pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [pkgsrc-2026Q3] pkgsrc/www/curl
Module Name: pkgsrc
Committed By: maya
Date: Wed Oct 21 00:39:16 UTC 2026
Modified Files:
pkgsrc/www/curl [pkgsrc-2026Q3]: Makefile Makefile.common distinfo
Log Message:
Pullup ticket #7292 - requested by taca
www/curl: Security fix
Revisions pulled up:
- www/curl/Makefile 1.310
- www/curl/Makefile.common 1.39
- www/curl/distinfo 1.229
---
Module Name: pkgsrc
Committed By: wiz
Date: Wed Oct 14 16:21:02 UTC 2026
Modified Files:
pkgsrc/www/curl: Makefile Makefile.common distinfo
Log Message:
curl: update to 8.23.0.
curl and libcurl 8.23.0
This release includes the following changes:
o lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK [64]
o SMB: drop support [63]
o tool_cb_wrt: inject the no-clobber number before the extension [21]
o tool_cb_wrt: try up to .9999 when no-clobbering [46]
This release includes the following bugfixes:
o apple-sectrust: check ocsp copy alloc [292]
o apple: shorten versions in `__builtin_available()` calls [251]
o apple: sync hash init calls, add comments [217]
o apple: sync up version guard macro style [263]
o base64: avoid repeated input loads when encoding [114]
o base64: optimize decode lookup table and quantum loop [88]
o build: convert HAS_TIME_T_UNSIGNED to a compile-time check [65]
o build: drop `HTTP_ONLY` option [23]
o capsule: reject a capsule that can never be buffered [84]
o cf-h1-proxy: reset chunk state on new request [146]
o cf-h1-proxy: stricter status line parsing [145]
o cf-https-connect: re-arm the timer for the hard eyeballs timeout [222]
o cf-ngtcp2-cmn: fix possible `-Wdeclaration-after-statement` [296]
o cf-ngtcp2-proxy: check for stream close on rx win update [159]
o cf-ngtcp2-proxy: fix rx flow control [174]
o cf-socket: adjust NO_SYN_RETRANSMISSIONS for older Windows [275]
o cf-socket: clamp keepalive seconds-to-milliseconds conversions [167]
o cfilters: fail a send that reports more written than requested [194]
o clang-tidy: merge nested `if()`s [39]
o cmake/Find*: drop deprecated compatibility config variables [259]
o cmake: enable C++ library for GCC in AWS-LC/BoringSSL static builds [232]
o cmake: link llvm stdc++ lib to AWS-LC/BoringSSL-specific feature detections only [271]
o config2setopts: always set the security options for SCP/SFTP [67]
o config2setopts: rename define for maximum cookie header length [248]
o conncache: avoid evicting connect-only connections [79]
o conncache: never discard a connection still in use [208]
o conncache: remove bundle dest [50]
o connect: do not busy-loop in blocking connect without a timeout [240]
o connect: keep IP info and connect time when connect fails [195]
o connectdata: use less curltime [34]
o cookie: accept and ignore empty property names in Set-Cookie [234]
o cookie: accept and ignore values for 'secure' and 'httponly' [187]
o cookie: accept slightly longer lines in cookie jars [105]
o cookie: cookies for a PSL domain from jar just limits tailmatch [176]
o cookie: ignore individual cookie errors when loading [6]
o cpool: do not use admin handle for conn lookup [299]
o cshutdown: make it smaller [60]
o cshutdown: use ptrarray instead of llist [156]
o curl-openssl.m4: sync LibreSSL detection method with rest of forks [218]
o curl_addrinfo: drop redundant parentheses [41]
o curl_easy_send/recv: check pointer arg [175]
o curl_fopen: restore the uid and gid checks [70]
o curl_formadd.md: mention the strlen() for names as well [29]
o curl_multi_perform: doc update [148]
o curl_setup.h: drop compatibility raw C flag `ENABLE_IPV6` [260]
o CURLINFO_EFFECTIVE_URL.md: mention a short lifetime [116]
o CURLOPT*ISSUERCERT*: not verified cryptographically [28]
o CURLOPT_POSTFIELDSIZE.md: improve wording [144]
o CURLOPT_SHARE.md: remove bad explanation for cookie sharing [7]
o CURLOPT_SSL_CTX_FUNCTION.md: client cert caveats [87]
o curlx_fopen: add macro to cast file mode [245]
o cw-out: avoid O(n^2) work while buffering paused output [74]
o cw-out: recheck callbacks for each call [134]
o cw-pause: fix O(N^2) list traversal in cw_pause_flush [137]
o DEPENDENCIES.md: fix release date for valgrind 3.0.0 to 2005-08-03
o DEPRECATE.md: reflect SMB removal [252]
o DEPRECATE: Common Name support in TLS certificates for OpenSSL [172]
o digest: check peer equality for staleness [24]
o digest: fix maximum length quoted value parsing [22]
o digest: parse without storing 'value' in local buffer [20]
o digest: quote the digest-uri param as well [85]
o dnscache/conncache tweaks [75]
o dnscache: check hostname on lookup [209]
o dnscache: compare full hostnames when lookup keys are truncated [301]
o docs: add the missing .html to the url-encode book link [3]
o docs: document and align the blocking situations [163]
o docs: note CAINFO/SSL_VERIFYPEER/SSL_VERIFYSTATUS effect on LDAP [188]
o docs: SSL session import/file updates [199]
o doh: reject undersized HTTPS RDATA [11]
o dynhds: check size overflows [198]
o dynhds: grow header array geometrically [73]
o easy: change event pollset construction [242]
o easy: duplicating a zero byte memory area needs no malloc [91]
o easy: make ca_cache_timeout standalone [51]
o easy: validate buffer pointer in curl_easy_recv and curl_easy_send [152]
o ECH: rework config, add test cases [220]
o escape: polish encoding and decoding for speed [37]
o escape: use hex-pair lookup in curl_easy_escape [77]
o examples: clean up crawler link parsing resources [119]
o fnmatch: replace recursive matcher with iterative greedy algorithm [72]
o formdata: reject a negative content length in curl_formadd [128]
o ftp: require TLS on the data connection for implicit FTPS [126]
o ftp: tighten use_ssl check for conn reuse [19]
o ftp: URL encode file names when wildcarding [61]
o ftplistparser: no more overwriting set.write_func [100]
o ftplistparser: when wildcarding, skip files with slashes [125]
o ftpserver.pl: fix warnings when running test 804 [257]
o getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds [107]
o getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds [94]
o getparam: switch off CONNECT headers when using -J [4]
o glob: reduce the number of allocations for URLs that don't need globbing. [109]
o global_init: tidy up, simplify, fix issues [43]
o gnutls: hardening [230]
o GnuTLS: remove our own OCSP signature verification [266]
o gtls: no early return on verify fail [149]
o h3-proxy: teardown fix [182]
o happy eyeballs: bound work from many duplicate/failing addresses [80]
o hash: change key arguments to const [14]
o hash: vary bucket placement across process runs [108]
o headers: avoid O(n^2) rescans in curl_easy_nextheader() [81]
o hsts: cap max-age to two years [47]
o hsts: on load, only remove exact duplicates [56]
o HTTP-CONNECT: do not react to 401 responses [31]
o http2: changes in error handling [53]
o http2: don't send a CURLE_SEND_ERROR after a valid http2 response [71]
o http2: fix reset after 1xx response [289]
o http2: init some callbacks for HTTP/2 push easy handles [191]
o http2: initialize URL handle for server pushes [104]
o http2: limit trailers and headers count [211]
o http2: update a refused stream's error after GOAWAY [102]
o http2: use stream in userdata [246]
o http: abide to close-rules when transfer-encoding off [132]
o http: ignore Proxy-Authenticate unless the response comes from a proxy [120]
o http: only enable Negotiate/NTLM to allowed origins [99]
o http: reject empty header names [241]
o http: reject resumed uploads [16]
o http_aws_sigv4: fix the s3express service name [273]
o http_chunks: accept exactly 17 characters chunk-size [170]
o http_chunks: limit trailers size [212]
o httpsig-key.md: correct the generating Ed25519 keys commands [97]
o httpsrr+ech: check target and port [133]
o if2ip: check interface name case sensitive [158]
o imap: close the connection on premature done instead of finalizing [197]
o imap: compare selected mailbox names case-sensitively [57]
o imap: do size checks using 64-bit math [291]
o inet_pton: reject a colon that ends an IPv6 address [179]
o IPFS.md: replace sunset link, allowlist another one to avoid `mdlinkcheck` hang [168]
o KNOWN_BUGS: drop the curl-config private details entry [290]
o KNOWN_BUGS: drop the empty error buffer entry, it no longer happens [66]
o ldap: base64-encode a non-SAFE DN and reject a control-byte type name [55]
o ldap: tidy up variable scope, merge nested `#if`s [206]
o lib557: exclude three floating point test cases for VS2013 and earlier [249]
o lib: connection shutdown, cleanup code [92]
o lib: make private functions static and remove unused code [83]
o lib: reject internal handles in the multi/easy public API [103]
o lib: replace `CURLX_FILE_MODE()` with `mode_t` cast [205]
o libssh2: match hashed known_hosts entries by host [30]
o libssh2: skip repeat checkp() for already-absent hashed key types [82]
o libssh: work with empty priv_key [143]
o mbedtls: fix ticket handling [52]
o mbedtls: pass correct length for PEM/DER key blobs [177]
o mbedtls: resend length check [140]
o mdlinkcheck: pass `--retry-max-time` to avoid server-controlled long retry times [161]
o mime: bound Curl_mime_duppart() recursion depth [164]
o mime: bound Curl_mime_prepare_headers() recursion depth [76]
o mime: do curl_mime_free() non-recursively [48]
o mprintf: acknowledge %F [300]
o mprintf: avoid scanning strings twice for unbounded %s [110]
o mprintf: make mprintf() and mfprintf() return -1 on error [279]
o mprintf: stage output and emit it in runs [38]
o mprintf: use size_t width for the bare Windows %I modifier [178]
o mqtt: drain queued output before advancing the state machine [118]
o mqtt: remaininglength check for 32-bit systems [150]
o mqttd: work around bogus VS2019 32-bit compiler warning [202]
o mulit_ev: remove socket references on forget [89]
o multi-event: fix timeout of pending transfers [111]
o multi: adjust the cleanup order in multi_done [135]
o multi: is_finished() fix [239]
o multi: reduce struct size with small cleanups [25]
o multi: remove redundant completion message list [32]
o multi: store timeout epoch as whole seconds [36]
o multi_ntfy: fix handling of more than 128 notifications in a batch [86]
o multi_ntfy: recheck callback on dispatch [228]
o multi_ntfy: replace enabled bitset with inline flags [44]
o multihandle: some easy shrinks [33]
o netrc: empty quoted values now produce a valid empty string [62]
o netrc: survive comment-only .netrc file [93]
o ngtcp2: shrink max sendbuf [13]
o ngtcp2: use stream in userdata [185]
o openldap: hand it a dup'd socket, not curl's own
o openssl/gtls: reject CRLfile with native CA store, matching rustls [27]
o openssl: fix OpenSSL v4.1 no-deprecated build [190]
o openssl: hardening [227]
o openssl: support X509 store caching when CApath is configured [264]
o openssl: use non-deprecated API for MD5/MD4 [69]
o os400: document curl_formadd_CCSID multi-chunk peculiarity [5]
o os400: restore HAVE_FCHMOD [181]
o os400: use correct free function [189]
o ossl_verifyhost: remove assumption of null-termination of ASN1_STRING. [26]
o output-dir.md: expand on its behavior [151]
o parsedate: find day names, months and time zones faster [68]
o parsedate: remove the unused leading three letters [106]
o parsedate: validate NULL date pointer in curl_getdate [213]
o peer: compare zoneid case sensitive [229]
o peer: parsing a zoneid as number fix [139]
o peer: preserve ipv6 props from "connect-to" [155]
o perf-tests: output two-digital decimals always [96]
o pingpong: add a max loop counter for Curl_pp_readresp [113]
o pingpong: guard sendleft against a send reporting more than requested [196]
o pingpong: schedule server response timeouts for the socket API [221]
o pytest: adjust threshold in test_20_11_crazy_pings for arm64 [237]
o pytest: check server status without ssl verify [154]
o pytest: fixture fixes [193]
o pytest: set `PerSourcePenalties no` when sshd supports it [169]
o pytest: silence pytest warnings [261]
o pytest: start all servers early [214]
o retry.md: clarify that the server can override retry delay time [184]
o Revert "setopt: clear the 'custom' CA booleans when set to NULL" [235]
o rtsp: accept a Content-Length body on methods that expected none [115]
o rtsp: do not send a learned session id to another origin [10]
o runtests: add extra room for mininum number of tests in sliced jobs [201]
o runtests: Added runnernums in order to have O(1) lookup [45]
o runtests: unset `CURL_MEMDEBUG` for curl requests made to the CI API [258]
o rustls: break recv loop on empty plain text [298]
o rustls: consume CURLOPT_SSLCERT_BLOB / CURLOPT_SSLKEY_BLOB [219]
o schannel: auto_client_cert conn matching [17]
o schannel: clear borrowed sslContext on close [15]
o schannel: fix `-Wextra-semi-stmt` with clang and extra debug enabled [267]
o schannel: fix compiler warning `-Wstrict-aliasing` in ALPN code [243]
o schannel: fix guard for old MSVC workaround [204]
o schannel: handle empty tokens during renegotiation [183]
o schannel: retain close_notify records across send retries [302]
o sectrust: add guards for rest of Apple OS flavors [250]
o share link: forget connection [223]
o socketpair: fix accept loop [210]
o socketpair: use `pipe2()` on Apple OSes (requires SDK 27) [262]
o socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH [124]
o socks: track SOCKS5 authentication per socket, not per connection [171]
o socksd: count connections per test, widen the method2 sentinel
o ssl: dedup ssl_fsslctx [35]
o ssls: validate input arguments in import, export, and unpack [136]
o strparse: speed up number parsing [129]
o sws: fix connection-monitor for connections closed before a request [153]
o telnet: make it work through proxy tunnels [112]
o test 1605: move from unit to libtest [49]
o test/servers.pm: restrict h2/3 port reuse [203]
o test1119, 1167: disable MSYS2 argument conversion [254]
o test1399: improve reliability [9]
o test1679: unset `SSL_CERT_FILE`, use `TESTNUMBER` [58]
o test2007: bump to use SHA256 public key hash (was: MD5) [226]
o test2007: set `MSYS2_ARG_CONV_EXCL` to avoid flaky failures [216]
o test2072: enable on Cygwin/MSYS2 [256]
o test428: skip when running on older MSYS2 versions [276]
o test: restore the old test 1609 as 3271 [162]
o testcurl.pl: drop support for building c-ares from embedded source tree [253]
o tests/http: use @classmethod when appropriate [231]
o tests: add SFTP connection reuse tests [224]
o tests: clean up Python test code [130]
o tests: fix typos in a comment [247]
o tests: require valgrind 3+ (2007-08-03) [282]
o tftp: verify direction in a few places [101]
o tool: (re)set SSL verification in --libcurl output [1]
o tool: add Unicode and long-filename support to `--create-dir` (Windows) [141]
o tool: buffer headers before remote filename selection [98]
o tool: handling of "synthetic" errors [233]
o tool_doswin: recognize superscript numbers as reserved [117]
o tool_easysrc: reset the handle between --next operations [90]
o tool_getparam: do not print the value of a redacted argument [127]
o tool_getparam: restore --socks5-gssapi-service [200]
o tool_help: guard category[2] access when category is bare "-" [59]
o tool_ipfs: keep the path percent-encoded when rewriting to the gateway [138]
o tool_operate: clear the retry flag when the output file fails [122]
o tool_util: add Unicode support to `tool_execpath()` [142]
o u8_strset, u32_ptrset: fix boundaries handling [131]
o uint-bset: skip unused slots when counting
o uint-table: add remove-max precaution [165]
o unit1399: check microsecond precision across redirects [225]
o unit1664: add workaround for VS2019 16.3 - VS2022 17.4 x64 miscompile [272]
o url: check syntax before applying default-protocol [147]
o url: CURLOPT_INTERFACE fix connection reuse match [186]
o url: match connections without force reuse and candidates [95]
o url: ntlm/negotiate, prohibit connection reuse on follows [18]
o urlapi: make curl_url_dup() copy the guessed_scheme flag [166]
o urlapi: normalize legacy numeric IPv4 hosts set via CURLUPART_HOST [180]
o urlapi: return NULL from curl_url_dup() when given a NULL handle [160]
o urlapi: run the urlparser perf test faster [54]
o urldata: remove conn->given [40]
o urldata: remove ssl_primary_config from easy handle [78]
o urldata: shrink connectdata negotiate states [207]
o vdns: announce resolver start before the HTTPS RR query is sent [173]
o vquic: fix preprocessor check for old Darwin versions [8]
o vquic: use `CURLX_FILE_MODE()` in `Curl_qlogdir()` [238]
o vssh: do not busy-loop in blocking state machine without a timeout [121]
o vtls: fix Curl_cert_hostcheck when the pattern is not a C string [12]
o vtls_scache: remember lock state locally [297]
o warnless: dedupe Intel compiler warning suppression pragmas [42]
o wcurl: import v2026.10.12 [236]
o websocket: auto PONG with client reader fix [215]
o websocket: error on EOS with incomplete frame [244]
o wolfssl: remove BIO destroy callback [157]
o ws: check pointer args in curl_ws_recv [192]
o ws: do not auto-pong in raw mode [123]
o x509: stricter parsing [2]
To generate a diff of this commit:
cvs rdiff -u -r1.309 -r1.309.2.1 pkgsrc/www/curl/Makefile
cvs rdiff -u -r1.38 -r1.38.2.1 pkgsrc/www/curl/Makefile.common
cvs rdiff -u -r1.228 -r1.228.2.1 pkgsrc/www/curl/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/www/curl/Makefile
diff -u pkgsrc/www/curl/Makefile:1.309 pkgsrc/www/curl/Makefile:1.309.2.1
--- pkgsrc/www/curl/Makefile:1.309 Wed Sep 2 19:19:31 2026
+++ pkgsrc/www/curl/Makefile Wed Oct 21 00:39:16 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.309 2026/09/02 19:19:31 wiz Exp $
+# $NetBSD: Makefile,v 1.309.2.1 2026/10/21 00:39:16 maya Exp $
.include "Makefile.common"
@@ -14,8 +14,8 @@ SUPERSEDES+= wcurl-[0-9]*
.include "options.mk"
-# 8.22.0
-# TESTDONE: 2072 tests were considered during 655 seconds.
-# TESTDONE: 1623 tests out of 1623 reported OK: 100%
+# 8.23.0
+# TESTDONE: 2138 tests were considered during 672 seconds.
+# TESTDONE: 1668 tests out of 1668 reported OK: 100%
.include "../../mk/bsd.pkg.mk"
Index: pkgsrc/www/curl/Makefile.common
diff -u pkgsrc/www/curl/Makefile.common:1.38 pkgsrc/www/curl/Makefile.common:1.38.2.1
--- pkgsrc/www/curl/Makefile.common:1.38 Wed Sep 2 19:19:31 2026
+++ pkgsrc/www/curl/Makefile.common Wed Oct 21 00:39:16 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile.common,v 1.38 2026/09/02 19:19:31 wiz Exp $
+# $NetBSD: Makefile.common,v 1.38.2.1 2026/10/21 00:39:16 maya Exp $
# used by www/libcurl-gnutls/Makefile
-DISTNAME= curl-8.22.0
+DISTNAME= curl-8.23.0
CATEGORIES= www
MASTER_SITES= https://curl.se/download/
EXTRACT_SUFX= .tar.xz
Index: pkgsrc/www/curl/distinfo
diff -u pkgsrc/www/curl/distinfo:1.228 pkgsrc/www/curl/distinfo:1.228.2.1
--- pkgsrc/www/curl/distinfo:1.228 Wed Sep 2 19:19:32 2026
+++ pkgsrc/www/curl/distinfo Wed Oct 21 00:39:16 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.228 2026/09/02 19:19:32 wiz Exp $
+$NetBSD: distinfo,v 1.228.2.1 2026/10/21 00:39:16 maya Exp $
-BLAKE2s (curl-8.22.0.tar.xz) = a89e1809cfded71de58affbd4c02b1fb1df70d7a76a120ce79144c1d529530b0
-SHA512 (curl-8.22.0.tar.xz) = d6badf794e7a72760a353db73adb8b671804ce41619b401265b22dc8f6770ebeaa5adb3c4d1312722082c56013612a382884e025cca49397a8ab47577dd659f7
-Size (curl-8.22.0.tar.xz) = 2953092 bytes
+BLAKE2s (curl-8.23.0.tar.xz) = 0c41b4d76dc6da7c5b9848bd8ad08cb41058a31c030ba2b934b824247de8aa30
+SHA512 (curl-8.23.0.tar.xz) = 69cf0feafdc79fbad007cf2fc977b777ce6ccb05d01afd17b5a42f8bedbfcc342fc3a48193faa7f3eafe6800cd7d07948916e8733db1b9de60287ed06219b840
+Size (curl-8.23.0.tar.xz) = 2990916 bytes
Home |
Main Index |
Thread Index |
Old Index