Upgrade curl to curl-8_21_0 (CVE-2026-8924, CVE-2026-9079)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -15,6 +15,17 @@ body:
 
         **SECURITY RELATED?** Submit here: https://hackerone.com/curl
 
+  - type: markdown
+    attributes:
+      value: "
+        > [!IMPORTANT]
+
+        > If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice."
+
   - type: textarea
     id: reproducer
     attributes:

.github/ISSUE_TEMPLATE/docs.yml

@@ -14,6 +14,17 @@ body:
 
         Only file documentation bugs here! Ask questions on the mailing lists https://curl.se/mail/
 
+  - type: markdown
+    attributes:
+      value: "
+        > [!IMPORTANT]
+
+        > If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice."
+
   - type: textarea
     id: source
     attributes:

.github/labeler.yml

@@ -39,6 +39,7 @@ authentication:
           - any-glob-to-all-files: "{\
               CMake/FindGSS.cmake,\
               CMake/FindLibgsasl.cmake,\
+              docs/internals/CREDENTIALS.md,\
               docs/libcurl/opts/CURLINFO_HTTPAUTH*,\
               docs/libcurl/opts/CURLINFO_PROXYAUTH*,\
               docs/libcurl/opts/CURLOPT_KRB*,\
@@ -49,10 +50,13 @@ authentication:
               docs/libcurl/opts/CURLOPT_XOAUTH*,\
               lib/*gssapi*,\
               lib/*ntlm*,\
+              lib/creds.*,\
+              lib/curl_ntlm*,\
               lib/curl_sasl.*,\
               lib/http_aws*,\
               lib/http_digest.*,\
               lib/http_negotiate.*,\
+              lib/http_ntlm.*,\
               lib/vauth/**\
               }"
 
@@ -129,16 +133,19 @@ connecting & proxies:
               docs/libcurl/opts/CURLOPT_SOCKS*,\
               docs/libcurl/opts/CURLOPT_TCP*,\
               docs/libcurl/opts/CURLOPT_TIMEOUT*,\
+              lib/cf-https-connect.*,\
+              lib/cf-ip-happy.*,\
               lib/cf-*proxy.*,\
               lib/cf-socket.*,\
               lib/cfilters.*,\
               lib/conncache.*,\
               lib/connect.*,\
               lib/http_proxy.*,\
               lib/if2ip.*,\
-              lib/noproxy.*,\
+              lib/proxy.*,\
               lib/socks.*,\
               src/tool_cb_soc.*,\
+              tests/http/*proxy*,\
               tests/http/*socks*,\
               tests/server/socksd.c\
               }"
@@ -295,11 +302,14 @@ HTTP/3:
               .github/workflows/http3-linux.yml,\
               CMake/FindNGHTTP3.cmake,\
               CMake/FindNGTCP2.cmake,\
+              docs/cmdline-opts/proxy-http3.md,\
               docs/HTTP3.md,\
               docs/examples/http3*,\
+              lib/cf-h3-proxy.*,\
               lib/vquic/**,\
               tests/http3-server.pl,\
-              tests/nghttpx.conf\
+              tests/nghttpx.conf,\
+              tests/http/*httpsrr*\
               }"
 
 IMAP:
@@ -381,6 +391,8 @@ name lookup:
               lib/socketpair*,\
               lib/thrdpool.*,\
               lib/thrdqueue.*,\
+              tests/http/testenv/dnsd.*,\
+              tests/http/*httpsrr*,\
               tests/http/*resolve.py,\
               tests/server/dnsd.c,\
               tests/server/resolve.c\
@@ -458,6 +470,7 @@ tests:
   - all:
       - changed-files:
           - any-glob-to-any-file:
+              - 'docs/tests/**'
               - 'tests/**'
 
 TFTP:
@@ -548,9 +561,9 @@ Windows:
               lib/curlx/fopen.*,\
               lib/curlx/multibyte.*,\
               lib/curlx/winapi.*,\
+              lib/libcurl.def,\
               lib/vtls/schannel*,\
               m4/curl-schannel.m4,\
               projects/Windows/**,\
-              src/tool_doswin.c,\
-              lib/libcurl.def\
+              src/tool_doswin.c\
               }"

.github/pull_request_template.md

@@ -0,0 +1,8 @@
+<!--
+        IMPORTANT:
+        If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice.
+-->

.github/scripts/cleancmd.pl

@@ -16,7 +16,7 @@
 my @asyms;
 
 open(S, "<./docs/libcurl/symbols-in-versions")
-    || die "cannot find symbols-in-versions";
+    or die "cannot find symbols-in-versions";
 while(<S>) {
     if(/^([^ ]*) /) {
         push @asyms, $1;
@@ -30,7 +30,7 @@
     );
 
 open(O, "<./docs/options-in-versions")
-    || die "cannot find options-in-versions";
+    or die "cannot find options-in-versions";
 while(<O>) {
     chomp;
     if(/^([^ ]+)/) {
@@ -50,7 +50,7 @@
 close(O);
 
 open(C, "<./.github/scripts/spellcheck.curl")
-    || die "cannot find spellcheck.curl";
+    or die "cannot find spellcheck.curl";
 while(<C>) {
     if(/^\#/) {
         next;

.github/scripts/cmp-config.pl

@@ -34,8 +34,7 @@
     exit;
 }
 
-# this lists complete lines that will be removed from the output if
-# matching
+# this lists complete lines that are removed from the output if matching
 my %remove = (
     '#define CURL_EXTERN_SYMBOL' => 1,
     '#define CURL_OS "Linux"' => 1,

.github/scripts/pyspelling.words

@@ -167,8 +167,10 @@ CWE
 cyassl
 Cygwin
 daniel
+datagrams
 datatracker
 dbg
+decapsulation
 Debian
 DEBUGBUILD
 decrypt
@@ -234,6 +236,7 @@ EGD
 EHLO
 EINTR
 else's
+encapsulation
 encodings
 enctype
 endianness
@@ -896,6 +899,7 @@ trustless
 Tse
 Tsujikawa
 TTL
+tty
 tvOS
 txt
 typedef
@@ -1010,6 +1014,7 @@ Youtube
 YYYY
 YYYYMMDD
 Zakrzewski
+Zeropath
 Zitzmann
 zlib
 zsh

.github/scripts/randcurl.pl

@@ -61,7 +61,7 @@ sub storedata {
 }
 
 sub getoptions {
-    my @all = `$curl --help all`;
+    my @all = qx($curl --help all);
     for my $o (@all) {
         chomp $o;
         if($o =~ /^ -(.), --([^ ]*) (.*)/) {
@@ -142,7 +142,7 @@ sub runone {
         $a .= " ".addarg();
     }
 
-    my $cmd="$curl$a $url";
+    my $cmd = "$curl$a $url";
 
     my $rc = system("$cmd >curl-output 2>&1 </dev/null -M 0.1") >> 8;
     #my $rc = system("valgrind -q $cmd >/dev/null 2>&1 </dev/null -M 0.1") >> 8;
@@ -194,7 +194,7 @@ sub runconfig {
     print C "$a\n";
     close(C);
 
-    my $cmd="$curl -K config $url";
+    my $cmd = "$curl -K config $url";
 
     my $rc = system("$cmd >curl-output 2>&1 </dev/null -M 0.1") >> 8;
 
@@ -218,7 +218,7 @@ sub runconfig {
 }
 
 # run curl command lines using -K
-my $end = time() + $seconds/2;
+my $end = time() + $seconds / 2;
 my $c = 0;
 print "Running command lines\n";
 do {
@@ -228,7 +228,7 @@ sub runconfig {
 print "$c command lines\n";
 
 # run curl command lines
-$end = time() + $seconds/2;
+$end = time() + $seconds / 2;
 $c = 0;
 print "Running config lines\n";
 do {

.github/scripts/requirements.txt

@@ -4,6 +4,5 @@
 
 cmakelang==0.6.13
 codespell==2.4.2
-pytype==2024.10.11
 reuse==6.2.0
-ruff==0.15.10
+ruff==0.15.16

.github/scripts/typos.toml

@@ -6,7 +6,7 @@
 extend-ignore-identifiers-re = [
   "^(ba|fo|pn|PN|UE)$",
   "^(CNA|cpy|ser)$",
-  "^(ECT0|ECT1|HELO|htpts|PASE)$",
+  "^(ECT0|ECT1|HELO|htpts|mport|PASE)$",
   "^[A-Za-z0-9_-]*(EDE|GOST)[A-Z0-9_-]*$",  # ciphers
   "^0x[0-9a-fA-F]+FUL$",  # unsigned long hex literals ending with 'F'
    "^[0-9a-zA-Z+]{64,}$",  # possibly base64

.github/scripts/verify-examples.pl

@@ -68,7 +68,7 @@ sub extract {
                 print O "/* !checksrc! disable BANNEDFUNC all */\n";  # for fopen()
                 print O "/* !checksrc! disable COPYRIGHT all */\n";
                 print O "/* !checksrc! disable UNUSEDIGNORE all */\n";
-                printf O "#line %d \"$f\"\n", $iline+1;
+                printf O "#line %d \"$f\"\n", $iline + 1;
             }
         }
         elsif($syn == 2) {

.github/stale.yml

@@ -15,7 +15,7 @@ staleLabel: stale
 # Comment to post when marking an issue as stale. Set to `false` to disable
 markComment: >
   This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
+  recent activity. It is closed if no further activity occurs. Thank you
   for your contributions.
 # Comment to post when closing a stale issue. Set to `false` to disable
 closeComment: false

.github/workflows/checksrc.yml

@@ -74,7 +74,7 @@ jobs:
       - name: 'typos'
         timeout-minutes: 2
         run: |
-          HOMEBREW_NO_AUTO_UPDATE=1 /home/linuxbrew/.linuxbrew/bin/brew install typos-cli
+          /home/linuxbrew/.linuxbrew/bin/brew install typos-cli
           eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           typos --version
           .github/scripts/typos.sh
@@ -88,18 +88,34 @@ jobs:
         run: |
           scripts/perlcheck.sh
 
-      - name: 'pytype'
+      - name: 'ruff'
         run: |
           source ~/venv/bin/activate
-          find . -name '*.py' -exec pytype -j auto -k -- {} +
+          scripts/pythonlint.sh
 
-      - name: 'ruff'
+  pytype:
+    name: 'pytype'
+    runs-on: ubuntu-24.04-arm  # pytype is discontinued and requires python 3.8-3.12
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'install prereqs'
+        run: |
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary pytype==2024.10.11 \
+            -r .github/scripts/requirements.txt \
+            -r tests/http/requirements.txt \
+            -r tests/requirements.txt
+
+      - name: 'check'
         run: |
           source ~/venv/bin/activate
-          scripts/pythonlint.sh
+          find . -name '*.py' -exec pytype -j auto -k -- {} +
 
   complexity:
-    name: 'complexity'
+    name: 'complexity and function sizes'
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
@@ -110,16 +126,18 @@ jobs:
           sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
           sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
           sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            pmccabe
+          sudo apt-get -o Dpkg::Use-Pty=0 install pmccabe
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
-      - name: 'check scores'
+      - name: 'check function complexity'
         run: ./scripts/top-complexity
 
+      - name: 'check function lengths'
+        run: ./scripts/top-length
+
   xmllint:
     name: 'xmllint'
     runs-on: ubuntu-slim
@@ -131,8 +149,7 @@ jobs:
           sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
           sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
           sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libxml2-utils
+          sudo apt-get -o Dpkg::Use-Pty=0 install libxml2-utils
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -148,7 +165,7 @@ jobs:
     steps:
       - name: 'install prereqs'
         timeout-minutes: 2
-        run: HOMEBREW_NO_AUTO_UPDATE=1 /home/linuxbrew/.linuxbrew/bin/brew install actionlint shellcheck zizmor
+        run: /home/linuxbrew/.linuxbrew/bin/brew install actionlint shellcheck zizmor
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -161,12 +178,19 @@ jobs:
           eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           zizmor --persona pedantic .github/workflows/*.yml .github/dependabot.yml
 
+      - name: 'zizmor GHA (auditor, warning-only)'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          zizmor --persona auditor .github/workflows/*.yml .github/dependabot.yml || true
+
       - name: 'actionlint'
         run: |
           eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
           actionlint --version
-          actionlint --ignore matrix .github/workflows/*.yml
+          actionlint --ignore matrix --ignore ubuntu-26.04 .github/workflows/*.yml
 
       - name: 'shellcheck CI'
         run: |