There are some new bugs disclosed in curl:
https://curl.haxx.se/docs/security.html

Grafting the new version seems like the right approach to me when I
consider libcurl's ABI compatibility policy:
https://curl.haxx.se/libcurl/abi.html

Thoughts?