * Mon May 25 2026 Paul Howarth <paul@city-fan.org> - 1.46-1
 - Update to 1.46
   Bug Fixes:

diff --git a/sources b/sources
index 8d6f70b..f3dd837 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (YAML-Syck-1.46.tar.gz) = b7a0d96961ce669a78efcc14e907dea56d176cc1623cca1685d93173902996bc45678096b0d6dc09291627896919b57f19a5218891e7f530be5e82367e2b96a5
+SHA512 (YAML-Syck-1.47.tar.gz) = 7f1f37a18063716630f785599e82ebd43747f842775300f3a5f8e69d4261f3a9f69d88e232b55fb1ad61c5c29c7e6b6512cca9b2a3c4f66cf6f9e93947a2f63f