Roll out cURL 8.12.1

[cmb69]

cURL 8.11.0 has been released, fixing CVE-2024-9681. Given that is a low severity issue, it might not be necessary to update stable branches right away (should wait after GA at least). I've already pushed the update to master, and did quick testing as usual, and found that now Websocket support is enabled by default. Probably not a problem, since that seems to require special support in ext/curl; otherwise I'd be wary to roll it out to stable versions.

Note that nghttp2 1.64.0 is available to be built as prerequisite for the cURL update.

@nielsdos, any thoughts about the update?

[cmb69]

Ah forgot: if we roll 8.11.0 out with Websocket support, we need to apply the following patch to php-src:

 ext/curl/tests/check_win_config.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/curl/tests/check_win_config.phpt b/ext/curl/tests/check_win_config.phpt
index b3beb044a7..8330a95564 100644
--- a/ext/curl/tests/check_win_config.phpt
+++ b/ext/curl/tests/check_win_config.phpt
@@ -54,7 +54,7 @@
 ZSTD => No
 HSTS => Yes
 GSASL => No
-Protocols => dict, file, ftp, ftps, gopher, %r(gophers, )?%rhttp, https, imap, imaps, ldap, ldaps, %r(mqtt, )?%rpop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
+Protocols => dict, file, ftp, ftps, gopher, %r(gophers, )?%rhttp, https, imap, imaps, ldap, ldaps, %r(mqtt, )?%rpop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp%r(, ws, wss)?%r
 Host => %s-pc-win32
 SSL Version => OpenSSL/%s
 ZLib Version => %s

[nielsdos]

Let's wait until after GA and then make sure the next release uses the update.

Ah forgot: if we roll 8.11.0 out with Websocket support, we need to apply the following patch to php-src:

This likely needs to happen anyway for the Linux users who receive the update via their distro.

[cmb69]

Let's wait until after GA and then make sure the next release uses the update.

Fine. I'll keep an eye on it.

This likely needs to happen anyway for the Linux users who receive the update via their distro.

The test is Windows only. :)

[nielsdos]

Fine. I'll keep an eye on it.

Thanks!

The test is Windows only. :)

Ah oops, I missed that. EDIT: duh, it even says win in the title... 🤦

[cmb69]

I guess we want to wait for cURL 8.11.1: https://curl.se/mail/lib-2024-11/0019.html

[cmb69]

I've pushed cURL 8.11.1 (which fixes another low severity vulnerability) to master. Test build showed no further issues.

I suggest to wait with rolling out until PHP GA's have been released (scheduled for Dec 19th), and then first push staging to stable (we're behind with this for a couple of months). Afterwards we can roll out new releases.

[cmb69]

Hmm, that fell through the cracks. :(

Anyway, cURL 8.12.0 has now been released, fixing 3 low severity security issues. We should update to this version right away (well, after the stable PHP versions have been rolled out on 2025-02-13). Besides the test case fix we would possibly have needed to fix (#25 (comment)), we now also need php/php-src#17709 (or something like that).

I've pushed and tagged the update, made test builds (requires https://github.com/winlibs/winlib-builder/tree/curl/winbuild-deprecation; need to check whether this can be used for older cURL versions; need to update to the CMake build chain soonish anyway), and didn't find any further issues when testing locally.

[cmb69]

need to check whether this can be used for older cURL versions

Yep. https://github.com/winlibs/winlib-builder/actions/runs/13160583314. I've pushed the fix.

[cmb69]

need to update to the CMake build chain soonish

A start: winlibs/winlib-builder#40

[nono303]

Hi @here,
I did some test with curl 8.12 + php 8.4 and have some issue:
see. curl/curl#16216 (comment)

[cmb69]

@nono303, please don't ping random people. :)

Anyway, I've seen your cURL bug report, but for now that is not an issue for "official" PHP builds, since we don't use c-ares (maybe we should in the future).

[nono303]

(Ooops for here 😬)
However, curl 8.12 seems to introduce some {change / regression / bugs}? on my tests, independently of c-ares but most globally related on DNS as RR (experimental) seems to be part of the root cause.
for the moment, not clear at all for me I'll continue digging.

[nono303]

sleeping on the issue and coming to the right conclusion 😉

1. There is a curl bug on 8.12 when compiling on windows with USE_HTTPSRR=OFF Curl 8.12 access violation with c-ares when HTTPS-RR enabled curl/curl#16216 (comment)
2. curl_setopt_array() is buggy when setting an option return false curl_setopt_array() not properly honoured when using CURLOPT_DNS_SERVERS php/php-src#17610 (comment)
3. CURLOPT_DNS_SERVERS only works when curl is compiled with ENABLE_ARES=ON and ENABLE_THREADED_RESOLVER=OFF curl_setopt_array() not properly honoured when using CURLOPT_DNS_SERVERS php/php-src#17610 (comment)

This being so (in point point of view), it would be interesting to provide curl lib with c-ares implemented (and thread resolver disabled) to enable CURLOPT_DNS_SERVERS

[cmb69]

See https://curl.se/mail/lib-2025-02/0017.html

[Jan-E]

Curl 8.12.1 will be released on Thursday Feb 13th.

[cmb69]

Curl 8.12.1 will be released on Thursday Feb 13th.

Right, that's the plan.

[cmb69]

I've updated to cURL 8.12.1 and tagged it. A test build for PHP 8.4 didn't show any issues for me locally (besides #25 (comment)).

@shivammathur, can you please roll out the new version?

[shivammathur]

@cmb69 Done.

[nono303]

I've updated to cURL 8.12.1 and tagged it. A test build for PHP 8.4 didn't show any issues for me locally

Same for me for curl 8.12.1 since yesterday.
all my tests and usages sounds good with php 8.4.4