I understand that www/curl will not build security/heimdal since it
considers that the builtin version is used. But when devel/cmake tests
its dependencies, it considers that builtin version of heimdal is not
used and it complains that the package is not installed.
The problem is the fact that pkgsrc is now insisting on linking a lot
of packages (curl included) with openssl from pkgsrc. This causes
linking with libraries from the base system that link against base
openssl to break.
You may get better success if you set:
USE_BUILTIN.openssl=no
in your /etc/mk.conf
Mike