I of course haven't "upgraded" to it, so I couldn't say. It might be legit, but since I couldn't verify that it was or what potential benefit the new version offered, I ignored it - which in lieu of recent events seem to have been a wise decision. But I am also interested in hearing more about the devel libcurl3 if someone has any info.