The former bumped ABI, and all sorts of crazy happens when you link in
libappstream-glib into a process with the 'other' ABI.

It seems the universe has settled on curl as a dep; do the same.