chore/cpp libcurl 8.23

CLAUDE.md

@@ -150,8 +150,9 @@ Do not use `gh cache delete --all`: it also removes the entries the current poli
     the newest ConanCenter version; stale transitive pins are lifted with `override=True` in the
     conanfile (fmt, lz4, util-linux-libuuid, jsoncpp). Held back: abseil 20260107.1 (protobuf 6.33.5),
     protobuf 6.33.5 (grpc is below 7), opentelemetry-proto 1.7.0 (opentelemetry-cpp), taocpp-pegtl 3.2.8
-    (cppgraphqlgen needs 3.x), lua 5.4.8 (sol2), librdkafka 2.14.2 and opentelemetry-cpp 1.26.0 (ConanCenter
-    behind upstream). flex and bison get `MAKEINFO=true` through a scoped Conan conf, not a fake binary.
+    (cppgraphqlgen needs 3.x), lua 5.4.8 (sol2), openssl 3.6.x (drogon needs <4), and, with ConanCenter behind
+    upstream, librdkafka 2.14.2 (2.16.0), opentelemetry-cpp 1.26.0 (1.29.0), drogon 1.9.13 (1.9.14) and trantor
+    1.5.28 (1.5.29). Last checked 2026-10-15: libcurl moved to 8.23.0; nothing else in range changed. flex and bison get `MAKEINFO=true` through a scoped Conan conf, not a fake binary.
     The Conan cache mount id is `cndp-conan2`; CI persists it with buildkit-cache-dance.
   - ⚠️ Reconcile: the r76 outbox codetab in `_docs/05-event-driven.md` used `pqxx` for
     brevity; it now shows libpq, as the example does.

_plans/modernization-plan.md

@@ -236,6 +236,7 @@ Final Opus recheck (2026-10-11): go. Go and C++ traces verified end to end in Te
 - Transitive refresh: every `conan.lock` is regenerated with `conan lock create --update` (no lockfile in, GCC 15, C++23, Release, static), so transitive packages take the newest ConanCenter version in range: openssl 3.6.3 to 3.6.5, libcurl 8.21.0 to 8.22.0 (26 also pins it directly), cmake tool 4.4.0 to 4.4.4. Overrides in each `conanfile.py` (`override=True`, build and ctest proven on all 31 images): fmt 12.1.0 to 12.2.0 (spdlog), lz4 1.9.4 to 1.10.0 (librdkafka, libpq), util-linux-libuuid 2.39.2 to 2.41.2 and jsoncpp 1.9.5 to 1.9.8 (drogon). None had to be dropped. The schemagen stage of 02 and 03 has its own `schemagen.lock` (boost 1.90.0 to 1.91.0; boost 1.91 builds boost_regex whatever `without_regex` says and its recipe rejects an unused built library, so regex is no longer disabled there).
 - Corrections to earlier claims: openssl is not capped at 3.6.3 (3.6.5 is current in the 3.6 line; only the 4.x line is outside drogon's `<4` range), libcurl is 8.22.0 (not 8.21.0), and jsoncpp is 1.9.8 everywhere (the locks held 1.9.5 transitively until the override).
 - Held versions (legitimate, with the reason): abseil 20260107.1 (protobuf 6.33.5 caps it), protobuf 6.33.5 (grpc 1.84.0 requires protobuf below 7; 7.36.2 exists), opentelemetry-proto 1.7.0 (required as a tool by opentelemetry-cpp 1.26.0), taocpp-pegtl 3.2.8 (cppgraphqlgen 4.5.9 needs the 3.x API; 4.x is newer), lua 5.4.8 (sol2's recipe pins 5.4.x; 5.5.0 is newer), openssl 3.6.x (drogon and trantor accept `<4`; 4.0.3 is newer), librdkafka 2.14.2 (upstream 2.16.0) and opentelemetry-cpp 1.26.0 (upstream 1.29.0), both ConanCenter behind upstream.
+- ConanCenter re-check (2026-10-15): every lock regenerated with `conan lock create . --lockfile="" --update` (an existing `conan.lock` in the directory is loaded by default, which pins everything). Only libcurl moved, 8.22.0 to 8.23.0, in 7 locks (01; 05 order, notification, shipping; 11 order, inventory, notification), verified 01, 05 and 11 C++ PASS. Recipe constraints re-read: grpc 1.84.0 needs protobuf <7; protobuf 6.33.5 caps abseil at 20260107.1 (20260526.0 exists); opentelemetry-cpp 1.26.0 tool-requires opentelemetry-proto 1.7.0 exactly (1.9.0 exists); sol2 requires lua 5.4.x (5.5.0 exists). New upstream gaps: drogon 1.9.14 and trantor 1.5.29 (ConanCenter 1.9.13 and 1.5.28); librdkafka 2.16.0 and opentelemetry-cpp 1.29.0 are still not on ConanCenter.
 - Build tooling: flex and bison (libpq build tools) ran makeinfo; the fake `makeinfo` binary is gone, replaced by scoped `-c:a 'flex/*:tools.gnu:extra_configure_args=["MAKEINFO=true"]'` (and bison) in the 14 projects whose lock contains flex. The Conan cache mount has an explicit `id=cndp-conan2`.
 - CI (cpp job): the Conan cache mount does not persist across jobs, and a cold build of the largest projects takes about 33 minutes on 4 CPUs (55-75 minutes estimated on a hosted runner). The job restores a `conan-cache` directory with actions/cache (key: runner OS, UBI 10.2, GCC 15, Conan 2.33.0, `hashFiles` of the project's `conan.lock`; restore-key on the toolchain) and injects it into the `cndp-conan2` mount with buildkit-cache-dance v3.4.0 (`cache-map`, extraction skipped on an exact hit). Image layers use `type=gha,mode=min` (`mode=max` across 31 scopes would exceed the 10 GB quota); the timeout is 120 minutes. Open risk: 31 projects can still exceed 10 GB of Conan cache and evict each other, which the toolchain restore-key softens.
 - Repair rounds (after the first build): Lua sandbox swallowing limit errors (22); hand-escaped or concatenated SQL and an unprotected shared connection (25, 03, 04); Kafka delivery reports awaited before replying 201, with 503 on failure (05, 06, 11, 24); notification insert retry and SQLSTATE duplicate detection (11); OTLP exporters in the 11 inventory service and the W3C propagator in the Go inventory service so the inventory span lands in the order's trace (11); range-checked decimal sums and non-zero exit on delivery failure in the stream processor (06); every libpq result released and checked, unknown saga status rejected (17); the alg=none test token differing from a valid one only by algorithm (12). First live run: 18/18 C++ PASS.

examples/01-cloud-native-principles/cpp/conan.lock

@@ -11,7 +11,7 @@
         "nlohmann_json/3.12.0#2d634ab0ec8d9f56353e5ccef6d6612c%1744735883.94",
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
         "libpq/17.11#6161d3be84f5d2bd657dd778eed017c2%1788252336.346",
-        "libcurl/8.22.0#3599f8564660d38f96af52da40795734%1789660092.861",
+        "libcurl/8.23.0#7143b4a20e3c91fe0bc46f298ae5e509%1792054159.656",
         "jsoncpp/1.9.8#5be5e85394fc94f13f6451e5822ea759%1787912339.522",
         "fmt/12.2.0#b445244e6d0151a425e229248cd2bed8%1785754552.386",
         "drogon/1.9.13#251680a44562cf10050d53c0259876d5%1778471907.643",

examples/05-event-driven/cpp/notification-consumer/conan.lock

@@ -10,7 +10,7 @@
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
         "librdkafka/2.14.2#ebe1ce610f423ebe1dbfd52756b98db8%1781073238.939",
         "libpq/17.11#6161d3be84f5d2bd657dd778eed017c2%1788252336.346",
-        "libcurl/8.22.0#3599f8564660d38f96af52da40795734%1789660092.861",
+        "libcurl/8.23.0#7143b4a20e3c91fe0bc46f298ae5e509%1792054159.656",
         "jsoncpp/1.9.8#5be5e85394fc94f13f6451e5822ea759%1787912339.522",
         "fmt/12.2.0#b445244e6d0151a425e229248cd2bed8%1785754552.386",
         "abseil/20260107.1#883e95a7be2b767999f64669ac642e5d%1773137897.755"

examples/05-event-driven/cpp/order-service/conan.lock

@@ -12,7 +12,7 @@
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
         "librdkafka/2.14.2#ebe1ce610f423ebe1dbfd52756b98db8%1781073238.939",
         "libpq/17.11#6161d3be84f5d2bd657dd778eed017c2%1788252336.346",
-        "libcurl/8.22.0#3599f8564660d38f96af52da40795734%1789660092.861",
+        "libcurl/8.23.0#7143b4a20e3c91fe0bc46f298ae5e509%1792054159.656",
         "jsoncpp/1.9.8#5be5e85394fc94f13f6451e5822ea759%1787912339.522",
         "fmt/12.2.0#b445244e6d0151a425e229248cd2bed8%1785754552.386",
         "drogon/1.9.13#251680a44562cf10050d53c0259876d5%1778471907.643",

examples/05-event-driven/cpp/shipping-consumer/conan.lock

@@ -10,7 +10,7 @@
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
         "librdkafka/2.14.2#ebe1ce610f423ebe1dbfd52756b98db8%1781073238.939",
         "libpq/17.11#6161d3be84f5d2bd657dd778eed017c2%1788252336.346",
-        "libcurl/8.22.0#3599f8564660d38f96af52da40795734%1789660092.861",
+        "libcurl/8.23.0#7143b4a20e3c91fe0bc46f298ae5e509%1792054159.656",
         "jsoncpp/1.9.8#5be5e85394fc94f13f6451e5822ea759%1787912339.522",
         "fmt/12.2.0#b445244e6d0151a425e229248cd2bed8%1785754552.386",
         "abseil/20260107.1#883e95a7be2b767999f64669ac642e5d%1773137897.755"

examples/11-observability/cpp/inventory-service/conan.lock

@@ -8,7 +8,7 @@
         "opentelemetry-cpp/1.26.0#000b96632e39f3672f8576bf4febb213%1789030194.301",
         "openssl/3.6.5#3c1311f37543e7140f33fe5989f315c2%1790692982.113",
         "nlohmann_json/3.12.0#2d634ab0ec8d9f56353e5ccef6d6612c%1744735883.94",
-        "libcurl/8.22.0#3599f8564660d38f96af52da40795734%1789660092.861",
+        "libcurl/8.23.0#7143b4a20e3c91fe0bc46f298ae5e509%1792054159.656",
         "grpc/1.84.0#c7c2ff9ed88b66eac8b8399c96d8df2c%1789729270.871",
         "fmt/12.2.0#b445244e6d0151a425e229248cd2bed8%1785754552.386",
         "c-ares/1.34.8#074b97a9e38159813ed5e2dcfeb290ca%1784539118.141",

examples/11-observability/cpp/notification-consumer/conan.lock

@@ -10,7 +10,7 @@
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
         "librdkafka/2.14.2#ebe1ce610f423ebe1dbfd52756b98db8%1781073238.939",
         "libpq/17.11#6161d3be84f5d2bd657dd778eed017c2%1788252336.346",
-        "libcurl/8.22.0#3599f8564660d38f96af52da40795734%1789660092.861",
+        "libcurl/8.23.0#7143b4a20e3c91fe0bc46f298ae5e509%1792054159.656",
         "fmt/12.2.0#b445244e6d0151a425e229248cd2bed8%1785754552.386",
         "abseil/20260107.1#883e95a7be2b767999f64669ac642e5d%1773137897.755"
     ],

examples/11-observability/cpp/order-service/conan.lock

@@ -13,7 +13,7 @@
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1775037240.923",
         "librdkafka/2.14.2#ebe1ce610f423ebe1dbfd52756b98db8%1781073238.939",
         "libpq/17.11#6161d3be84f5d2bd657dd778eed017c2%1788252336.346",
-        "libcurl/8.22.0#3599f8564660d38f96af52da40795734%1789660092.861",
+        "libcurl/8.23.0#7143b4a20e3c91fe0bc46f298ae5e509%1792054159.656",
         "jsoncpp/1.9.8#5be5e85394fc94f13f6451e5822ea759%1787912339.522",
         "grpc/1.84.0#c7c2ff9ed88b66eac8b8399c96d8df2c%1789729270.871",
         "fmt/12.2.0#b445244e6d0151a425e229248cd2bed8%1785754552.386",