[New curl version] 8.10.0

[github-actions]

https://github.com/curl/curl/releases/tag/curl-8_10_0

[rimrul]

/open pr

The MSYS workflow run was started

The MINGW workflow run was started

[dscho]

Looks like the only security-relevant change is the fix for CVE-2024-8096, which does not affect us because it is relevant to GnuTLS backends only, and we do not ship any libcurl binaries with that backend.

[dscho]

/add relnote

The workflow run was started

[rimrul]

Looks like curl/curl#14895 is relevant to Gits HTTP 2 code.

[dscho]

Looks like curl/curl#14895 is relevant to Gits HTTP 2 code.

Do you know of any easy way to test this?

[PhilipOakley]

Do you know of any easy way to test this?

there's some clues in the discussion https://lore.kernel.org/git/ZuPKvYP9ZZ2mhb4m@pks.im/

[dscho]

Do you know of any easy way to test this?

there's some clues in the discussion https://lore.kernel.org/git/ZuPKvYP9ZZ2mhb4m@pks.im/

Thank you! I haven't been able to pay attention to the Git mailing list lately. If I read this correctly, then we'll get CI failures in t5559 with the new cURL version? (But then, our shears/* CI builds are all broken now, before even reaching the test suite...)

[dscho]

If I read this correctly, then we'll get CI failures in t5559 with the new cURL version?

But of course we'll only get them when we actually exercise the tests, which we don't, because they require an Apache server :-(

So I tried to reproduce according to this nutshell description, using a current minimal SDK (which has the current libcurl), but no dice, it works:

usr\bin\bash.exe -lc "git -c http.version=HTTP/2 -c http.postbuffer=65536 clone --bare https://github.com/git/git git.git"

The good news is that we don't need to do much of anything until September 18th, when a new cURL version is planned.

[dscho]

The good news is that we don't need to do much of anything until September 18th, when a new cURL version is planned.

The not-so-good news is that Git v2.46.1 was released in the meantime, and the corresponding Git for Windows release will have to wait :-(