Backport latest vvmd
@kop316 pinged me about updating
We have 0.7 in the archive and 0.10 is about to hit bookworm in a couple days.
it mentiones needing this (as of yet) unmerged patch for curl
maybe we should also keep that on our radar, but if I remember the upstream discussion that curl patch is only needed for a "full fix" for (I believe) this issue and there might be some partial mitigation in place in 0.9 (I'm a bit hazy on the details currently)
Mostly putting this here as a reminder for myself