[ptxdist] [PATCH 1/2] libcurl: Version bump. 8.18.0 -> 8.19.0

[ptxdist] [PATCH 1/2] libcurl: Version bump. 8.18.0 -> 8.19.0

[Christian Melki]

Mostly bugfixes.
https://curl.se/changes.html#8_19_0

Plugs CVEs:
CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection

* License hash changed. Year updates.

* Fix new and removed build options.

Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
 rules/libcurl.make | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/rules/libcurl.make b/rules/libcurl.make
index 62d9a8ccb..d15ea064f 100644
--- a/rules/libcurl.make
+++ b/rules/libcurl.make
@@ -15,15 +15,15 @@ PACKAGES-$(PTXCONF_LIBCURL) += libcurl
 #
 # Paths and names
 #
-LIBCURL_VERSION	:= 8.18.0
-LIBCURL_MD5	:= dae6088bf7af69d3b0a87c762de92248
+LIBCURL_VERSION	:= 8.19.0
+LIBCURL_MD5	:= d5d3581ba4b4df1140a26a6efcf13e61
 LIBCURL		:= curl-$(LIBCURL_VERSION)
 LIBCURL_SUFFIX	:= tar.xz
 LIBCURL_URL	:= https://curl.se/download/$(LIBCURL).$(LIBCURL_SUFFIX)
 LIBCURL_SOURCE	:= $(SRCDIR)/$(LIBCURL).$(LIBCURL_SUFFIX)
 LIBCURL_DIR	:= $(BUILDDIR)/$(LIBCURL)
 LIBCURL_LICENSE	:= curl
-LIBCURL_LICENSE_FILES := file://COPYING;md5=72f4e9890e99e68d77b7e40703d789b8
+LIBCURL_LICENSE_FILES := file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc
 
 # ----------------------------------------------------------------------------
 # Prepare
@@ -39,7 +39,6 @@ LIBCURL_CONF_OPT	:= \
 	--enable-optimize \
 	--disable-warnings \
 	--disable-werror \
-	--disable-curldebug \
 	--enable-symbol-hiding \
 	--$(call ptx/endis, PTXCONF_LIBCURL_C_ARES)-ares \
 	--enable-rt \
@@ -110,6 +109,7 @@ LIBCURL_CONF_OPT	:= \
 	--without-mbedtls \
 	--without-wolfssl \
 	--without-rustls \
+	--without-apple-sectrust \
 	--with-zlib=$(SYSROOT) \
 	--without-brotli \
 	--without-zstd \
@@ -128,7 +128,6 @@ LIBCURL_CONF_OPT	:= \
 	--without-libidn2 \
 	--without-nghttp2 \
 	--without-ngtcp2 \
-	--without-openssl-quic \
 	--without-nghttp3 \
 	--without-quiche \
 	--without-zsh-functions-dir \
-- 
2.43.0

[ptxdist] [PATCH 2/2] host-libcurl: Follow target libcurl bump 8.18.0 -> 8.19.0

[Christian Melki]

Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
 rules/host-libcurl.make | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/host-libcurl.make b/rules/host-libcurl.make
index 132caadf2..82ea79077 100644
--- a/rules/host-libcurl.make
+++ b/rules/host-libcurl.make
@@ -25,7 +25,6 @@ HOST_LIBCURL_CONF_OPT	:= \
 	--enable-optimize \
 	--disable-warnings \
 	--disable-werror \
-	--disable-curldebug \
 	--enable-symbol-hiding \
 	--disable-ares \
 	--enable-rt \
@@ -94,6 +93,7 @@ HOST_LIBCURL_CONF_OPT	:= \
 	--without-mbedtls \
 	--without-wolfssl \
 	--without-rustls \
+	--without-apple-sectrust \
 	--without-zlib \
 	--without-brotli \
 	--without-zstd \
-- 
2.43.0