Instead of printing out VERSION, I specified in Makefile.PL that File::Temp and File::Spec are required dependencies. That causes them to be listed with their version numbers in the PREREQUISITES section of the report. They are both the latest released version, which is what I used to get the source code for the monkey patches in the test files. If you look at the carp output produced by t/a4.t you can see that File::Spec::Unix->canonpath is called with untainted data and it returns tainted data. The source code for File::Spec::Unix->canonpath is very simple and has no variables that are not declared in my. It doesn't even have any use of $1 that could have that scope problem.