curl removed from Omnibus-GitLab FIPS packages in 19.0
Apr 24, 2026Adam Chu

Summary
Starting with Omnibus-GitLab 19.0, FIPS packages will no longer include a GitLab-built version of curl. Instead, they will use the curl package provided by the customer's Linux distribution, aligning with the existing model for OpenSSL. This change is due to curl 8.18.0 deprecating compilation against OpenSSL 1.x. GitLab will no longer be responsible for shipping security updates to curl in FIPS packages; customers must keep their OS's curl up to date. Scanner findings for curl will now reflect the host OS package.