[PATCH] curl: upgrade 8.21.0 -> 8.22.0

[PATCH] curl: upgrade 8.21.0 -> 8.22.0

[Jaipaul Cheernam]

CVE fixed in 8.22.0: Info gathered from [1] based First and Last

  CVE-2026-13608
  CVE-2026-18924
  CVE-2026-19931
  CVE-2026-80229
  CVE-2026-80230
  CVE-2026-80231
  CVE-2026-80255
  CVE-2026-82208
  CVE-2026-82209

[1] https://curl.se/docs/vuln-8.21.0.html

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/recipes-support/curl/curl/no-test-timeout.patch      | 8 ++++----
 .../curl/{curl_8.21.0.bb => curl_8.22.0.bb}               | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename meta/recipes-support/curl/{curl_8.21.0.bb => curl_8.22.0.bb} (98%)

diff --git a/meta/recipes-support/curl/curl/no-test-timeout.patch b/meta/recipes-support/curl/curl/no-test-timeout.patch
index f432279728..93c2627bdd 100644
--- a/meta/recipes-support/curl/curl/no-test-timeout.patch
+++ b/meta/recipes-support/curl/curl/no-test-timeout.patch
@@ -1,4 +1,4 @@
-From 30fb6d1ce4cc721feef5665934f2b7f83fb50efb Mon Sep 17 00:00:00 2001
+From 4bc84380d2d0d85ed5a57cf9f78286531a19de48 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@arm.com>
 Date: Fri, 15 Mar 2024 14:37:37 +0000
 Subject: [PATCH] Set the max-time timeout to 600 so the timeout is 10 minutes
@@ -12,15 +12,15 @@ Signed-off-by: Ross Burton <ross.burton@arm.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/servers.pm b/tests/servers.pm
-index 5d5d98b..442cfaf 100644
+index 99db988..81a7572 100644
 --- a/tests/servers.pm
 +++ b/tests/servers.pm
-@@ -124,7 +124,7 @@
+@@ -123,7 +123,7 @@ my $sshdverstr;    # for socks server, ssh daemon version string
  my $sshderror;     # for socks server, ssh daemon version error
  my %doesntrun;     # servers that do not work, identified by pidfile
  my %PORT = (nolisten => 47); # port we use for a local non-listening service
 -my $server_response_maxtime = 13;
 +my $server_response_maxtime = 600;
- my $httptlssrv = find_httptlssrv();
  my %run;           # running server
  my %runcert;       # cert file currently in use by an SSL running server
+ my $CLIENTIP = "127.0.0.1";  # address which curl uses for incoming connections
diff --git a/meta/recipes-support/curl/curl_8.21.0.bb b/meta/recipes-support/curl/curl_8.22.0.bb
similarity index 98%
rename from meta/recipes-support/curl/curl_8.21.0.bb
rename to meta/recipes-support/curl/curl_8.22.0.bb
index e8c024d18a..ad3e6b728f 100644
--- a/meta/recipes-support/curl/curl_8.21.0.bb
+++ b/meta/recipes-support/curl/curl_8.22.0.bb
@@ -20,7 +20,7 @@ SRC_URI:append:class-nativesdk = " \
     file://environment.d-curl.sh \
 "
 
-SRC_URI[sha256sum] = "aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6"
+SRC_URI[sha256sum] = "f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7"
 
 # Curl has used many names over the years...
 CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"

[PATCH v2] curl: upgrade 8.21.0 -> 8.22.0

[Jaipaul Cheernam]

ChangeInfo: https://curl.se/ch/8.22.0.html

CVE fixed in 8.22.0: Info gathered from [1] based First and Last

  CVE-2026-13608
  CVE-2026-18924
  CVE-2026-19931
  CVE-2026-80229
  CVE-2026-80230
  CVE-2026-80231
  CVE-2026-80255
  CVE-2026-82208
  CVE-2026-82209

[1] https://curl.se/docs/vuln-8.21.0.html

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
Changes since v1:
- Added ChangeLog URL for 8.22.0 (https://curl.se/ch/8.22.0.html)

 meta/recipes-support/curl/curl/no-test-timeout.patch      | 8 ++++----
 .../curl/{curl_8.21.0.bb => curl_8.22.0.bb}               | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename meta/recipes-support/curl/{curl_8.21.0.bb => curl_8.22.0.bb} (98%)

diff --git a/meta/recipes-support/curl/curl/no-test-timeout.patch b/meta/recipes-support/curl/curl/no-test-timeout.patch
index f432279728..93c2627bdd 100644
--- a/meta/recipes-support/curl/curl/no-test-timeout.patch
+++ b/meta/recipes-support/curl/curl/no-test-timeout.patch
@@ -1,4 +1,4 @@
-From 30fb6d1ce4cc721feef5665934f2b7f83fb50efb Mon Sep 17 00:00:00 2001
+From 4bc84380d2d0d85ed5a57cf9f78286531a19de48 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@arm.com>
 Date: Fri, 15 Mar 2024 14:37:37 +0000
 Subject: [PATCH] Set the max-time timeout to 600 so the timeout is 10 minutes
@@ -12,15 +12,15 @@ Signed-off-by: Ross Burton <ross.burton@arm.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/servers.pm b/tests/servers.pm
-index 5d5d98b..442cfaf 100644
+index 99db988..81a7572 100644
 --- a/tests/servers.pm
 +++ b/tests/servers.pm
-@@ -124,7 +124,7 @@
+@@ -123,7 +123,7 @@ my $sshdverstr;    # for socks server, ssh daemon version string
  my $sshderror;     # for socks server, ssh daemon version error
  my %doesntrun;     # servers that do not work, identified by pidfile
  my %PORT = (nolisten => 47); # port we use for a local non-listening service
 -my $server_response_maxtime = 13;
 +my $server_response_maxtime = 600;
- my $httptlssrv = find_httptlssrv();
  my %run;           # running server
  my %runcert;       # cert file currently in use by an SSL running server
+ my $CLIENTIP = "127.0.0.1";  # address which curl uses for incoming connections
diff --git a/meta/recipes-support/curl/curl_8.21.0.bb b/meta/recipes-support/curl/curl_8.22.0.bb
similarity index 98%
rename from meta/recipes-support/curl/curl_8.21.0.bb
rename to meta/recipes-support/curl/curl_8.22.0.bb
index e8c024d18a..ad3e6b728f 100644
--- a/meta/recipes-support/curl/curl_8.21.0.bb
+++ b/meta/recipes-support/curl/curl_8.22.0.bb
@@ -20,7 +20,7 @@ SRC_URI:append:class-nativesdk = " \
     file://environment.d-curl.sh \
 "
 
-SRC_URI[sha256sum] = "aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6"
+SRC_URI[sha256sum] = "f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7"
 
 # Curl has used many names over the years...
 CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"

Re: [PATCH] curl: upgrade 8.21.0 -> 8.22.0

[Jaipaul Cheernam]

[-- Attachment #1: Type: text/plain, Size: 75 bytes --]

Please ignore forgot to include ChangeLog URL and sent V2 with that info.

[-- Attachment #2: Type: text/html, Size: 92 bytes --]