Since 0.24.11 "curl: require version 7.85.0"

[GK-774]

Since 0.24.11 (2026/05/15) mpd requires curl >= 7.85.0.
Most Linux distributions have a lot of stuff linked to the curl libraries (e.g. the package management), so they usually stay on the initial version and backport any fixes. In my case this is version 7.76.1. I changed '>= 7.85' to '>= 7.76' and built 0.24.11 and later 0.24.12 when it was released without any problems. I have this running since the 0.24.12 release now, including radio streams several hours a day, with zero issues. Seems curl 7.76.1 is just working fine for me.

This leads me to the following questions:
What was the reason for requiring curl 7.85.0, which fix(es) were relevant?
What problem(s) can or will arise with using curl 7.76.1?
If there are potential issues, how can I test if my version is affected?

[MaxKellermann]

See 78341dd for an explanation. (TLDR: 7.85.0 fixes a security vulnerability that could be blamed on MPD. You can build with older CURL versions if you want, but then you're 100% responsible.)

[GK-774]

Ok, thanks for the explanation, good to know. And yes, I have no problem to be "100% responsible" as that alleged "attacker" (actually someone I have allowed to use my mpd installation) would be on my local subnet or in other words in my living room.