From patchwork Sat Oct 17 15:36:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10404 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4j6Qrr0Dbkz3xWT for ; Sat, 17 Oct 2026 15:36:28 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4j6Qrq5qw6z7BK for ; Sat, 17 Oct 2026 15:36:27 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4j6Qrq4s1bz308v for ; Sat, 17 Oct 2026 15:36:27 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4j6Qrh3N6Hz36W8 for ; Sat, 17 Oct 2026 15:36:20 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4j6Qrh0clnz7Cc; Sat, 17 Oct 2026 15:36:20 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1792251380; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HPEl9ffWiMAlGH6dVPHmDxwWOJ2uj+br3TRZ5XE8nCQ=; b=jTSQS8ae4Gs3AoW3SA8us0KBjV1y0cC+mUOpVELlvjBAePm6uC1RY9kMOeibdpFJxyTdFR S32rrp9a66RqAsAw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1792251380; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HPEl9ffWiMAlGH6dVPHmDxwWOJ2uj+br3TRZ5XE8nCQ=; b=p5W+EYI26S2NK3Ub+poT7Nt4I5dCNo3sEPtEzrg6iKwvnSfi7wHLmueenVJpObYNo+/WA+ rLUlr32ETgppMnCNlX1IKxF+p/0TO3TzseSA6i+knfzK4r8kON0bGjeCifABzsACbPOeAp EBg0ZIWhG3aC6DqYiS0+egFCPDlcMkGzf0Rd2pGRIk36iG7u26Wy/Tc5wCUv64jkFXH7uf 84URJPZAThaQQ1xSZHm9lmNIvk0DHpu+2PTalsQoMTBtTCHxbJKKHA5U7m5dmoeHUA/ysa 4cwB9Kp/V0U5NMUERMakeFuYsLDWnKPG5RLiZKtUMmUOky4oIRN4Kc9u39WQSw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] curl: Update to version 8.23.0 Date: Sat, 17 Oct 2026 17:36:14 +0200 Message-ID: <20261017153616.3333393-6-adolf.belka@ipfire.org> In-Reply-To: <20261017153616.3333393-1-adolf.belka@ipfire.org> References: <20261017153616.3333393-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 8.22.0 to 8.23.0 - No change in rootfile - Changelog 8.23.0 Changes: lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK SMB: drop support tool_cb_wrt: inject the no-clobber number before the extension tool_cb_wrt: try up to .9999 when no-clobbering Bugfixes: apple-sectrust: check ocsp copy alloc apple: shorten versions in `__builtin_available()` calls apple: sync hash init calls, add comments apple: sync up version guard macro style base64: avoid repeated input loads when encoding base64: optimize decode lookup table and quantum loop build: convert HAS_TIME_T_UNSIGNED to a compile-time check build: drop `HTTP_ONLY` option capsule: reject a capsule that can never be buffered cf-h1-proxy: reset chunk state on new request cf-h1-proxy: stricter status line parsing cf-https-connect: re-arm the timer for the hard eyeballs timeout cf-ngtcp2-cmn: fix possible `-Wdeclaration-after-statement` cf-ngtcp2-proxy: check for stream close on rx win update cf-ngtcp2-proxy: fix rx flow control cf-socket: adjust NO_SYN_RETRANSMISSIONS for older Windows cf-socket: clamp keepalive seconds-to-milliseconds conversions cfilters: fail a send that reports more written than requested clang-tidy: merge nested `if()`s cmake/Find*: drop deprecated compatibility config variables cmake: enable C++ library for GCC in AWS-LC/BoringSSL static builds cmake: link llvm stdc++ lib to AWS-LC/BoringSSL-specific feature detections only config2setopts: always set the security options for SCP/SFTP config2setopts: rename define for maximum cookie header length conncache: avoid evicting connect-only connections conncache: never discard a connection still in use conncache: remove bundle dest connect: do not busy-loop in blocking connect without a timeout connect: keep IP info and connect time when connect fails connectdata: use less curltime cookie: accept and ignore empty property names in Set-Cookie cookie: accept and ignore values for 'secure' and 'httponly' cookie: accept slightly longer lines in cookie jars cookie: cookies for a PSL domain from jar limits tailmatch cookie: ignore individual cookie errors when loading cpool: do not use admin handle for conn lookup cshutdown: make it smaller cshutdown: use ptrarray instead of llist curl-openssl.m4: sync LibreSSL detection method with rest of forks curl_addrinfo: drop redundant parentheses curl_easy_send/recv: check pointer arg curl_fopen: restore the uid and gid checks curl_formadd.md: mention the strlen() for names as well curl_multi_perform: doc update curl_setup.h: drop compatibility raw C flag `ENABLE_IPV6` CURLINFO_EFFECTIVE_URL.md: mention a short lifetime CURLOPT*ISSUERCERT*: not verified cryptographically CURLOPT_POSTFIELDSIZE.md: improve wording CURLOPT_SHARE.md: remove bad explanation for cookie sharing CURLOPT_SSL_CTX_FUNCTION.md: client cert caveats curlx_fopen: add macro to cast file mode cw-out: avoid O(n^2) work while buffering paused output cw-out: recheck callbacks for each call cw-pause: fix O(N^2) list traversal in cw_pause_flush DEPENDENCIES.md: fix release date for valgrind 3.0.0 to 2005-08-03 DEPRECATE.md: reflect SMB removal DEPRECATE: Common Name support in TLS certificates for OpenSSL digest: check peer equality for staleness digest: fix maximum length quoted value parsing digest: parse without storing 'value' in local buffer digest: quote the digest-uri param as well dnscache/conncache tweaks dnscache: check hostname on lookup dnscache: compare full hostnames when lookup keys are truncated docs: add the missing .html to the URL encode book link docs: document and align the blocking situations docs: note CAINFO/SSL_VERIFYPEER/SSL_VERIFYSTATUS effect on LDAP docs: SSL session import/file updates doh: reject undersized HTTPS RDATA dynhds: check size overflows dynhds: grow header array geometrically easy: change event pollset construction easy: duplicating a zero byte memory area needs no malloc easy: make ca_cache_timeout standalone easy: validate buffer pointer in curl_easy_recv and curl_easy_send ECH: rework config, add test cases escape: polish encoding and decoding for speed escape: use hex-pair lookup in curl_easy_escape examples: clean up crawler link parsing resources fnmatch: replace recursive matcher with iterative greedy algorithm formdata: reject a negative content length in curl_formadd ftp: require TLS on the data connection for implicit FTPS ftp: tighten use_ssl check for conn reuse ftp: URL encode filenames when wildcarding ftplistparser: no more overwriting set.write_func ftplistparser: when wildcarding, skip files with slashes ftpserver.pl: fix warnings when running test 804 getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds getparam: switch off CONNECT headers when using -J glob: reduce the number of allocations for URLs that don't need globbing. global_init: tidy up, simplify, fix issues gnutls: hardening GnuTLS: remove our own OCSP signature verification gtls: no early return on verify fail h3-proxy: teardown fix happy eyeballs: bound work from many duplicate/failing addresses hash: change key arguments to const hash: vary bucket placement across process runs headers: avoid O(n^2) rescans in curl_easy_nextheader() hsts: cap max-age to two years hsts: on load, only remove exact duplicates HTTP-CONNECT: do not react to 401 responses http2: changes in error handling http2: don't send a CURLE_SEND_ERROR after a valid http2 response http2: fix reset after 1xx response http2: init some callbacks for HTTP/2 push easy handles http2: initialize URL handle for server pushes http2: limit trailers and headers count http2: update a refused stream's error after GOAWAY http2: use stream in userdata http: abide to close-rules when transfer-encoding off http: ignore Proxy-Authenticate unless the response comes from a proxy http: only enable Negotiate/NTLM to allowed origins http: reject empty header names http: reject resumed uploads http_aws_sigv4: fix the s3express service name http_chunks: accept exactly 17 characters chunk-size http_chunks: limit trailers size httpsig-key.md: correct the generating Ed25519 keys commands httpsrr+ech: check target and port if2ip: check interface name case sensitive imap: close the connection on premature done instead of finalizing imap: compare selected mailbox names case-sensitively imap: do size checks using 64-bit math inet_pton: reject a colon that ends an IPv6 address IPFS.md: replace sunset link, allowlist another one to avoid `mdlinkcheck` hang KNOWN_BUGS: drop the curl-config private details entry KNOWN_BUGS: drop the empty error buffer entry, it no longer happens ldap: base64-encode a non-SAFE DN and reject a control-byte type name ldap: tidy up variable scope, merge nested `#if`s lib557: exclude three floating point test cases for VS2013 and earlier lib: connection shutdown, cleanup code lib: make private functions static and remove unused code lib: reject internal handles in the multi/easy public API lib: replace `CURLX_FILE_MODE()` with `mode_t` cast libssh2: match hashed known_hosts entries by host libssh2: skip repeat checkp() for already-absent hashed key types libssh: work with empty priv_key mbedtls: fix ticket handling mbedtls: pass correct length for PEM/DER key blobs mbedtls: resend length check mdlinkcheck: pass `--retry-max-time` to avoid server-controlled long retry times mime: bound Curl_mime_duppart() recursion depth mime: bound Curl_mime_prepare_headers() recursion depth mime: do curl_mime_free() non-recursively mprintf: acknowledge %F mprintf: avoid scanning strings twice for unbounded %s mprintf: make mprintf() and mfprintf() return -1 on error mprintf: stage output and emit it in runs mprintf: use size_t width for the bare Windows %I modifier mqtt: drain queued output before advancing the state machine mqtt: remaininglength check for 32-bit systems mqttd: work around bogus VS2019 32-bit compiler warning mulit_ev: remove socket references on forget multi-event: fix timeout of pending transfers multi: adjust the cleanup order in multi_done multi: is_finished() fix multi: reduce struct size with small cleanups multi: remove redundant completion message list multi: store timeout epoch as whole seconds multi_ntfy: fix handling of more than 128 notifications in a batch multi_ntfy: recheck callback on dispatch multi_ntfy: replace enabled bitset with inline flags multihandle: some easy shrinks netrc: empty quoted values now produce a valid empty string netrc: survive comment-only .netrc file ngtcp2: shrink max sendbuf ngtcp2: use stream in userdata openldap: hand it a dup'd socket, not curl's own openssl/gtls: reject CRLfile with native CA store, matching rustls openssl: fix OpenSSL v4.1 no-deprecated build openssl: hardening openssl: support X509 store caching when CApath is configured openssl: use non-deprecated API for MD5/MD4 os400: document curl_formadd_CCSID multi-chunk peculiarity os400: restore HAVE_FCHMOD os400: use correct free function ossl_verifyhost: remove assumption of null-termination of ASN1_STRING. output-dir.md: expand on its behavior parsedate: find day names, months and time zones faster parsedate: remove the unused leading three letters parsedate: validate NULL date pointer in curl_getdate peer: compare zoneid case sensitive peer: parsing a zoneid as number fix peer: preserve ipv6 props from "connect-to" perf-tests: output two-digital decimals always pingpong: add a max loop counter for Curl_pp_readresp pingpong: guard sendleft against a send reporting more than requested pingpong: schedule server response timeouts for the socket API pytest: adjust threshold in test_20_11_crazy_pings for arm64 pytest: check server status without ssl verify pytest: fixture fixes pytest: set `PerSourcePenalties no` when sshd supports it pytest: silence pytest warnings pytest: start all servers early retry.md: clarify that the server can override retry delay time Revert "setopt: clear the 'custom' CA booleans when set to NULL" rtsp: accept a Content-Length body on methods that expected none rtsp: do not send a learned session id to another origin runtests: add extra room for minimum number of tests in sliced jobs runtests: Added runnernums in order to have O(1) lookup runtests: unset `CURL_MEMDEBUG` for curl requests made to the CI API rustls: break recv loop on empty plain text rustls: consume CURLOPT_SSLCERT_BLOB / CURLOPT_SSLKEY_BLOB schannel: auto_client_cert conn matching schannel: clear borrowed sslContext on close schannel: fix `-Wextra-semi-stmt` with clang and extra debug enabled schannel: fix compiler warning `-Wstrict-aliasing` in ALPN code schannel: fix guard for old MSVC workaround schannel: handle empty tokens during renegotiation schannel: retain close_notify records across send retries sectrust: add guards for rest of Apple OS flavors share link: forget connection socketpair: fix accept loop socketpair: use `pipe2()` on Apple OSes (requires SDK 27) socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH socks: track SOCKS5 authentication per socket, not per connection socksd: count connections per test, widen the method2 sentinel ssl: dedup ssl_fsslctx ssls: validate input arguments in import, export, and unpack strparse: speed up number parsing sws: fix connection-monitor for connections closed before a request telnet: make it work through proxy tunnels test 1605: move from unit to libtest test/servers.pm: restrict h2/3 port reuse test1119, 1167: disable MSYS2 argument conversion test1399: improve reliability test1679: unset `SSL_CERT_FILE`, use `TESTNUMBER` test2007: bump to use SHA256 public key hash (was: MD5) test2007: set `MSYS2_ARG_CONV_EXCL` to avoid flaky failures test2072: enable on Cygwin/MSYS2 test428: skip when running on older MSYS2 versions test: restore the old test 1609 as 3271 testcurl.pl: drop support for building c-ares from embedded source tree tests/http: use @classmethod when appropriate tests: add SFTP connection reuse tests tests: clean up Python test code tests: fix typos in a comment tests: require valgrind 3+ (2007-08-03) tftp: verify direction in a few places tool: (re)set SSL verification in --libcurl output tool: add Unicode and long-filename support to `--create-dir` (Windows) tool: buffer headers before remote filename selection tool: handling of "synthetic" errors tool_doswin: recognize superscript numbers as reserved tool_easysrc: reset the handle between --next operations tool_getparam: do not print the value of a redacted argument tool_getparam: restore --socks5-gssapi-service tool_help: guard category[2] access when category is bare "-" tool_ipfs: keep the path percent-encoded when rewriting to the gateway tool_operate: clear the retry flag when the output file fails tool_util: add Unicode support to `tool_execpath()` u8_strset, u32_ptrset: fix boundaries handling uint-bset: skip unused slots when counting uint-table: add remove-max precaution unit1399: check microsecond precision across redirects unit1664: add workaround for VS2019 16.3 - VS2022 17.4 x64 miscompile url: check syntax before applying default-protocol url: CURLOPT_INTERFACE fix connection reuse match url: match connections without force reuse and candidates url: ntlm/negotiate, prohibit connection reuse on follows urlapi: make curl_url_dup() copy the guessed_scheme flag urlapi: normalize legacy numeric IPv4 hosts set via CURLUPART_HOST urlapi: return NULL from curl_url_dup() when given a NULL handle urlapi: run the urlparser perf test faster urldata: remove conn->given urldata: remove ssl_primary_config from easy handle urldata: shrink connectdata negotiate states vdns: announce resolver start before the HTTPS RR query is sent vquic: fix preprocessor check for old Darwin versions vquic: use `CURLX_FILE_MODE()` in `Curl_qlogdir()` vssh: do not busy-loop in blocking state machine without a timeout vtls: fix Curl_cert_hostcheck when the pattern is not a C string vtls_scache: remember lock state locally warnless: dedupe Intel compiler warning suppression pragmas wcurl: import v2026.10.12 websocket: auto PONG with client reader fix websocket: error on EOS with incomplete frame wolfssl: remove BIO destroy callback ws: check pointer args in curl_ws_recv ws: do not auto-pong in raw mode x509: stricter parsing Signed-off-by: Adolf Belka --- lfs/curl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/curl b/lfs/curl index 2dd3e804d..54317c2f0 100644 --- a/lfs/curl +++ b/lfs/curl @@ -24,7 +24,7 @@ include Config -VER = 8.22.0 +VER = 8.23.0 THISAPP = curl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 1efe036ae4ba6bc1e2bcf7bae2229e2c3be8e9d72a0f32f6c1f192d277f625f77786cf538593ad59a7873b477ff3566412d3404d6ccd202c0f7055b6d3a45d25 +$(DL_FILE)_BLAKE2 = ecfabdf0327114aff21430e2f4de788fd8fdc36db606ac70b45241225babac374c2f0334430f31dbc366f2d3a0c7e405b30d973da9b11ae84e6a0da396a4cf87 install : $(TARGET)