[Daniel's week] September 25, 2026

[Daniel Stenberg]

Hello,

Another packed week ends.

## 25 years on Apple

This very day, twenty-five years ago, the first macOS version shipped that 
bundled curl, the command line tool [2].

## security

Now at twenty-two pending vulnerabilities to announce with the next release. I 
don’t think we can manage many more within a single release cycle! Most of 
these need to be backported to older branches for the subsequent related 
Rock-solid curl releases.

## performance

I figured out a neat trick that made the libcurl number parser test [2] run 
more than twice as fast! I also added the build time as a new graph since the 
data is already there anyway and it might be a good idea to keep an eye on it 
so that it doesn’t decay drastically.

I started the performance tests with an idea that I would have ‘markers’ set 
for each data-point so that there would be a fixed comparison metric to help 
us detect and spot really slow trends better. I ditched that concept this week 
since it was just too hard to keep up with and make work. Instead the mean 
value, the 25-round mean and the latest values are the ones I’m going to focus 
on to try to detect when there are developments of note for specific 
data-points.

The performance tests have now been running for 45 days and there are soon 
2,000 builds that contribute to the charts. I will soon add something that 
expires old data to make the site focus only on recent enough runs (maybe the 
most recent 60 days is sufficient?). Right now we can see how annoying it can 
be that we have some many early runs with rather bad performance that tilt the 
mean values badly for a long time. I also started out running the tests three 
times per hour compared to only once per hour now, which helps cause this 
imbalance that will fix itself over time.

## Rock-solid curl

I did a Rock-solid curl webinar on Thursday [3] that explains the reasoning 
and the concept. Now available on YouTube.

## Development

We received a large amount of bug reports from Aisle out of band. These 160 
issues, well explained and many with accompanying patches, are problems they 
have identified while scanning curl for vulnerabilities. They are specifically 
NOT vulnerabilities but many or even most of them are still things we want to 
fix. This week we have been going through the list and are basically 
cherry-picking things we want to fix in the order we feel like with no rush 
and no time frame set for when this work is to be completed. Most of these 
issues are bugs we agree are legitimate and genuine issues and we of course 
want to fix all bugs.

We are at 23 days since the previous release and we have merged at least 166 
bugfixes.

I should also mention that Joshua Rogers (of Aisle) has been contributing a 
lot recently and is now ranked the 4th most frequent commit author in 2026 in 
curl.

## rc2

Just a little off the regular schedule - since I’m traveling tomorrow - we 
shipped curl 8.23.0-rc2 today [4]. The second release candidate of the coming 
release.

Please take this one for a spin in your use case when you have a few minutes 
to spare, to help us verify that there is no silly regression or anything in 
there! Hopefully we can extend our streak of not having shipped any patch 
release (since July 2025) even this time!

## stickers

If you're heading to the OpenSSL conference in Prague Oct 13-15 [5] make sure 
you chase down James Fuller and unload him of a few curl stickers. He's going 
to be our official distributor there. You can have your fix from him. For 
free. You know you need one. Or two.

## coming up

- I am off on vacation next week and will be absent from curl as much as
   possible
- the week I come back I will speak at the Netnod Tech Meeting 2026 in
   Stockholm
- no weekly email from me next week

## Links

[1] = https://curl.se/perf/index.html#numparser
[2] = https://daniel.haxx.se/blog/2026/09/25/25-years-on-apple-computers/
[3] = https://youtu.be/w7-St22V1sA
[4] = https://curl.se/rc/
[5] = https://openssl-conference.org/

-- 

  / daniel.haxx.se