From patchwork Sun Sep 13 17:12:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10204 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hjZbk0zBGz3xTV for ; Sun, 13 Sep 2026 17:12:50 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hjZbg0qysz8RT for ; Sun, 13 Sep 2026 17:12:47 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hjZbc0J5pz37C2 for ; Sun, 13 Sep 2026 17:12:44 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hjZbW4nTTz32ds for ; Sun, 13 Sep 2026 17:12:39 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hjZbT1MZJz7FV; Sun, 13 Sep 2026 17:12:37 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789319557; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=M2mejAVwnxo6sqbvYDcQOMQTMszvSw7QxY3Ot+m7HfU=; b=LK8d7C/RtPUr3sGEjOyAu25dXy5piCf3TCXjmDFF3J0LLTupIgx5G6UBEWGjPexa15VxZI n9dRbG1iZQANQDBw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789319557; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=M2mejAVwnxo6sqbvYDcQOMQTMszvSw7QxY3Ot+m7HfU=; b=neMI++vwHDRTwiJ6Xr0kPQs+Jcc4LwiRLFD/8L67sNlKf5q5UPnbBgBgz0rV9Nmlu4cEuM WNshjrA1ciUqVbO0cbmhkFve/uiaVkVA420sRo8WU1m6Nxcv46OBq5T/IEb61sQ16PLFWs FrMFXWXOJDYn02kpf6IZ6zi+HmWrqcVjwPGRlI4t1pLkjVX48e65Ug3bZCKIyI8k4Huqgb vYK23VL/fYz4e5rZKdLp0aGt9O2lqFATzOW8HJ2r7DfEJmM7OXXz1eftXoWasnpt0XxmWW D7AyTgNi0jnjNFUow4VinNoYj6hfa0WVSL+1SHNCZD4howbovwZj8vCoz0w25A== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] curl: Update to version 8.22.0 Date: Sun, 13 Sep 2026 19:12:12 +0200 Message-ID: <20260913171230.3920551-13-adolf.belka@ipfire.org> In-Reply-To: <20260913171230.3920551-1-adolf.belka@ipfire.org> References: <20260913171230.3920551-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 8.21.0 to 8.22.0 - Update of rootfile - Changelog 8.22.0 Changes: gssapi: add support for Apple GSS Framework hardening: add API guards RFC 9421 HTTP Message Signatures support spnego: block NTLM fallback in SPNEGO negotiation TLS: drop support for TLS-SRP vquic: add option to use Apple fast UDP Bugfixes: altsvc: continue after unknown parameters asyn-thrdd: retry link-local ipv6 if missing scope id autotools: minor fixes and improvements build: always use local `inet_pton()`/`inet_ntop()` implementations build: assume POSIX `select()` is available build: clear `Require.private` for static-only builds in `libcurl.pc` build: drop `dirent.h` and `opendir()` detections on Windows build: drop detecting `gettimeofday()` on Windows build: drop superfluous `STDC_HEADERS` macro build: enable thread-safe `getaddrinfo()` for OpenBSD build: minor debug option message fixes/improvements build: require `!NDEBUG` for debug-enabled (aka development) builds build: strip duplicate spaces after `Libs.private:` in `libcurl.pc` build: strip trailing spaces from `libcurl.pc` cd2nroff: fix backslashes for 4-space indent lines cd2nroff: stricter checks for asterisks for italics cf-ngtcp2-cmn: de-duplicate `ngtcp2_conn_client_new()` call code cf-ngtcp2-cmn: initialize new callback ptr for ngtcp2 1.24.0+ cf-socket: avoid broken NetBSD SOCK_NONBLOCK cf-socket: disable TCP SYN retransmissions for localhost on Windows cfilters: fix event-based connection shutdown clock: save one call cmake/FindLibgsasl: fix to set `LIBGSASL_VERSION` with pkg-config detection cmake: check libgsasl version at configure time cmake: dedupe expressions into local vars in `cmake_uninstall.in.cmake` cmake: fix not to build `tunits` when `BUILD_CURL_EXE=OFF` cmake: flatten build tree, tidy up base dir variables cmake: minor improvements to `cmake_uninstall.in.cmake` cmake: optimize OpenSSL fork detection cmake: replace `remove` command with `rm` and pass arg safely cmake: robustify base path in local file reference cmake: stop probing unused `float.h` for `STDC_HEADERS` cmake: use built-in variable and target property dump functions with CMake 4.5+ config-riscos.h: delete handcrafted RISC OS config header, in favor of autotools config-win32.h: drop UWP, c-ares, simplify more config-win32.h: limit use to MSVC IDE Project builds configure: clarify --enable-debug option configure: fix misleading error messages configure: link `-lcrypt32` instead of `-lm` for wolfSSL on Windows configure: only check in the watt library if WATT_ROOT is set configure: remove double check for GnuTLS configure: set ldap lib to no by default for non-finds conncache: apply multi limits to transfers using a shared pool conncache: conn upkeep/alive: move and enhance conncache: connection alive checks intervals conncache: don't assume curl_off_t increment wrap-around conncache: guess maxconnects different connect: connection close tweaks connect: only set connect timer on first socket connection reuse: age check connection reuse: check SSL configs when doing a scheme upgrade connections: use admin handles only for maintenance content_encoding: exact-match the identity transfer-coding token content_encoding: give a clear error on multi-member gzip cookie: cookies set for an exact PSL domain is host-only cookie: improve TAB handling cookie: refuse to load cookies set against a PSL domain CREDENTIALS.md: remove comment about empty user/pass ctype: exclude control bytes from ISPRINT and ISGRAPH curl: help category cleanups curl_gssapi: document/update feature availability curl_threads: always use native threads/mutex on Windows curl_trc: remove unused expire timers curl_url_set.md: expand the CURLU_NO_AUTHORITY description curl_ws_meta.md: polish and better vocabulary CURLOPT_HEADERFUNCTION.md: document folded header unfolding CURLOPT_SOCKOPTFUNCTION.md: ALREADY_CONNECTED does not work for HTTP/3 CURLOPT_SSH_*_KEYFILE: used for setting up, then no more CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization', not 'Authentication' CURLOPT_USERNAME.md: ambient username caveats CURLSHOPT_(UN)SHARE.md: do not modify shares while in use curlx_inet_ntop: return `CURLcode`, drop setting `errno` curlx_inet_pton: drop setting `errno` on error DEPRECATE.md: HTTP/2 Server Push gets removed in March 2027 dict: avoid busy-loop in sendf() when the socket is not writable dist: fix to drop test bundle .c files from the source tarball dnsd: fix bounds check in `read_https_alpn_part()` docs/INTERNALS.md -> docs/DEPENDENCIES.md docs: clarify that cookies need domain set to match docs: connection reuse behavior for socket callbacks docs: make 5 example snippets compile cleanly with clang docs: mention possible auth option conflicts docs: remove doubled word in SECURITY-ADVISORY.md DoH: improvements easy: fix unused global on non-Windows easy_lock: silence `portability-no-assembler` with clang-tidy 23.1.0+ FAQ: correct an option typo file: support directory listing on Windows filter: change time reporting FTP: fix TLS session reuse on the data connection ftp: reject control bytes in ACCT and alternative-to-user gitignore: maintenance updates gopher: fix partial sends of CRLF gopher: reject CR and LF in the selector h2 push: use squeaky clean easy handle h2: bootstrap max streams from multi handle if in use h3-proxy: fix NULL deref when non-:status header arrives before :status Happy Eyeballing v3: resolution delay of 25ms header api: add guards headers: name the arguments the way the definitions name them HISTORY.md: PSL support in 2015 HISTORY: add when c-ares support was introduced (2004) HISTORY: September 1999: started using CVS hostip: only cache negative resolves for authoritative answers hsts: only match the exact strings http digest: tie peer/credentials on input http2: make server push transfers inherit share from parent http2: remove assert in ingress processing http: avoid length underflow in Curl_compareheader http: custom Authorization: header overrides Negotiate http: fix non-tunneling proxy hostname use http: stop dropping large custom headers http: trim custom header name before the Authorization drop httpsrr: DoH with HTTPS, fix response handling idn: restore `MultiByteToWideChar()` `MB_ERR_INVALID_CHARS` flag imap: APPEND CRLF fix include: include when building for modern Linux. INSTALL.md: add building-from-source overview section INTERNALS.md: require quiche 0.20.0+ ipv6 scope_id: set from first peer keylog: add a random size argument to Curl_tls_keylog_write() ldap: base64-encode LDIF values beginning with colon or less-than ldap: reject control characters in URL-decoded filter values ldap: support empty username and password ldap: support insecure mode for Windows native LDAP lib1587: fix gcc `-Wconversion` with LibreSSL on Windows, test in CI lib2405: adjust for non-threaded builds lib: add "Curl_" prefix to two global functions lib: add multi_wakeup_internal lib: drop unused `system_win32.h` includes lib: fix 'ns' -> 'us' in trace messages lib: new easy option string storage lib: optimize struct layouts for reduced memory usage lib: ratelimit timestamps lib: silence gcc-16 compiler warnings `-Wmaybe-uninitialized` lib: update mentions of the legacy "sessionhandle" libcurl.md: emphasize that the output needs checking libcurl.pc: add `License` tag libcurl.pc: add Copyright tag to the pkgconf file libcurl.pc: add the Link.ABI and Source tags macos sectrust: fail ocsp verify when not builtin Makefile.am: improve etags mbedtls: enforce verifyhost when verifypeer is disabled mbedtls: replace `memset()` with `psa_hash_operation_init()` md5: replace magic numbers with `MD5_DIGEST_LEN` mime.c: avoid integer overflow in base64 size calculation mime: reject CR and LF in mail part name and filename mod_curltest: fix compiler warnings mprintf: acknowledge %F mprintf: avoid never-ending loop for positive-infinite mprintf: fix long double output mqtt: reject control bytes in the topic multi: cap expire times to INT_MAX internally multi: forbid curl_easy_pause from within multi socket callback multi: hold timeout values in 'int' instead of 'long' multi: remove #if 0'ed code that uses old struct multi: shrink expire timer indices multi: timeout improvements multi: use index list for expire timeouts multi: xfer table initial size and growth multihandle: move two struct fields ngtcp2+openssL: fix early data ngtcp2: avoid NULL deref in cf_ngtcp2_send ngtcp2: clean up after ngtcp2 in `curl_global_cleanup` ngtcp2: let verify failures win over expiry processing errors openldap: handle Curl_sasl_continue() returns better openssl+sectrust: fix session reuse openssl+sectrust: move session verified set into result check openssl: avoid conn reuse if provider is used openssl: avoid strlen() on the data from OpenSSL openssl: aws-lc ocsp workaround openssl: drop unused pre-OpenSSL3 `ctx_option_t` typedef openssl: fix DER buffer leak in Apple SecTrust verification openssl: no server cert is only okay if also not pinned openssl: prefer modern API flavors for `EVP_MD_CTX` new/free openssl: replace stray legacy API variant with `EVP_DigestInit_ex()` os400: port latest header files changes to ILE/RPG interface os400: rewrite upper ebcdic wrappers using dynbuf progress: cleanup, less memory protocol: simpler Curl_getn_scheme runs faster proxy: CONNECT trailers handling psl: update a comment to understandable English pytest: update two H3 tests for nghttp3 1.18.0+ quic: upload improvements quiche: set the max field section size rtsp: refactor method handling and improve error checks runtests: allow comments in `setenv` section, merge sections in test433 runtests: fix `mode="warn"` tests passing unconditionally, fix test 1752 runtests: flush cached test parts when (re)loading a file runtests: restore `-k` option and actively process as no-op sasl: fix zero-length response encoding schannel: add ALPN support for mingw-w64 <9 and =128-bit pointers url: fix handling of empty user in NTLM matching url: fix negotiate/ntlm connection reuse url: reject control codes in credentials set via CURLOPT urlapi: allow URLs to not have userauth (hostname) urlapi: avoid dedotdotify() if possible urlapi: clear password buffer on error path urlapi: do not keep an internal port string urlapi: improved return codes urlapi: preserve empty markers in relative URLs urldata: cleanups urldata: drop four strings from the aptr struct urldata: sort the connectdata struct fields by size VERSIONS.md: document Rock-solid curl releases vms: fix symbol typo and missing closing quotes in `config_h.com` vquic: add Curl_ prefix to some global functions vquic: initialize new callback slot for nghttp3 v1.18.0+ vquic: silence `-Wmissing-field-initializers` for nghttp3/ngtcp2 callback tables vquic: use ngtcp2 v1.25.0 new close2 callback vssh: keyfile use cleanups vssh: silence gcc-11 `-Wnull-dereference`, dedupe `CURL_EASY_STR()` calls vtls: move 'native_ca_store' ssl_config_data => ssl_primary_config vtls_scache: use case sensitive path match VULN-DISCLOSURE-POLICY.md: issues that should be found by tests are LOW wcurl: import v2026.08.30 websocket: pause writing and meta data fix winsock: drop redundant version checks at initialization wolfssl: do not run Curl_wssl_setup_x509_store() twice wolfssl: fix build for wolfssl without bio chain support ws: fix write callback error handling ws: pause/unpause write handling Signed-off-by: Adolf Belka --- config/rootfiles/common/curl | 4 ++++ lfs/curl | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/curl b/config/rootfiles/common/curl index 96daee9e6..27b79e8c5 100644 --- a/config/rootfiles/common/curl +++ b/config/rootfiles/common/curl @@ -223,6 +223,10 @@ usr/lib/libcurl.so.4.8.0 #usr/share/man/man3/CURLOPT_HTTPHEADER.3 #usr/share/man/man3/CURLOPT_HTTPPOST.3 #usr/share/man/man3/CURLOPT_HTTPPROXYTUNNEL.3 +#usr/share/man/man3/CURLOPT_HTTPSIG_ALGORITHM.3 +#usr/share/man/man3/CURLOPT_HTTPSIG_HEADERS.3 +#usr/share/man/man3/CURLOPT_HTTPSIG_KEY.3 +#usr/share/man/man3/CURLOPT_HTTPSIG_KEYID.3 #usr/share/man/man3/CURLOPT_HTTP_CONTENT_DECODING.3 #usr/share/man/man3/CURLOPT_HTTP_TRANSFER_DECODING.3 #usr/share/man/man3/CURLOPT_HTTP_VERSION.3 diff --git a/lfs/curl b/lfs/curl index b41766a07..2dd3e804d 100644 --- a/lfs/curl +++ b/lfs/curl @@ -24,7 +24,7 @@ include Config -VER = 8.21.0 +VER = 8.22.0 THISAPP = curl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 230989e586a592b2aee768a1a6d48f1c8247e4d26afd0787a94f45faa9fbebcda5c9a8e2b739fb5a2ada151c13b09a8e2319825e9314fcc894377f24e92d338f +$(DL_FILE)_BLAKE2 = 1efe036ae4ba6bc1e2bcf7bae2229e2c3be8e9d72a0f32f6c1f192d277f625f77786cf538593ad59a7873b477ff3566412d3404d6ccd202c0f7055b6d3a45d25 install : $(TARGET)