Upgrade curl to 8.21.0

[VijayenderReddyPutta]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

Summary
What does the PR accomplish, why was it needed?

This PR upgrades curl from 8.11.1 to 8.21.0.

The current package carries downstream backport patches for the CVEs listed below. These patches are removed in this PR because the fixes are already included in upstream curl releases through 8.21.0.

Removed downstream CVE patches now covered upstream

• Fixed in 8.12.0+
  • CVE-2025-0167 — netrc and default credential leak
  • CVE-2025-0665 — eventfd double-close
  • CVE-2025-0725 — gzip integer overflow
• Fixed in 8.16.0+
  • CVE-2025-10148 — predictable WebSocket mask
• Fixed in 8.18.0+
  • CVE-2025-14017 — threaded OpenLDAP partial SSL config
• Fixed in 8.19.0+
  • CVE-2026-1965 — Negotiate auth over wrong connection
  • CVE-2026-3783 — token leak with redirect and netrc
  • CVE-2026-3784 — credentials not checked for reused connection
• Fixed in 8.20.0+
  • CVE-2026-4873 — STARTTLS connection reuse over non-STARTTLS connection
  • CVE-2026-5545 — bad reuse of Negotiate connection
  • CVE-2026-6253 — proxy credentials leak over redirect-to proxy
  • CVE-2026-6276 — stale custom cookie host causes cookie leak
  • CVE-2026-6429 — netrc credential leak with reused proxy connection
  • CVE-2026-7168 — cross-proxy Digest auth state leak
• Fixed in 8.21.0
  • CVE-2026-12064 — proto-default skips SSH verification
  • CVE-2026-8286 — STARTTLS authentication bypass via connection reuse
  • CVE-2026-8458 — SASL password overflow via integer truncation
  • CVE-2026-8926 — netrc and redirect credential leak
  • CVE-2026-8927 — proxy digest auth state not reset on proxy change
  • CVE-2026-8932 — client cert leak on connection reuse
  • CVE-2026-9079 — stale proxy password leak
  • CVE-2026-10536 — HTTP/2 GOAWAY crash

These CVEs were validated against curl’s official affected/fixed version matrix and security advisories. Because this package is being upgraded to 8.21.0, the downstream backport patches are no longer required.

For reference:

• curl security advisories: https://curl.se/docs/security.html
• CVE-2025-0167 advisory: https://curl.se/docs/CVE-2025-0167.html
• CVE-2025-0725 advisory: https://curl.se/docs/CVE-2025-0725.html
• curl release/version history: https://curl.se/docs/versions.html

Note: this section documents the downstream CVE patches removed by this PR. Upstream curl 8.21.0 also includes additional security fixes that were not previously carried as downstream patches in this package.

Compatibility / Breaking-Change Notes (Azure Linux)
Upgrades curl from 8.11.1 to 8.21.0.
Removes downstream Azure Linux backport patches because the included CVE fixes are now present upstream in curl 8.21.0.

Auth API change:
CURLAUTH_DIGEST_IE is no longer supported in 8.21.0.
Use CURLAUTH_DIGEST instead.

Protocol/feature changes in upgrade path:
RTMP removed.
SMB support is opt-in.
NTLM disabled by default in newer upstream builds.
Verify required protocols/features with curl --version.

TLS/dependency expectations:
Upstream tightened several dependency/version constraints across the included versions.
Validate runtime/build compatibility on pinned environments.

HTTP/2 behavior:
HTTP/2 stream dependency controls are deprecated/no-op in 8.21.0.
Validate latency/perf-sensitive HTTP/2 workloads.

Compatibility note: upstream curl 8.21.0 deprecates CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E; these options are retained for backward compatibility but no longer have any effect.
No Azure Linux packaging-level breaking changes were identified in this PR beyond the upstream curl behavior changes included in the version upgrade.
Consumers that depend on exact upstream curl 8.11.1 behavior should validate workloads against 8.21.0, especially if they use advanced HTTP/2 stream-priority/dependency APIs, connection reuse behavior, proxy authentication flows, STARTTLS, mTLS, or redirect credential handling.

Verdict: Safe to merge. No breaking changes upstream (8.11.1 → 8.21.0) affect this package's build configuration or default protocol/auth surface.

Reviewed breaking changes and their impact on this build (--with-ssl --with-gssapi --with-libssh2 --with-nghttp2 --enable-threaded-resolver):

<style> </style>

Change	Impact here
Secure Transport / BearSSL TLS backends removed	None — this build uses OpenSSL
OpenSSL minimum raised to 3.0.0	None — Azure Linux already ships OpenSSL 3.x
NTLM disabled by default	No impact unless a consumer explicitly relies on NTLM auth
SMB support made opt-in	None — SMB was never enabled in this spec
RTMP support dropped	None — RTMP was never enabled in this spec
c-ares minimum raised to 1.16.0	None — this build uses the threaded resolver, not c-ares
CURLAUTH_DIGEST_IE legacy behavior removed	Negligible — pre-2006 IE Digest quirk, not used in practice

Recommendation: No action required for this build. Only downstream consumers that explicitly use NTLM authentication should verify their integration continues to work as expected post-upgrade.

Change Log
SPECS/curl/curl.spec — bump to 8.21.0, drop 21 obsolete CVE patches, %changelog
SPECS/curl/curl.signatures.json — new source hash (d9b32799...7f99135e33bb)
SPECS/curl/CVE-2025-0167.patch — removed (fixed upstream in 8.12.0)
SPECS/curl/CVE-2026-1965.patch — removed (fixed upstream in 8.19.0)
SPECS/curl/CVE-2026-6253.patch — removed (fixed upstream in 8.20.0)
SPECS/curl/CVE-2025-0665.patch — removed (fixed upstream in 8.12.0)
SPECS/curl/CVE-2026-3783.patch — removed (fixed upstream in 8.19.0)
SPECS/curl/CVE-2025-0725.patch — removed (fixed upstream in 8.12.0)
SPECS/curl/CVE-2026-3784.patch — removed (fixed upstream in 8.19.0)
SPECS/curl/CVE-2026-6429.patch — removed (fixed upstream in 8.20.0)
SPECS/curl/CVE-2025-10148.patch — removed (fixed upstream in 8.16.0)
SPECS/curl/CVE-2026-4873.patch — removed (fixed upstream in 8.20.0)
SPECS/curl/CVE-2026-7168.patch — removed (fixed upstream in 8.20.0)
SPECS/curl/CVE-2025-14017.patch — removed (fixed upstream in 8.18.0)
SPECS/curl/CVE-2026-5545.patch — removed (fixed upstream in 8.20.0)
SPECS/curl/CVE-2026-6276.patch — removed (fixed upstream in 8.20.0)
SPECS/curl/CVE-2026-12064.patch — removed (fixed upstream in 8.21.0)
SPECS/curl/CVE-2026-8926.patch — removed (fixed upstream in 8.21.0)
SPECS/curl/CVE-2026-8927.patch — removed (fixed upstream in 8.21.0)
SPECS/curl/CVE-2026-8932.patch — removed (fixed upstream in 8.21.0)
SPECS/curl/CVE-2026-8458.patch — removed (fixed upstream in 8.21.0)
SPECS/curl/CVE-2026-10536.patch — removed (fixed upstream in 8.21.0)
SPECS/curl/CVE-2026-8286.patch — removed (fixed upstream in 8.21.0)
SPECS/curl/CVE-2026-9079.patch — removed (fixed upstream in 8.21.0)
cgmanifest.json — curl 8.11.1 -> 8.21.0

Does this affect the toolchain?
NO

Associated issues
#xxxx
Links to CVEs
https://nvd.nist.gov/vuln/detail/CVE-2025-0665 — already fixed in 8.12.0
https://nvd.nist.gov/vuln/detail/CVE-2025-0167 — already fixed in 8.12.0
https://nvd.nist.gov/vuln/detail/CVE-2025-0725 — already fixed in 8.12.0
https://nvd.nist.gov/vuln/detail/CVE-2025-10148 — already fixed in 8.16.0
https://nvd.nist.gov/vuln/detail/CVE-2025-14017 — already fixed in 8.18.0
https://nvd.nist.gov/vuln/detail/CVE-2026-1965 — already fixed in 8.19.0
https://nvd.nist.gov/vuln/detail/CVE-2026-3783 — already fixed in 8.19.0
https://nvd.nist.gov/vuln/detail/CVE-2026-3784 — already fixed in 8.19.0
https://nvd.nist.gov/vuln/detail/CVE-2026-4873 — already fixed in 8.20.0
https://nvd.nist.gov/vuln/detail/CVE-2026-6276 — already fixed in 8.20.0
https://nvd.nist.gov/vuln/detail/CVE-2026-7168 — already fixed in 8.20.0
https://nvd.nist.gov/vuln/detail/CVE-2026-5545 — already fixed in 8.20.0
https://nvd.nist.gov/vuln/detail/CVE-2026-6253 — already fixed in 8.20.0
https://nvd.nist.gov/vuln/detail/CVE-2026-6429 — already fixed in 8.20.0
https://nvd.nist.gov/vuln/detail/CVE-2026-12064 — already fixed in 8.21.0
https://nvd.nist.gov/vuln/detail/CVE-2026-8926 — already fixed in 8.21.0
https://nvd.nist.gov/vuln/detail/CVE-2026-8927 — already fixed in 8.21.0
https://nvd.nist.gov/vuln/detail/CVE-2026-8932 — already fixed in 8.21.0
https://nvd.nist.gov/vuln/detail/CVE-2026-8458 — already fixed in 8.21.0
https://nvd.nist.gov/vuln/detail/CVE-2026-10536 — already fixed in 8.21.0
https://nvd.nist.gov/vuln/detail/CVE-2026-8286 — already fixed in 8.21.0
https://nvd.nist.gov/vuln/detail/CVE-2026-9079 — already fixed in 8.21.0

Test Methodology
Local Build.

Buddy Build URL -

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Akhila Guruju (akhila-guruju)]

ABI / API -> no breakage
SONAME libcurl.so.4 is stable; no removed symbols/options; enum→long changes are value-identical.
Every runtime dependency (git, rpm, tdnf, PHP, python-pycurl, etc.) continues to link and run without recompilation.
CURLAUTH_DIGEST_IE, CURLOPT_STREAM_DEPENDS(_E) are deprecated but retained (symbols kept, graceful fallback).

NTLM default flipped off (8.20.0)
Removed features are legacy/unused on azl (Secure Transport, BearSSL, Heimdal, wolfSSH, Kerberos-FTP, IE-digest).
The only items needing a spec confirmation are, NTLM default-off, SMB opt-in, and RTMP removal. All easily preserved with %configure flags if any consumer needs them.
NTLM is considered legacy and weak today (Kerberos and modern token auth have largely replaced it), which is why curl 8.20.0 turned it off by default.

Verdict: 0 open CVEs, no ABI removals, build-compatible; only open item is the NTLM enable/keep-off decision.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Kanishk Bansal (Kanishk-Bansal)]

/azurepipelines run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
2 pipeline(s) were filtered out due to trigger conditions.

[Kanishk Bansal (Kanishk-Bansal)]

Dimension	Finding
SONAME	configure.ac sets CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME = "4" → libcurl.so.4, unchanged from 8.11.1. curl hasn't bumped SONAME since 2006.
Symbol version node	Stays CURL_4 (libcurl.vers.in byte-identical to 8.11.1). Map is global: curl_*; local: *; — libcurl only ever adds symbols, never removes/renames (curl's standing ABI/API promise).
Sodiff gate	✅ passed both arches — Azure Linux's authoritative shared-object ABI diff; a removed symbol or SONAME change would fail it. No regression → dependent packages relink cleanly.
Toolchain consumers	✅ Toolchain_tests_{AMD64,ARM64} TestToolchainPackages passed both arches — in-tree consumers (git, cmake, rpm, etc.) build & test green against the new libcurl.
-devel / API	New CURLOPT_*/functions between 8.11→8.21 are additive; existing headers backward-compatible.
Non-ABI (CLI/behavior)	Over 10 releases curl may tweak CLI defaults/options — runtime behavior only, not linkage. Covered by the passing RPM %check + toolchain tests.

[Kanishk Bansal (Kanishk-Bansal)]

no ABI break. A consumer built against 8.11.1's libcurl.so.4 continues to run against 8.21.0's libcurl.so.4.

LGTM, Minor version bump to make package more maintainable.

• Buddy Build
• Tarball uploaded
• Changelog entry
• CG Manifest
• PR has security & CVE-fixed-by-upgrade tag

Recommendation: ABI-safe to merge.

[VijayenderReddyPutta]

Resolved merge conflicts and rebased.

[Kanishk Bansal (Kanishk-Bansal)]

/azurepipelines run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.