How to Deprecate a CPAN Module · Olaf Aldersskip to content<br>#Perl#CPAN#security<br>How to Deprecate a CPAN Module<br>by Olaf Alders<br>July 21, 2026<br>·4 min read<br>·835 words
Table of Contents
"This old house once filled with joy" by Don O'Brien is licensed under CC BY 2.0.<br>You may have noticed that the CPAN Security group recently got funded by<br>Alpha-Omega<br>to work on further securing the Perl and CPAN ecosystems. This means that A<br>LOT OF CVEs are currently being issued. Since the group is not the arbiter of<br>which modules are still in use (and this is largely an unknowable problem),<br>there will be CVEs published for modules which probably can simply be deprecated.<br>Deprecating a module on CPAN is not as simple as pushing a button, so let’s run<br>through what’s actually involved. The key thing to know here is that to<br>deprecate a module you have to upload a deprecated version. This may seem<br>counter-intuitive because uploading a new archive makes it look like the module<br>is still under development, but none of this is going to change anytime soon.<br>File it under “historical reasons” and get on with your day.<br>#First Consider Adoption<br>If you have decided that you no longer wish to maintain a module, you can mark<br>it as available for adoption. This<br>does not require a new upload and can be done directly from<br>PAUSE. If you’re going this route, you can still<br>upload a fixed version or you can wait for someone else to adopt and fix the<br>code. If a module is still useful or has dependencies you may want to consider<br>this option as more beneficial to the community. You are not required to hand<br>off your module and, likewise, you are not required to deprecate it. It’s<br>always your call to make. You can also choose to fix it or to do nothing at<br>all.<br>#Choosing to Deprecate<br>#Flag the Module as Deprecated<br>Step one is flagging the module as deprecated. When I searched for resources<br>on how to do this I, of course, found that Neil<br>Bowers had helpfully already mapped it out,<br>way back in 2015 in his Marking a distribution as<br>deprecated blog post.<br>That will walk you through the steps required to do the flagging. If you prefer<br>to invoke an LLM, you can use<br>TOKUHIROM’s handy<br>deprecate-cpan-module<br>skill.<br>It also covers slightly more cases than Neil’s version (see<br>Minilla).<br>A helpful practice when deprecating is to include a note about why the deprecation has taken<br>place. See<br>Crypt::SaltedHash<br>for an example.<br>At this point I should note that the word is deprecated and not<br>depreciated. The words are<br>close and both are real<br>words, so your spell check will not help you here.<br>#Upload Your New Version<br>At this point you may choose to ship a fix for the vulnerability along with the<br>deprecation. You do not need to do this. Just keep in mind that the CVE will be<br>displayed prominently on the module page if it remains unresolved so that other<br>users are aware of the issue. Now it’s time to build your release and upload<br>that to PAUSE either with your tooling or by using the PAUSE<br>website directly.<br>#Maybe Delete All the Versions<br>At this point you may or may not be finished. After uploading your archive you<br>can either delete the library from CPAN entirely or make yourself a sandwich<br>and call it a day. You may be asking, why wouldn’t I just skip the deprecation<br>and delete the module to begin with? The reason is that deleting a module from<br>CPAN is more like archiving it. It continues to live on in<br>BackPAN. This means that if you<br>skip the deprecation and jump immediately to deleting your module, it will be<br>hanging around in an undeprecated state in various places. Now,<br>bizarrely, to quote myself:<br>BackPAN is an aggregation of what currently is and what at one point was<br>on CPAN . For various reasons, modules can be deleted from CPAN before<br>they have outlived their usefulness to the general public. […] There are<br>various BackPAN s and, unlike CPAN itself, there is no one canonical<br>BackPAN . This leads to a confusing situation where not every BackPAN<br>may have exactly the same files, so this bears keeping in mind.<br>If you use cpan.metacpan.org as the mirror which your<br>CPAN client installs from, you are actually using a BackPAN , so in<br>general you should be able to find what you need there.
You certainly do not need to delete your library from CPAN, but it’s a<br>valid choice.<br>#Or Not<br>Maybe you’ve gotten a CVE and it doesn’t need deprecation at all – just a fix<br>and a new lease on life. If that’s the case, kudos to you. Just remember that<br>getting a CVE for your code is in no way a reflection on you as a person. If it<br>were, I would feel terrible about myself. With the speed of security research<br>increasing steadily we can expect many more CVEs to be published in the months<br>to come. The increased volume, in the short term at least, will be part of the<br>new normal.
$ share
esc
↑↓ navigate<br>↵ open<br>pagefind