From 50ca1f4a6af9fe950bd4edfbf0c61da4b1c7b49d Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 30 Apr 2026 06:47:46 +0200 Subject: [PATCH] package/libcurl: security bump to version 8.20.0 https://curl.se/ch/8.20.0.html https://curl.se/docs/security.html Fixes the following CVEs: https://curl.se/docs/CVE-2026-7168.html https://curl.se/docs/CVE-2026-7009.html https://curl.se/docs/CVE-2026-6429.html https://curl.se/docs/CVE-2026-6276.html https://curl.se/docs/CVE-2026-6253.html https://curl.se/docs/CVE-2026-5773.html https://curl.se/docs/CVE-2026-5545.html https://curl.se/docs/CVE-2026-4873.html Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain (cherry picked from commit 8940fae6070eb064042b9e54b862523cc1b8d6bc) Signed-off-by: Thomas Perale --- package/libcurl/libcurl.hash | 6 +++--- package/libcurl/libcurl.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/libcurl/libcurl.hash b/package/libcurl/libcurl.hash index ad34083745..549527b1af 100644 --- a/package/libcurl/libcurl.hash +++ b/package/libcurl/libcurl.hash @@ -1,7 +1,7 @@ -# From https://github.com/curl/curl/releases/tag/curl-8_19_0 +# From https://github.com/curl/curl/releases/tag/curl-8_20_0 # after checking pgp signature: -# https://curl.se/download/curl-8.19.0.tar.xz.asc +# https://curl.se/download/curl-8.20.0.tar.xz.asc # signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2 -sha256 4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d333f11df curl-8.19.0.tar.xz +sha256 63fe2dc148ba0ceae89922ef838f7e5c946272c2e78b7c59fab4b79d3ce2b896 curl-8.20.0.tar.xz # Locally computed sha256 82f2f4427d6545ee5aaac4f0b80428da6cc8ba41c2cf5da3a03680ec327b9681 COPYING diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk index 2fddfcb379..ac233fd939 100644 --- a/package/libcurl/libcurl.mk +++ b/package/libcurl/libcurl.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBCURL_VERSION = 8.19.0 +LIBCURL_VERSION = 8.20.0 LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz LIBCURL_SITE = https://curl.se/download LIBCURL_DEPENDENCIES = host-pkgconf \