curl Ships Three Rock-solid Patch Branches: Recheck Proxy Client Version Policy

curl's official version history now lists three Rock-solid curl releases dated September 7, 2026: 8.14.2, 8.16.1 and 8.20.1. The same page lists 8.18.2 on September 2. These are long-term support releases managed separately for paying customers and branched from earlier standard curl versions. The current public release remains curl and libcurl 8.22.0, released September 2.

That distinction matters for proxy client fleets. A patch-looking version is not automatically the next public curl release, and the highest visible number is not automatically the right production branch. Teams need to identify where a build came from, which features and fixes it includes, who maintains it and how its proxy behavior was tested.

The curl project does not publish detailed contents for every commercial branch on its public version table. Do not infer a specific security or proxy fix merely from a new patch number.

Separate public releases from supported branches

Maintain two explicit concepts in the asset inventory:

• Upstream public line: the publicly released curl and libcurl version, its documented changes and the distribution or vendor package built from it.
• Supported branch: a separately maintained branch with a defined support agreement, backport policy, delivery channel and escalation path.

Rock-solid versions use numbers that were not used by the freely available release line. A deployment report that says only “curl 8.20.1” is incomplete. It should also state the supplier, package identity, build provenance and applicable support contract.

Inventory the real runtime, not the intended package

Proxy applications often load a different libcurl from the curl command found in the shell. Containers, language bindings, embedded agents and operating-system tools can each ship their own build.

For every workload, capture:

workload_alias
binary_or_library_path
curl_version
libcurl_version
package_supplier
package_digest
branch_type
build_date
tls_backend
resolver_backend
enabled_protocols
enabled_features
architecture
operating_system
support_owner
rollback_artifact

Record the output of the actual process in a controlled inventory job. Do not assume a base image update changed every statically linked binary or bundled dependency.

Decide what the branch is meant to optimize

A current public release and a maintained older branch solve different operational problems. Write the decision criteria before selecting either:

• need for recently added public features;
• tolerance for behavior changes and regressions;
• requirement for backported fixes on a pinned baseline;
• availability of vendor support and response targets;
• operating-system and TLS-backend compatibility;
• compliance evidence and software-bill-of-materials needs;
• upgrade frequency and maintenance-window constraints;
• ability to run a representative proxy canary.

A support contract does not replace testing. A recent public release is not automatically risky. The correct choice depends on documented product requirements and evidence from the fleet's actual routes.

Build a proxy regression matrix by capability

Use endpoints and accounts you own or are explicitly authorized to test. Cover the features the workload actually uses:

Do not enable every protocol merely because the build supports it. Reduce the test and production surface to the approved workload.

Compare branch behavior with one-variable canaries

Run the incumbent and candidate builds against the same fixture and proxy route. Keep method, headers, body, credentials, market, DNS mode, address family and concurrency fixed.

Capture a sanitized row per attempt:

trial_id
branch_alias
client_build_digest
proxy_route_alias
protocol
dns_mode
address_family
requested_market
observed_market
proxy_auth_result
proxy_tls_result
destination_tls_result
http_version
status_code
response_digest
failure_phase
attempt_count
time_to_useful_result_ms

Classify first-attempt results separately from final results after retry. Otherwise a candidate that creates more resets or authentication retries can appear healthy while increasing latency, bandwidth and provider cost.

Pay special attention to build-dependent behavior

The same version number can behave differently when compiled with different TLS, resolver, compression, HTTP/2, HTTP/3 or SSH backends. Package maintainers can also apply downstream patches.

Your release gate should therefore compare:

• complete version and feature output;
• linked TLS backend and CA-store behavior;
• asynchronous versus threaded resolver behavior;
• HTTP/2 and HTTP/3 availability;
• supported proxy protocols and authentication methods;
• native CA integration;
• runtime configuration and environment variables;
• package and container digests.

If two clients have the same curl label but different feature sets, treat them as different release artifacts.

Validate proxy authentication and connection reuse

Authentication regressions can appear only after reuse, challenge negotiation or a route switch. Test:

1. first request on a fresh connection;
2. second request on the same connection;
3. new destination through the same proxy pool;
4. credential rotation in a controlled environment;
5. failed authentication followed by a valid credential;
6. multiple workers using separate session aliases;
7. cancellation and retry near a challenge response.

Verify that credentials never cross workloads, destinations or customer sessions. Store only redacted method and outcome fields; never store passwords or complete authorization headers.

Stage rollout by route, not only by host count

A ten-percent host canary can still miss a protocol or market used by only one workload. Stage the candidate across dimensions:

1. deterministic lab fixtures;
2. one route from each required proxy class;
3. one approved market in each operating region;
4. low-risk read-only workloads;
5. representative concurrency and connection reuse;
6. broader production traffic after the observation window.

Keep the incumbent artifact available. Roll back on destination or proxy TLS failures, authentication drift, response-integrity mismatch, unexpected market changes, retry amplification, handle leaks or tail-latency regression.

Procurement questions for a supported branch

Before adopting a commercially maintained branch, ask the supplier:

• Which upstream baseline and downstream patches are included?
• Which operating systems, architectures and TLS backends are covered?
• How are security and correctness fixes selected for backporting?
• What is the delivery and authenticity-verification process?
• How are release notes and software bills of materials provided?
• What proxy protocols and authentication combinations are tested?
• How long is the branch maintained?
• What are the support and incident-response targets?
• What happens when the branch reaches end of support?
• Can the supplier support a staged migration to another line?

Record answers in the dependency register. “Long-term support” has value only when the scope, owner and exit plan are explicit.

Acceptance checklist

• [ ] Public release and supported branch are labeled separately.
• [ ] Supplier, package, digest and support owner are recorded.
• [ ] Actual loaded libcurl is inventoried for every workload.
• [ ] Build features and TLS/resolver backends are captured.
• [ ] Direct and proxy canaries use deterministic authorized fixtures.
• [ ] HTTP, HTTPS proxy, CONNECT and SOCKS5 paths in use are tested.
• [ ] DNS, IPv4, IPv6 and required markets are asserted.
• [ ] Authentication and connection reuse show no credential bleed.
• [ ] Response digest and semantic completion pass.
• [ ] First-attempt failures remain visible after retries.
• [ ] Canary coverage is segmented by route and workload.
• [ ] Rollback artifact and end-of-support plan are ready.

FAQ

Is Rock-solid curl the new public curl release?

No. curl describes Rock-solid releases as separately managed long-term support versions for paying customers. The public curl and libcurl release line has its own version history.

Does 8.20.1 contain everything in public 8.22.0?

Do not assume that from the number. It is a patch release on a separately maintained branch. Use supplier release information and an inventory of required features and fixes.

Should a proxy fleet always choose long-term support?

No universal answer exists. Evaluate feature needs, backport policy, operational risk, support obligations, cost and canary evidence.

Can curl --version prove which library an application uses?

It proves the command's build, not necessarily the library loaded by another application. Inspect the actual runtime, package and dependency path.

What is the safest first production test?

A read-only, deterministic request through one approved route per required proxy class, with strict response-integrity, identity, market and retry assertions.

Compliance and safe operation

Use only authorized proxy services, destinations, accounts and markets. Respect access controls, rate limits, privacy requirements and software license and support terms. Verify package authenticity through the approved delivery process, protect credentials and do not use route rotation to conceal policy or trust failures.

Continue with the HTTPS proxy TLS chain audit, Node.js proxy-client canary plan, and proxy idle-timeout test.

Source note: curl project, Version Numbers and Releases, reviewed September 13, 2026; curl project, Releases and Downloads, reviewed September 13, 2026; curl project, Commercial Support, reviewed September 13, 2026.