Repository navigation
Upgrade curl to curl-8_23_0 () - #63
Merged
Merged
Conversation
Clarify that the size must not be larger than the buffer. Closes curl#23078
When no priv_key is configured and the default key file does not exsits, priv_key is set to "" which, when set in libssh, leads to an error. Only set priv_key when it is neither NULL nor the empty string. Fixes curl#23080 Closes curl#23082
Turn the DEBUGASSERT into a runtime check, returning an error if a re-send after EAGAIN uses a shorter data length. Reported-by: Joshua Rogers Closes curl#23083
When interpreting a zoneid as a numeric scopeid, check that the complete zoneid is numeric and not only has a number prefix. Closes curl#23060
Return CURLE_BAD_FUNCTION_ARGUMENT when NULL or zero-length buffer arguments are provided to curl_easy_ssls_import(), or when a NULL callback is passed to curl_easy_ssls_export(). Validate pointers and length in Curl_ssl_session_unpack() before dereferencing. Add unit test verifications in test1678. Closes curl#23062
The xcode-27 is incompatible with gcc-15, so use a macos-26 gcc-14 pairing instead. Number of combination jobs unchanged (9). Ref: curl#21236 (comment) Follow-up to 1acdf3b curl#18698 Closes curl#23087
A write function is allowed to invoked curl_easy_setopt and change itself. Get the write callback again after each chunk that has been written. Reported-by: Joshua Rogers Closes curl#23085
Before using the echconig from a HTTPS-RR, check if target and port match the peer it will be used for. Closes curl#23086
When doing TELNET:// transfers are read from stdin without having set an upload file, so set stdin non-blocking mode unconditionally to make it able to time-out correctly. Added to KNOWN_BUGS as not working on native Windows. Update test 1548 to sit waiting on an idle stdin with telnet properly. Closes curl#23081
A real file name cannot contain a slash. Skip those. Reported-by: Fernando Gallardo Extend the LIST response in test 2805 to verify that it gets ignored. Closes curl#23089
CURLOPT_WS_OPTIONS(3) documents that in raw mode (CURLWS_RAW_MODE), libcurl does not handle pings or any other frame for the application. Previously, auto_pong only checked !data->set.ws_no_auto_pong, ignoring data->set.ws_raw_mode. As a result, receiving a PING in raw mode caused libcurl to intercept the frame, discard it from the application stream, and queue an automatic PONG into ws->pending. When sending raw data via curl_ws_send(), ws_flush() would inject this unexpected PONG control frame into the application's raw stream, corrupting message framing. Disable auto_pong whenever ws_raw_mode is active. Closes curl#23040
The recent cpool refactor used an admin handle for looking up the last used connection of a transfer, but only for pool locks. In this use case, an admin handle it not always available (curl_easy_getinfo) and not necessary for pool locks. Just used the passed transfer for locking. Closes curl#23090
Break out of rustls' receive loop on empty plaintext results (due to a TLS message not having any) to prevent the famous "malicious" server from keeping curl in that loop forever. Reported-by: Joshua Rogers Closes curl#23092
Remember the locking state locally on import so that there is no confusion with another thread having locked the cache in the meantime. Reported-by: Joshua Rogers Closes curl#23091
E.g. (seen with LibreSSL build combined with ngtcp2 1.15.0):
```
lib/vquic/cf-ngtcp2-cmn.c:287:9: warning: mixing declarations and code is incompatible with standards before C99 [-Wdeclaration-after-statement]
287 | int ossl_early_status = SSL_get_early_data_status(ctx->tls.ossl.ssl);
| ^
```
Closes curl#23094
To improve CI performance. On the assumption that no-SSL builds have limited usefulness nowadays. VS2026 and VS2022 remains tested in other jobs. Saving 1m15s to 1m45s twice. Ref: curl#23094 (comment) Closes curl#23095
No measurable perf gain at the moment. Closes curl#23097
Seeing much more updates than in the past. Ref: https://www.stunnel.org/NEWS.html Closes curl#23098
Check the result of the OCSP data allocation and return CURLE_OUT_OF_MEMORY when this failed. Reported-by: Joshua Rogers Closes curl#23099
To make them evaluate correctly also on 32-bit platforms. Reported-by: Mohammed K. Fathy Closes curl#23100
It was added in 2005 (c7a6346) with no linked issue, which is probably why nobody re-checked it. Two later changes fixed it without removing it: - 97aca09 (2020) made --libs echo LIBCURL_PC_LIBS_PRIVATE only when ENABLE_SHARED=no, so a normal shared build prints just '-L$libdir -lcurl'. - e244d50 (2024) filtered inherited LDFLAGS down to -L/-F/ --library-path=/-framework before they reach LIBCURL_PC_LDFLAGS_PRIVATE, and that variable is referenced only by --static-libs. Closes curl#23102
Do not think that response headers were complete when the stream was reset after an 1xx response. Reported-by: Joshua Rogers Closes curl#23104
Quiche ships with its own BoringSSL copy which is/may be a different version than the one we pin in CI for the bare BoringSSL jobs. Cherry-picked from curl#23088 Closes curl#23106
With arm64 binaries. Thanks-to: Daniel McCarney Ref: rustls/rustls-ffi#682 Ref: curl#23065 (comment) Ref: curl#23079 (comment) Closes curl#23107
Fixing: ``` /usr/bin/find: ‘/c/PROGRA~1/MICROS~2/2022/Enterprise/vc/tools/msvc’: No such file or directory ``` Also: list installed MSVC versions, Windows Kits in log for information and debugging purposes. Ref: actions/runner-images#14602 Closes curl#23108
To be on par with Rustls arm64 binary package. Also add `intel` suffix/comment to prepare for introducing arm64 binaries. Closes curl#23109
GnuTLS documents for gnutls_certificate_verify_peers2() that it already takes a received OCSP response into account. Therefore our own code needs only to check if a stapled OCSP response was receieved when verifystatus is requested. Besides being superfluous, the code was also producing false negatives as the list of trust anchors used is insufficent for verification, as correclty pointed out in curl#23311. Closes curl#23312
Narrow the exclusion from `*` to `/D`, to fix certain build combinations relying on the heuristics, but still fix the narrower case that we saw breaking when using MSVC with CMake's Visual Studio generator, with `/DINW32 /D_WINDOWS` passed to the compiler, which hit the heuristics by default. Tested via curl#23306: https://ci.appveyor.com/project/curlorg/curl/builds/54881098 Ref: https://curl.se/dev/log.cgi?id=20261010032513-1037281 Reported-by: Marcel Raad Fixes curl#23372 Follow-up to 2f3f99d curl#23339 Closes curl#23375
curl's printf relies on the CRT to print floating point numbers. The old (pre-UCRT) CRT used by VS2013 and earlier toolchains behave differently than expected. Exclude them to make the test pass with these toolchains. Also: - output double conversion results to stdout to make it appear in CI logs. Test failures as seen with VS2013: ``` test 0557 [curl_mprintf() testing] 557: stdout FAILED: --- log/1/check-expected +++ log/1/check-generated @@ -6,7 +6,12 @@ All curl_mprintf() signed long tests OK![LF] All curl_mprintf() curl_off_t tests OK![LF] All curl_mprintf() strings tests OK![LF] -All float strings tests OK![LF] +sprintf line 1117 failed:[LF] +we ''[LF] +system: '9.000000'[LF] +MISMATCH (suffix): %.17Le curl=1.23456789012345670e+000 libc=e+00[LF] +MISMATCH (suffix): %.17LE curl=1.23456789012345670E+000 libc=E+00[LF] +test_float_formatting Failed![LF] All curl_mprintf() octal and hexadecimal tests OK![LF] [...] ``` Ref: https://ci.appveyor.com/project/curlorg/curl/builds/54883622/job/pdynkxfjxtfhlomb#L949 Follow-up to bdda3a2 curl#22706 Follow-up to 48322e9 curl#22719 Cherry-picked from curl#23306 Closes curl#23377
https://curl.se/libcurl/c/options-in-examples.html lists libcurl options that have no corresponding examples using them. This fixes some gaps. - aws-sigv4.c: use CURLOPT_AWS_SIGV4 - cacertinmem: document that this is using the old way - cainfo-blob: use CURLOPT_CAINFO_BLOB - clientcert-blob: CURLOPT_SSLCERT_BLOB - conditional: use CURLOPT_TIMEVALUE - cookie.c: use CURLOPT_COOKIE - cookiejar: use CURLOPT_COOKIEJAR - doh: show how to use DoH - ftp-listonly: use CURLOPT_DIRLISTONLY - httpput: use CURLOPT_UPLOAD_BUFFERSIZE - httpsig: do RFC 9421 HTTP Message Signatures - limit-rate: limit download rate - nagle: clear TCP_NODELAY - path-as-is: keep dot-dot sequences - trailer: trailing headers using CURLOPT_TRAILERFUNCTION - usercertinmem: document that this is using the old way Closes curl#23379
The option was accepted but ignored since the switch to an enum for every option. Make it set the proxy service name again, as --proxy-service-name does. Extend test 1481 to verify Follow-up to 9e4e527 Closes curl#23344
Previous attempt: curl#21349 Assisted-by: Viktor Szakats Closes curl#23387
- add more `manually bumped` comments. Follow-up to b783adf curl#23271 - add link to Circle CI runner image page. - 'zero byte'/'binary 0'/'NUL' -> 'NUL byte' for consistency. - appveyor: use long-form options, `--out-null`, add `--disable`. - whitespace/typo/comment fixes. Closes curl#23386
To fix this error in the 'Run analysis' step:
```
Wrote bundle to file /tmp/bundle2839271098
2026/10/13 15:08:12 error sending scorecard results to webapp: http
response 400, status: 400 Bad Request, error:
{"code":400,"message":"workflow verification failed: unable to parse
github workflow: [:23:1: unexpected key \"cache-mode\" for \"workflow\"
section. expected one of \"concurrency\", \"defaults\", \"env\",
\"jobs\", \"name\", \"on\", \"permissions\", \"run-name\"
[syntax-check]]"}
```
It's a new, but legit key. It seems the ossf/scorecard-action does not
recognize it yet. Further, it seems it outsources this check (indirectly)
to actionlint, which I recently dropped from CI because it's
accumulating many fallouts due to the lack of upstream updates.
It means the Scorecard analyzer may flag other similar ones that we
previously explicitly silenced via the actionlint command-line.
Refs:
https://github.com/ossf/scorecard-action/blob/fa7117db83c52d787ae5a89f350999701505d78e/go.mod#L16
ossf/scorecard#5278
Follow-up to e8ca163 curl#23387
Follow-up to 410e444 curl#23194
Closes curl#23388
- Do not clear the bool indicating custom choice when NULL is passed as the option value. This change affects how libcurl behaves when the NULL value is set for SSL CA options CURLOPT_CAINFO, CURLOPT_CAPATH, CURLOPT_CAINFO_BLOB, CURLOPT_PROXY_CAINFO, CURLOPT_PROXY_CAPATH, CURLOPT_PROXY_CAINFO_BLOB. Those options have a variable that tracks when they are set to determine whether or not to use a default value. Prior to this change, and since 5df33ef (precedes 8.22.0), if those options were set to NULL then the respective tracking variable would be set to false to indicate the user did not make a custom choice. Prior to 5df33ef, if those options were set to NULL then the respective tracking variable would be set to true to indicate the user did make a custom choice. This change effectively restores the behavior prior to 5df33ef because users may set the option value to NULL to indicate that they do not want the default value used. In other words, NULL is a valid custom choice and should not cause the option to revert to its default string. Bug: curl#22614 Reported-by: tawmoto@users.noreply.github.com Closes curl#23202
Keep the SSPI shutdown token and its sent offset until the complete record has been written. Regenerating it after CURLE_AGAIN loses an encrypted record and can make the peer reject the next record. Handle short writes without advancing the TLS context again and free pending tokens when the connection closes. Add a native unit test for would-block, partial writes, pending-token cleanup and send failures. Prior to this change libcurl didn't properly handle the case where the close_notify TLS record could not be sent in full on the first try. Microsoft observed FTPS upload failures due to this problem. Refer to the pull request for more detail. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Closes curl#23368
- Require that both hostnames for comparison fit the key before using the fast path; otherwise compare the complete case-insensitive hostname. - Extend test unit3271 with both length orderings and equal long names. Prior to this change the check was incomplete and the comparison could be erroneously skipped. Follow-up to 62a6ee5. Closes curl#23350
![cycode-security[bot]](https://avatars.githubusercontent.com/in/39308?s=60&v=4){kind=small}
Since 2f1e94e the alive check in Curl_cpool_conn_seems_healthy() is skipped when it last ran less than a second ago, and that also skipped the pending input check that follows it. An idle HTTP/1.1 connection that had received unsolicited data from the server was then reused within that second and the stray bytes came back as the response to the next request, so every later response on that connection was shifted by one. 8.21.0 refused to reuse a connection with input pending on every reuse, and with 8.22.0 the tool reproduces it at a 900 ms gap between requests while 1100 ms gets a fresh connection. RFC 9112 section 9.2 says a client must not treat data received with no outstanding request as a response, so poll for pending input on every reuse of an idle non-multiplexed connection and keep the once a second limit only for the other checks, the protocol specific connection_is_dead callback and multiplexed connections. Test 1701 reproduces it with sws sending a second response after the first one completed and the tool starting the next request inside the window. Follow-up to 2f1e94e Ref: curl#22169 Bug: https://hackerone.com/reports/4098761 Closes curl#23412 (cherry picked from commit ef6b17c)
simon-lemay-unity
requested changes
Oct 26, 2026
simon-lemay-unity
left a comment
simon-lemay-unity
left a comment
There was a problem hiding this comment.
I think the update might have moved the new fields in vtls_config.h in the wrong struct. Let check quickly and then I'll approve or update the PR.
simon-lemay-unity
left a comment
simon-lemay-unity
left a comment
There was a problem hiding this comment.
Alright only a comment needed to be updated. I changed it. Rest looks good.
simon-lemay-unity
approved these changes
Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated curl upgrade to
curl-8_23_0for .Merged upstream tag into
masteron branchcve/curl-curl-8_23_0.Files changed: 0.
The break reviewer flagged API-incompatible changes and the repair loop resolved them locally before this PR was opened:
Opened by cve-libcurl-updater. Do not auto-merge — human review required.