microsoft · vicroms · Jan 8, 2026 · Nov 29, 2025 · Dec 6, 2025 · Dec 6, 2025
diff --git a/ports/curl/dependencies.patch b/ports/curl/dependencies.patch
diff --git a/ports/curl/pkgconfig-curl-config.patch b/ports/curl/pkgconfig-curl-config.patch
diff --git a/ports/curl/portfile.cmake b/ports/curl/portfile.cmake
@@ -4,12 +4,14 @@ vcpkg_from_github(
     OUT_SOURCE_PATH SOURCE_PATH
     REPO curl/curl
     REF ${curl_version}
-    SHA512 ec2fa6c47d52feed943421b00e98370971bcc73b82842a85426ea9e42d36eaab51258a8d00197fdaaf5ec39e19385280fe387765f27e3b3dc1086c46236dc0bf
+    SHA512 1dca42354d29b9326a3e9be34c74433c3a7364318d69519e2f5b9a164e81db739d3ef1eed79e3313296fe72af73281e0fc61e57a21e9dede1ef240c8fa6af4fe
     HEAD_REF master
     PATCHES
         dependencies.patch
-        pkgconfig-curl-config.patch
 )
+# The on-the-fly tarballs do not carry the details of release tarballs.
+vcpkg_replace_string("${SOURCE_PATH}/include/curl/curlver.h" [[-DEV"]] [["]])
+vcpkg_replace_string("${SOURCE_PATH}/include/curl/curlver.h" [[LIBCURL_TIMESTAMP "[unreleased]"]] [[LIBCURL_TIMESTAMP "[vcpkg]"]])
 
 vcpkg_check_features(OUT_FEATURE_OPTIONS FEATURE_OPTIONS
     FEATURES

diff --git a/ports/curl/vcpkg-cmake-wrapper.cmake b/ports/curl/vcpkg-cmake-wrapper.cmake
@@ -1,19 +1,29 @@
+function(z_vcpkg_curl_libraries_warning variable access value current_list_file stack)
+    if(variable STREQUAL "CURL_LIBRARIES"
+       AND access STREQUAL "READ_ACCESS"
+       AND NOT z_vcpkg_curl_libraries_warning_issued)
+        set(z_vcpkg_curl_libraries_warning_issued 1 PARENT_SCOPE)
+        message(WARNING
+            "CURL_LIBRARIES is '${CURL_LIBRARIES}'. "
+            "When linking imported targets, exported CMake config must use \"find_dependency(CURL)\"."
+        )
+    endif()
+endfunction()
+
 list(REMOVE_ITEM ARGS "NO_MODULE" "CONFIG" "MODULE")
+list(GET ARGS 0 _z_vcpg_curl_name)
 _find_package(${ARGS} CONFIG)
 
-if(CURL_FOUND)
+if(${_z_vcpg_curl_name}_FOUND)
     cmake_policy(PUSH)
     cmake_policy(SET CMP0012 NEW)
     cmake_policy(SET CMP0054 NEW)
     cmake_policy(SET CMP0057 NEW)
 
-    include("${CMAKE_ROOT}/Modules/SelectLibraryConfigurations.cmake")
-
     set(_curl_target CURL::libcurl_shared)
     if(TARGET CURL::libcurl_static)
         set(_curl_target CURL::libcurl_static)
     endif()
-    get_target_property(_curl_include_dirs ${_curl_target} INTERFACE_INCLUDE_DIRECTORIES)
     get_target_property(_curl_link_libraries ${_curl_target} INTERFACE_LINK_LIBRARIES)
     if(NOT _curl_link_libraries)
         set(_curl_link_libraries "")
@@ -25,30 +35,32 @@ if(CURL_FOUND)
         string(REGEX REPLACE "([\$]<[^;]*)?OpenSSL::(SSL|Crypto)([^;]*>)?" "${OPENSSL_LIBRARIES}" _curl_link_libraries "${_curl_link_libraries}")
     endif()
     if(_curl_link_libraries MATCHES "::")
-        message(WARNING "CURL_LIBRARIES list at least one target. This will not work for use cases where targets are not resolved.")
-    endif()
+        # leave CURL_LIBRARIES as set by upstream (imported target), but add information.
+        variable_watch(CURL_LIBRARIES "z_vcpkg_curl_libraries_warning")
+    else()
+        get_target_property(CURL_INCLUDE_DIRS ${_curl_target} INTERFACE_INCLUDE_DIRECTORIES)
+        # resolve CURL_LIBRARIES to filepaths.
+        if(WIN32)
+            get_target_property(_curl_location_debug ${_curl_target} IMPORTED_IMPLIB_DEBUG)
+            get_target_property(_curl_location_release ${_curl_target} IMPORTED_IMPLIB_RELEASE)
+        endif()
 
-    if(WIN32)
-        get_target_property(_curl_location_debug ${_curl_target} IMPORTED_IMPLIB_DEBUG)
-        get_target_property(_curl_location_release ${_curl_target} IMPORTED_IMPLIB_RELEASE)
-    endif()
+        if(NOT _curl_location_debug AND NOT _curl_location_release)
+            get_target_property(_curl_location_debug ${_curl_target} IMPORTED_LOCATION_DEBUG)
+            get_target_property(_curl_location_release ${_curl_target} IMPORTED_LOCATION_RELEASE)
+        endif()
 
-    if(NOT _curl_location_debug AND NOT _curl_location_release)
-        get_target_property(_curl_location_debug ${_curl_target} IMPORTED_LOCATION_DEBUG)
-        get_target_property(_curl_location_release ${_curl_target} IMPORTED_LOCATION_RELEASE)
-    endif()
+        set(CURL_LIBRARY_DEBUG "${_curl_location_debug}" CACHE INTERNAL "vcpkg")
+        set(CURL_LIBRARY_RELEASE "${_curl_location_release}" CACHE INTERNAL "vcpkg")
+        include("${CMAKE_ROOT}/Modules/SelectLibraryConfigurations.cmake")
+        select_library_configurations(CURL)
+        set(CURL_LIBRARIES ${CURL_LIBRARY} ${_curl_link_libraries})
 
-    set(CURL_INCLUDE_DIRS "${_curl_include_dirs}")
-    set(CURL_LIBRARY_DEBUG "${_curl_location_debug}" CACHE INTERNAL "vcpkg")
-    set(CURL_LIBRARY_RELEASE "${_curl_location_release}" CACHE INTERNAL "vcpkg")
-    select_library_configurations(CURL)
-    set(CURL_LIBRARIES ${CURL_LIBRARY} ${_curl_link_libraries})
-    set(CURL_VERSION_STRING "${CURL_VERSION}")
+        unset(_curl_link_libraries)
+        unset(_curl_location_debug)
+        unset(_curl_location_release)
+    endif()
 
-    unset(_curl_include_dirs)
-    unset(_curl_link_libraries)
-    unset(_curl_location_debug)
-    unset(_curl_location_release)
     unset(_curl_target)
     cmake_policy(POP)
 endif()
diff --git a/ports/curl/vcpkg.json b/ports/curl/vcpkg.json
@@ -1,6 +1,6 @@
 {
   "name": "curl",
-  "version": "8.17.0",
+  "version": "8.18.0",
   "description": "A library for transferring data with URLs",
   "homepage": "https://curl.se/",
   "license": "curl AND ISC AND BSD-3-Clause",

diff --git a/scripts/test_ports/vcpkg-ci-curl/portfile.cmake b/scripts/test_ports/vcpkg-ci-curl/portfile.cmake
@@ -1,11 +1,10 @@
 set(VCPKG_POLICY_EMPTY_PACKAGE enabled)
 
 vcpkg_find_acquire_program(PKGCONFIG)
+set(ENV{PKG_CONFIG} "${PKGCONFIG}")
 
 vcpkg_cmake_configure(
     SOURCE_PATH "${CURRENT_PORT_DIR}/project"
-    OPTIONS
-        "-DPKG_CONFIG_EXECUTABLE=${PKGCONFIG}"
     OPTIONS_RELEASE
         "-DCURL_CONFIG=${CURRENT_INSTALLED_DIR}/tools/curl/bin/curl-config"
     OPTIONS_DEBUG

diff --git a/scripts/test_ports/vcpkg-ci-curl/project/CMakeLists.txt b/scripts/test_ports/vcpkg-ci-curl/project/CMakeLists.txt
@@ -3,11 +3,21 @@ project(libcurl-test C)
 
 block(SCOPE_FOR VARIABLES)
     # blocked by FindOpenSSL in CMake 3.30: set(CMAKE_DISABLE_FIND_PACKAGE_PkgConfig 1)
+    set(env_pkg_config_backup "$ENV{PKG_CONFIG}")
+    set(ENV{PKG_CONFIG} "${CMAKE_COMMAND} -E false")
 
     find_package(CURL COMPONENTS libz REQUIRED)
 
-    add_executable(main main.c)
-    target_link_libraries(main PRIVATE CURL::libcurl)
+    add_executable(main-targets main.c)
+    target_link_libraries(main-targets PRIVATE CURL::libcurl)
+
+    add_executable(main-variables main.c)
+    target_include_directories(main-variables PRIVATE ${CURL_INCLUDE_DIRS})
+    target_link_libraries(main-variables PRIVATE ${CURL_LIBRARIES})
+
+    unset(PKG_CONFIG_EXECUTABLE CACHE)
+    unset(PKG_CONFIG_ARGN CACHE)
+    set(ENV{PKG_CONFIG} "${env_pkg_config_backup}")
 endblock()
 
 block(SCOPE_FOR VARIABLES)

diff --git a/versions/baseline.json b/versions/baseline.json
@@ -2249,7 +2249,7 @@
       "port-version": 8
     },
     "curl": {
-      "baseline": "8.17.0",
+      "baseline": "8.18.0",
       "port-version": 0
     },
     "curlcpp": {

diff --git a/versions/c-/curl.json b/versions/c-/curl.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "f01a26a6b8c210cf94b38303afc93d984a75aab9",
+      "version": "8.18.0",
+      "port-version": 0
+    },
     {
       "git-tree": "e5ec3165c979aad7e25d907ffb82e7b6ad0f8f92",
       "version": "8.17.0",