CPAN Uploads Are Up 50% Year-over-Year

With the rise of LLMs we’ve seen a couple of interesting things happen.

• The speed at which software can be created has increased greatly
• The speed at which exploits are being found (and hopefully patched) has likely increased at a similar rate

"Ieper - up arrow" by R/DV/RS is licensed under CC BY 2.0 .

I have no hard data for either of these things. Imagine me waving my hands.

As I was hand waving, I wondered what kind of impacts this is having on the CPAN ecosystem. I know that a lot of authors have been very responsive to receiving CVEs via the CPAN Security team. I also have seen that some authors are cranking out LLM-fueled libraries at a dizzying pace. I found myself longing for a report by Neil Bowers, but these are created on an annual basis and I need to know right now. Consider this an unsatisfying halfway point as we wait for Neil Bowers’ next CPAN Report.

Neil Bowers just after approving a new PAUSE account.

I will now state plainly that the prose in this article is mine, but the rest is Claude. I’m quite happy to have Claude run reports for me, even if it initially tries to write them in Python. The scripts live at oalders/cpan-activity so that you can re-run them yourself if you like. Don’t consider them good prior art. I looked briefly and then had to look away.

#What Was Measured

I decided that I cared about 2026 and that I’d like to see a month over month comparison between Jan-Aug 2026 and the same period in the previous year. I can hear you right now telling me the various beefs you have with my approach, but if I’m honest, I cannot actually hear you as I’m plugging my ears. Imagine me saying “la la la”.

#Uploads

Let’s start with uploads. That’s probably the raw number that most of us associate with CPAN activity. This one is surprising to me in how clearly that graph is trending upwards.

#Releasers

Releasers tracks the number of unique PAUSE ids to upload in a given month. This has also clearly trended up.

#First-time releasers

First-time releasers tracks how many PAUSE ids have uploaded for the first time ever. This is kind of a “new blood” metric. It doesn’t mean that the PAUSE account was created in that month. You can, for instance, get an account in 2020 and upload your first release in 2026. In that case you’d appear in 2026 rather than 2020.

Clearly first-time releasers are not making up a large percentage of active accounts either this year or last year. I’m sure these numbers are very small when compared with something like npm, but it’s clearly not getting worse. One thing to remember is that there is a higher bar for getting a PAUSE account than there is for (some) other ecosystems. New accounts are gated on a human approving them and, traditionally, you’ve needed to state why you require a PAUSE id. This has the effect of making it harder to spam CPAN with automated accounts and possibly means that the quality of uploads is higher because of the amount of effort involved. In the meantime it may actually be easier to register an fpm account for your Fortran libraries than it is to get a PAUSE id.

#New distributions

Note, this is not new modules but rather new distributions. So if you add X new modules to a library you’ve already uploaded, they won’t be measured in this chart.

#For the C-Suite

Here’s a top level summary of the various charts.

By all of these measures, CPAN looks to be a healthier and more vibrant ecosystem when compared with the previous year. I have no idea how long this trajectory continues, but many of us will be keeping an eye on it.

Related posts:

• The CPAN Bus Factor
• How to Deprecate a CPAN Module

Image credit: "Kit Harrington SDCC 2013" by Gage Skidmore is licensed under CC BY-SA 2.0 .