The patch updates curl module to the version 8.4.0 [1] that brings a number of functional fixes and security fix of SOCKS5 heap buffer overflow (CVE-2023-38545), see description in [2] and commit fb4415d8aee6 ("socks: return error if hostname too long for remote resolve") in [3]. 1. https://curl.se/changes.html#8_4_0 2. https://curl.se/docs/CVE-2023-38545.html 3. https://github.com/curl/curl/commit/fb4415d8aee6c1045be932a34fe6107c2f5ed147 NO_DOC=libcurl submodule bump NO_TEST=libcurl submodule bump (cherry picked from commit 0ea1ba877b8e62e0acb558b55623d93bf58a0e1f)

The motivation is to reduce time slip on Tarantool startup before running init scripts. Internal ev time is set in fiber_init/ev_default_loop and is not get updated until starting event loop. This causes timeouts slip up to 0.3 in debug ASAN build in init script (see #9261). Let's run event loop right at the beginning of the run_script_f before executing any script. This way besides updating internal ev time we make an explicit place of starting script event loop. Currently it is started lazily when config script yields. This will fix CI for PR https://github.com/tarantool/tarantool-ee/pull/572 for debug ASAN workflow. We can also remove start_loop condition. It does not make sense now. It was added in the commit 3a851430a19c ("Fix tarantool -e "os.exit()" hang") but since then we start to stop event loop after handling os.exit(). Also this fixes #9266. The issue is we don't have an event loop to run on shutdown triggers if -e command line expression add such a trigger and then call os.exit(). Follow-up #7327 Closes #9266 NO_DOC=bugfix (cherry picked from commit 1fcfb8c2bc8f3a4793c68cdc66930d8498c8504f)

This patch fixes issue: $ tarantoolctl rocks --version 1>/dev/null Warning: failed to load command module luarocks.cmd.help NO_DOC=bugfix NO_CHANGELOG=not released yet (cherry picked from commit d6ae403e99cc20d816e59f8fba8f7350e44b9217)

Tarantool supports two console protocols: text and binary. The binary protocol is implemented with IPROTO EVAL request so the console module reuses the net.box module to establish and maintain a binary connection. Currently, instead of passing the original URI specified by the user to net.box.connect as is, the console module parses the URI and passes the host and port. As a result, extra information that may be specified in URI parameters is lost. This prevents the user from connecting to the binary console using the SSL transport because to use the SSL transport the user must specify transport=ssl URI parameter. Needed for tarantool/tarantool-ee#567 NO_DOC=no visible changes in CE NO_TEST=no visible changes in CE NO_CHANGELOG=no visible changes in CE (cherry picked from commit 33e72567dc4f8f745be986190be08db847f423d0)

During building an index in background, some transaction can perform a dml request that affects space size (e.g. a replace), but the size will remain the same, because bsize is moved from the old space to the new space in memtx_space_prepare_alter() prior to space_execute_dml(). Fix this issue by calling space_finish_alter() in alter_space_do(). In fact, this patch partially reverts commit 9ec3b1a445a6 ("alter: zap space_vtab::commit_alter"). NO_DOC=bugfix Closes #9247 (cherry picked from commit 54a42186de2776b4fa970ee1a9cf53c543a1cb26)