Upgrade curl to curl-8_23_0 ()

.circleci/config.yml

@@ -23,6 +23,7 @@
 ###########################################################################
 
 # View these jobs in the browser: https://app.circleci.com/pipelines/github/curl/curl
+# Images: https://circleci.com/developer/images?imageType=machine
 
 # Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/reference/configuration-reference/
 version: 2.1
@@ -45,9 +46,7 @@ commands:
     steps:
       - run:
           command: |
-            sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip
-            python3 -m venv ~/venv
-            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+            sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev
 
   configure:
     steps:
@@ -104,7 +103,6 @@ commands:
     steps:
       - run:
           command: |
-            source ~/venv/bin/activate
             # Revert a CircleCI-specific local setting that makes test 1459
             # return 67 (CURLE_LOGIN_DENIED) instead of the
             # expected 60 (CURLE_PEER_FAILED_VERIFICATION).
@@ -114,7 +112,7 @@ commands:
 executors:
   ubuntu:
     machine:
-      image: ubuntu-2204:2026.05.1
+      image: ubuntu-2204:2026.05.1  # manually bumped
 
 jobs:
   basic:
@@ -157,7 +155,7 @@ jobs:
 
   arm:
     machine:
-      image: ubuntu-2204:2026.05.1
+      image: ubuntu-2204:2026.05.1  # manually bumped
     resource_class: arm.medium
     steps:
       - checkout
@@ -168,7 +166,7 @@ jobs:
 
   arm-cares:
     machine:
-      image: ubuntu-2204:2026.05.1
+      image: ubuntu-2204:2026.05.1  # manually bumped
     resource_class: arm.medium
     steps:
       - checkout

.clang-tidy.yml

@@ -48,7 +48,8 @@ Checks:
   - readability-redundant-control-flow
   - readability-redundant-declaration
   - readability-redundant-function-ptr-dereference
-  - readability-redundant-parentheses
+  # readability-redundant-nested-if  # would need local suppression in a handful of cases
+  # - readability-redundant-parentheses
   - readability-redundant-preprocessor
   - readability-suspicious-call-argument
   - readability-uppercase-literal-suffix

.github/actions/pkg-install/action.yml

@@ -0,0 +1,68 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# https://docs.github.com/en/actions/tutorials/create-actions/create-a-composite-action
+name: 'Install packages'
+description: 'Installs packages for local workflows'
+
+inputs:
+  apt:
+    description: 'Optional space-separated list of apt package names'
+  brew:
+    description: 'Optional space-separated list of Homebrew package names'
+  pip:
+    description: 'Optional pip command-line options'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'install (apt)'
+      if: ${{ inputs.apt }}
+      shell: bash
+      env:
+        PACKAGES: ${{ inputs.apt }}
+      run: |
+        sudo rm -f /etc/apt/apt.conf.d/20apt-esm-hook.conf || true
+        ls -l /etc/apt/sources.list.d
+        sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+        sudo sed -i '/\/archive\.ubuntu\.com/d' /etc/apt/apt-mirrors.txt
+        sudo sed -i '/\/security\.ubuntu\.com/d' /etc/apt/apt-mirrors.txt
+        # sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt
+        cat /etc/apt/apt-mirrors.txt
+        [[ "${PACKAGES}" = *':i386'* ]] && sudo dpkg --add-architecture i386
+        sudo apt-get -o Dpkg::Use-Pty=0 update
+        sudo apt-get -o Dpkg::Use-Pty=0 install ${PACKAGES}
+
+    - name: 'install (brew)'
+      if: ${{ inputs.brew }}
+      shell: bash
+      env:
+        HOMEBREW_NO_INSTALL_CLEANUP: '1'
+        PACKAGES: ${{ inputs.brew }}
+      run: |
+        if [[ "$(uname)" != *'Darwin'* ]]; then
+          brewroot='/home/linuxbrew/.linuxbrew/bin/'
+        fi
+        # Run this command with retries because of spurious failures seen while running the tests.
+        # shellcheck disable=SC2181
+        while [[ $? == 0 ]]; do
+          for i in 1 2 3; do
+            if ${brewroot}brew install ${PACKAGES}; then
+              break 2
+            else
+              echo "Error: wait to try again: $i"
+              sleep 10
+            fi
+          done
+          false Too many retries
+        done
+
+    - name: 'install (pip)'
+      if: ${{ inputs.pip }}
+      shell: bash
+      env:
+        PACKAGES: ${{ inputs.pip }}
+      run: |
+        [ -d ~/venv ] || python3 -m venv ~/venv
+        ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary ${PACKAGES}

.github/egress-firewall.yaml

@@ -0,0 +1,15 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# https://github.com/github-early-access/actions-native-egress-firewall
+
+# Defaults:
+# - github.com
+# - [...]blob.core.windows.net
+# - codeload.github.com
+# - [...]actions.githubusercontent.com
+
+mode: enforce
+allow:
+  - api.github.com

.github/labeler.yml

@@ -454,14 +454,6 @@ script:
               scripts/**\
               }"
 
-SMB:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/smb.*,\
-              tests/smbserver.py\
-              }"
-
 SMTP:
   - all:
       - changed-files:
@@ -564,7 +556,7 @@ Windows:
               appveyor.*,\
               CMake/win32-cache.cmake,\
               lib/*win32*,\
-              lib/curlx/fopen.*,\
+              lib/curlx/win32-fopen.*,\
               lib/curlx/multibyte.*,\
               lib/curlx/winapi.*,\
               lib/libcurl.def,\

renovate.json → .github/renovate.json

@@ -65,6 +65,16 @@
       "schedule": [
         "* * 10 * *"
       ]
+    },
+    {
+      "description": "Schedule package updates on the 10th of January",
+      "matchSourceUrls": [
+        "**/amissl/**"
+      ],
+      "groupName": "yearly updates by URL",
+      "schedule": [
+        "* * 10 1 *"
+      ]
     }
   ],
   "customManagers": [
@@ -79,19 +89,6 @@
       ],
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}",
       "extractVersionTemplate": "{{#if extractVersion}}{{{extractVersion}}}{{else}}^v?(?<version>.+)${{/if}}"
-    },
-    {
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/^\\.github/workflows/linux\\.yml$/"
-      ],
-      "matchStrings": [
-        "OPENLDAP_VERSION: (?<currentValue>.*)\\s"
-      ],
-      "datasourceTemplate": "github-tags",
-      "depNameTemplate": "openldap/openldap",
-      "versioningTemplate": "semver",
-      "extractVersionTemplate": "^OPENLDAP_REL_ENG_(?<major>\\d+)_(?<minor>\\d+)_(?<patch>\\d+)$"
     }
   ]
 }

.github/scripts/cmp-config.pl

@@ -38,6 +38,7 @@
 my %remove = (
     '#define CURL_EXTERN_SYMBOL' => 1,
     '#define CURL_OS "Linux"' => 1,
+    '#define CURL_OS "aarch64-unknown-linux-gnu"' => 1,
     '#define CURL_OS "x86_64-pc-linux-gnu"' => 1,
     '#define GETHOSTNAME_TYPE_ARG2 int' => 1,
     '#define GETHOSTNAME_TYPE_ARG2 size_t' => 1,

.github/scripts/distfiles.sh

@@ -15,7 +15,6 @@ gitonly=".git*
 ^appveyor.*
 ^GIT-INFO.md
 ^README.md
-^renovate.json
 ^REUSE.toml
 ^SECURITY.md
 ^LICENSES/*

.github/scripts/pyspelling.words

@@ -393,7 +393,6 @@ IMAP
 imap
 IMAPS
 imaps
-impacket
 implementers
 INI
 init
@@ -792,9 +791,7 @@ slist
 sln
 Slowloris
 SMB
-smb
 SMBS
-smbs
 SMBv
 SMTP
 smtp

.github/scripts/requirements-docs.txt

@@ -2,4 +2,4 @@
 #
 # SPDX-License-Identifier: curl
 
-pyspelling==2.12.1
+pyspelling==2.13

.github/scripts/requirements.txt

@@ -4,6 +4,5 @@
 
 cmakelang==0.6.13
 codespell==2.4.3
-pyrefly==1.2.0
 reuse==6.2.0
-ruff==0.16.5
+ruff==0.17.0

.github/scripts/shellcheck-ci.sh

@@ -7,16 +7,18 @@
 
 set -eu
 
+cd -- "$(dirname "${0}")"/../..
+
 export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
 
 # GHA
-git ls-files '.github/workflows/*.yml' | while read -r f; do
+git ls-files '.github/actions/**/*.yml' '.github/workflows/*.yml' | while read -r f; do
   echo "Verifying ${f}..."
   {
     echo '#!/usr/bin/env bash'
     echo 'set -eu'
     yq eval '.. | select(has("run") and (.run | type == "!!str")) | .run + "\ntrue\n"' "${f}"
-  } | sed -E 's|\$\{\{ .+ \}\}|GHA_EXPRESSION|g' | shellcheck -
+  } | shellcheck -
 done
 
 # Circle CI

.github/scripts/verify-examples.pl

@@ -27,7 +27,7 @@
 use warnings;
 
 my @files = @ARGV;
-my $cfile = "test.c";
+my $cfile = 'test-' . (defined $ENV{'CC'} ? $ENV{'CC'} : 'gcc') . '.c';
 my $check = "./scripts/checksrc.pl";
 my $error = 0;
 
@@ -42,14 +42,14 @@ sub testcompile {
     if(defined $ENV{'CFLAGS'}) {
         $cflags .= ' ' . $ENV{'CFLAGS'};
     }
-    my $rc = system($cc . ' -c test.c -I include -W -Wall -pedantic -Werror ' . $cflags . ' ' .
+    my $rc = system($cc . ' -c ' . $cfile . ' -I include -W -Wall -pedantic -Werror ' . $cflags . ' ' .
         '-Wno-unused-parameter -Wno-unused-but-set-variable ' .
         '-DCURL_ALLOW_OLD_MULTI_SOCKET -DCURL_DISABLE_DEPRECATION') >> 8;
     return $rc;
 }
 
 sub checksrc {
-    my $rc = system($check, ('test.c')) >> 8;
+    my $rc = system($check, ($cfile)) >> 8;
     return $rc;
 }
 

.github/workflows/appveyor-status.yml

@@ -12,6 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions: {}
+cache-mode: none
 
 jobs:
   split: