[24.11] curl: 8.11.1 -> 8.12.0

[mrkline]

Backports #379541

https://github.com/curl/curl/releases/tag/curl-8_12_0
https://curl.se/ch/8.12.0.html

Fixes Basic HTTP auth via netrc:
curl/curl#15767

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[vcunat]

CVE-2025-0665 is not fixed by this PR, I believe. That's the patch you're removing.

[mrkline]

Sorry, I don't follow - this is straight cherry-pick of #379541, and the bump to 8.12 fixes that CVE: https://curl.se/docs/CVE-2025-0665.html

[vcunat]

Yes, It's wrong described in the original PR. We were applying patch for that CVE. This PR removes that patch and uses a release that contains the same patch. In other words, we had the CVE fix some time ago already, so it's confusing to say that this PR fixes it.

[mrkline]

I'm happy to change the commit message if you'd like me to! My understanding was it was good form for backport PRs to not alter commit messages much when you cherry-pick.

The more pressing reason to backport the 8.11.1 -> 8.12 bump is to fix curl/curl#15767, which breaks everything that uses Basic HTTP auth via netrc. (e.g., Cachix, which has been busted on 24.11 since the 8.11.1 bump in December.)

[mrkline]

I've removed the confusing mentions of the specific CVEs from the commit message. Let me know if there's anything else I should do.