The patch updates curl module to the version 8.4.0 [1] that brings a number of functional fixes and security fix of SOCKS5 heap buffer overflow (CVE-2023-38545), see description in [2] and commit fb4415d8aee6 ("socks: return error if hostname too long for remote resolve") in [3]. 1. https://curl.se/changes.html#8_4_0 2. https://curl.se/docs/CVE-2023-38545.html 3. https://github.com/curl/curl/commit/fb4415d8aee6c1045be932a34fe6107c2f5ed147 NO_DOC=libcurl submodule bump NO_TEST=libcurl submodule bump

Tarantool supports two console protocols: text and binary. The binary protocol is implemented with IPROTO EVAL request so the console module reuses the net.box module to establish and maintain a binary connection. Currently, instead of passing the original URI specified by the user to net.box.connect as is, the console module parses the URI and passes the host and port. As a result, extra information that may be specified in URI parameters is lost. This prevents the user from connecting to the binary console using the SSL transport because to use the SSL transport the user must specify transport=ssl URI parameter. Needed for tarantool/tarantool-ee#567 NO_DOC=no visible changes in CE NO_TEST=no visible changes in CE NO_CHANGELOG=no visible changes in CE

User password is stored in a system space is a form of hash when 'chap-sha1' auth type is set, and in a form of hash with salt when 'pap-sha256' is set. Now, if a user is set inside config, and the current auth type is different from the type the users password is stored in, the password hash will be regenerated. Part of #8967 NO_DOC=documentation request will be filed manually for the whole credentials

With #8906 the object types mentioned above were introduced. They control access to code execution over IPROTO. This patch adds such object types support to credentials applier. Now 'execute' can be granted to a user or role for 'lua_eval', 'lua_call' and 'sql'. Note that similar to 'universe', objects can't be specified in the config, only 'all' is allowed. Part of #8967 NO_DOC=documentation request will be filed manually for the whole credentials

The new parameters will be implemented in Tarantool Enterprise Edition. This commit just adds configuration stubs. Needed for tarantool/tarantool-ee#502 Needed for tarantool/tarantool-ee#503 NO_DOC=stubs for enterprise edition NO_CHANGELOG=stubs for enterprise edition

Let's obtain box.cfg parameters from audit_log_init with cfg_get instead of passing them as arguments, like we do with the security module, for example. This simplifies addition of new audit log parameters. Needed for tarantool/tarantool-ee#502 Needed for tarantool/tarantool-ee#503 NO_DOC=refactoring NO_TEST=refactoring NO_CHANGELOG=refactoring

During building an index in background, some transaction can perform a dml request that affects space size (e.g. a replace), but the size will remain the same, because bsize is moved from the old space to the new space in memtx_space_prepare_alter() prior to space_execute_dml(). Fix this issue by calling space_finish_alter() in alter_space_do(). In fact, this patch partially reverts commit 9ec3b1a445a6 ("alter: zap space_vtab::commit_alter"). NO_DOC=bugfix Closes #9247

Consider the following example: ``` tarantool -e "box.cfg{} require('console').start()" ``` When a local console is exited by pressing Ctrl+D, Tarantool seemingly freezes - console stops to work, typed characters are not echoed. But the event loop is not stopped because there are background fibers running. This patch adds a message that Ctrl+C should be pressed in such a case. Closes #7017 NO_DOC=minor

Attaching triggers to space id instead of space object is a significant pitfall. The users who haven't discovered new triggers may not expect the triggers of a dropped space will be fired by a new one. So let's drop triggers that were set with old API along with the space. All the tests, changed because of described above breaking change, are restored. Closes #9223 NO_DOC=later

The patch provides event triggers with flags and introduces the first one - EVENT_TRIGGER_IS_TEMPORARY. When the new event_remove_temporary_triggers method is called, all the temporary triggers are removed from the event. Part of #9223 NO_CHANGELOG=internal NO_DOC=internal