FIPS Package Dependency Management
curl removed from Omnibus-GitLab FIPS packages in 19.0

curl removed from Omnibus-GitLab FIPS packages in 19.0

4/24/2026 · Adam Chu

What this post added

This post announces a change in Omnibus-GitLab FIPS packages: the bundled, GitLab-built curl will be removed starting in version 19.0. Instead, FIPS packages will rely on the curl package provided by the customer's Linux distribution. This aligns with the existing model for OpenSSL in FIPS packages and is driven by curl's deprecation of OpenSSL 1.x support. Customers will be responsible for keeping their OS's curl up to date for security patches. This change has no immediate impact on instance functionality but shifts security update responsibility for curl to the customer.

Read the original post ↗