8000 Update curl to 8.23.0 by gominimal-pkgmgr-mgr[bot] · Pull Request #929 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

Update curl to 8.23.0 - #929

Merged
bryan-minimal merged 2 commits into
mainfrom
update-curl-8.23.0
Oct 21, 2026
Merged

Update curl to 8.23.0#929
bryan-minimal merged 2 commits into
mainfrom
update-curl-8.23.0

Conversation

@gominimal-pkgmgr-mgr
@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot commented Oct 19, 2026
Copy link
Copy Markdown
Contributor

Update curl 8.22.0 → 8.23.0

Source: github:curl/curl:release-asset
Release: https://github.com/curl/curl/releases/tag/curl-8_23_0
Changelog: curl/curl@8.22.0...curl-8_23_0
Released: 4 days ago (2026-10-14)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 8.23.0 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 20 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (20)

This update clears 20 vulnerabilities affecting 8.22.0:

CVE / GHSA CPE Severity Fixed in
CURL-CVE-2026-92392 (curl, curl) HIGH via range: >= 8.12.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23…
CURL-CVE-2026-107928 (curl, curl) UNKNOWN via range: >= 7.86.0, < 8.23.0
CURL-CVE-2026-107929 (curl, curl) UNKNOWN via range: >= 8.9.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23.…
CURL-CVE-2026-86412 (curl, curl) UNKNOWN via range: >= 8.18.0, < 8.23.0
CURL-CVE-2026-86413 (curl, curl) UNKNOWN via range: >= 8.21.0, < 8.23.0
CURL-CVE-2026-86414 (curl, curl) UNKNOWN via range: >= 7.10.8, < 8.23.0
CURL-CVE-2026-86415 (curl, curl) UNKNOWN via range: >= 8.21.0, < 8.23.0
CURL-CVE-2026-87861 (curl, curl) UNKNOWN via range: >= 8.21.0, < 8.23.0
CURL-CVE-2026-87862 (curl, curl) UNKNOWN via range: >= 8.11.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23…
CURL-CVE-2026-87863 (curl, curl) UNKNOWN via range: >= 8.2.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23.…
CURL-CVE-2026-87865 (curl, curl) UNKNOWN via range: >= 7.69.1, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23…
CURL-CVE-2026-87866 (curl, curl) UNKNOWN via range: >= 7.43.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23…
CURL-CVE-2026-92386 (curl, curl) UNKNOWN via range: >= 8.7.0, < 8.23.0
CURL-CVE-2026-92387 (curl, curl) UNKNOWN via range: >= 8.10.0, < 8.23.0
CURL-CVE-2026-92388 (curl, curl) UNKNOWN via range: >= 7.21.0, < 8.23.0
CURL-CVE-2026-92389 (curl, curl) UNKNOWN via range: >= 7.15.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23…
CURL-CVE-2026-92390 (curl, curl) UNKNOWN via range: >= 7.20.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23…
CURL-CVE-2026-92391 (curl, curl) UNKNOWN via range: >= 7.56.0, < 8.14.3; >= 8.15.0, < 8.16.2; >= 8.17.0, < 8.20.2; >= 8.21.0, < 8.23…
CURL-CVE-2026-94265 (curl, curl) UNKNOWN via range: >= 8.21.0, < 8.23.0
CURL-CVE-2026-94266 (curl, curl) UNKNOWN via range: >= 7.62.0, < 8.23.0

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ curl 8.22.0 8.23.0
~ curl-upstream 8.22.0 8.23.0

Changes

Old New
Version 8.22.0 8.23.0
SHA256 f7ef3ae8a22e521f... 8dadd7d2536a314f...
Size 3.0 MB 3.0 MB
Source gs://minimal-staging-archives/curl-8.22.0.tar.xz gs://minimal-staging-archives/curl-8.23.0.tar.xz
  • License: curl (source: tarball)

Quality suggestions

  • Missing tests block. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a --version or small round-trip invocation) as part of this PR so future bumps catch regressions. See packages/python/build.ncl for a simple example.

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner October 19, 2026 05:39
@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot added the auto-update Opened autonomously by pkgmgr auto-update label Oct 19, 2026
@coderabbitai
coderabbitai Bot commented Oct 19, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 7184efa9-c565-48a4-b6cf-2109ba16262a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal bryan-minimal mentioned this pull request Oct 19, 2026
Merged
@bryan-minimal
bryan-minimal commented Oct 19, 2026
Copy link
Copy Markdown
Member

Holding this one: the minimal build status is red (1h55m) and that check publishes no log here. If the build failure is reproducible on the box I can look; otherwise a re-run will tell whether it was the builder.

norrietaylor
norrietaylor reviewed Oct 19, 2026
View reviewed changes
@norrietaylor norrietaylor left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The bump itself is fine. --with-openssl and --with-ca-path still exist, wcurl is still installed so its glob matches, and no package depends on SMB, which 8.23.0 removes.

minimal build failed while linking libx265.so on arm64 (collect2: ld returned 1). libx265 is only in this rebuild set through cmake → curl. That looks like the parallel-make race #934 fixes, so let's land #934, update this branch, and re-run. This clears ~20 curl advisories, so it's worth landing soon after.

Generated by Claude Code

@bryan-minimal
bryan-minimal commented Oct 20, 2026
Copy link
Copy Markdown
Member

Done, as @norrietaylor suggested: #934 (libx265 → Ninja) landed 2026-10-20 00:29 UTC, this branch was updated onto main (2955cb66), and the re-run is green. minimal build and minimal-check both pass, along with closure, the report checks, license/cla and CodeRabbit. Merge state is CLEAN.

On the earlier red build (the hold above): the buildbot's per-package log for run 6f29c338 shows curl 8.23.0 built fine on both arches. The failure was libx265 on arm64 (p2s.S.o: file not recognized → collect2: ld returned 1). x265's CMake feeds the same ARM asm add_custom_command outputs into both x265-static and x265-shared. Under the Makefile generator with parallel jobs, both targets write the same .S.o at once. Ninja emits that shared output once. libx265 was only in this rebuild set because of cmake → curl. The re-run rebuilt that whole cone, libx265 included, on both arches.

So this is ready to land. It clears the curl advisories, including CVE-2026-92392 (HIGH).

@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 20, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Oct 20, 2026
@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 21, 2026
Merged via the queue into main with commit 223a61d Oct 21, 2026
11 checks passed
@bryan-minimal
bryan-minimal deleted the update-curl-8.23.0 branch October 21, 2026 04:08
This was referenced Oct 26, 2026
Merged
Merged
7DB1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@norrietaylor norrietaylor norrietaylor left review comments
@bryan-minimal bryan-minimal bryan-minimal approved these changes

Assignees

No one assigned

Labels

auto-update Opened autonomously by pkgmgr auto-update

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bryan-minimal @norrietaylor
0