Default @INC current-directory limit in Perl 5.26+
0 reputation · 30 Jul 2021, 13:56 UTC
Goal
Assess whether a legacy Perl application can be deployed on Perl 5.26 or later without changing code that implicitly loads modules from the current working directory.
Constraints
Perl 5.26 removed the current directory from the default @INC module search path, while earlier releases included it by default. Setting PERL_USE_UNSAFE_INC=1 restores the older behavior but re-enables accidental loading from writable directories. Explicit path declarations such as use lib are the documented alternative, but the extent of implicit dependencies in existing code is unknown.
Questions
- Does the application contain relative require or do calls that depend on @INC containing the current directory?
- Is enabling PERL_USE_UNSAFE_INC=1 acceptable for the deployment environment, or should all implicit current-directory references be replaced with explicit paths?
- What documentation approach covers version-specific behavior for deployments spanning Perl releases older and newer than 5.26?