1curl and libcurl 8.6.0 2 3 Public curl releases: 254 4 Command line options: 258 5 curl_easy_setopt() options: 304 6 Public functions in libcurl: 93 7 Contributors: 3078 8 9This release includes the following changes: 10 11 o add CURLE_TOO_LARGE [48] 12 o add CURLINFO_QUEUE_TIME_T [76] 13 o add CURLOPT_SERVER_RESPONSE_TIMEOUT_MS: add [39] 14 o asyn-thread: use GetAddrInfoExW on >= Windows 8 [55] 15 o configure: make libpsl detection failure cause error [109] 16 o docs/cmdline: change to .md for cmdline docs [77] 17 o docs: introduce "curldown" for libcurl man page format [102] 18 o runtests: support -gl. Like -g but for lldb. [47] 19 20This release includes the following bugfixes: 21 22 o altsvc: free 'as' when returning error [23] 23 o appveyor: replace PowerShell with bash + parallel autotools [54] 24 o appveyor: switch to out-of-tree builds [29] 25 o asyn-ares: with modern c-ares, use its default timeout [127] 26 o build: delete unused `HAVE_{GSSHEIMDAL,GSSMIT,HEIMDAL}` [4] 27 o build: delete/replace clang warning pragmas [111] 28 o build: enable missing OpenSSF-recommended warnings, with fixes [11] 29 o build: fix `-Wconversion`/`-Wsign-conversion` warnings [26] 30 o build: fix Windows ADDRESS_FAMILY detection [35] 31 o build: more `-Wformat` fixes [40] 32 o build: remove redundant `CURL_PULL_*` settings [8] 33 o cf-h1-proxy: no CURLOPT_USERAGENT in CONNECT with hyper [133] 34 o cf-socket: show errno in tcpkeepalive error messages [120] 35 o CI/distcheck: run full tests [31] 36 o cmake: add option to disable building docs 37 o cmake: fix generation for system name iOS [53] 38 o cmake: fix typo [5] 39 o cmake: freshen up docs/INSTALL.cmake [101] 40 o cmake: prefill/cache `HAVE_STRUCT_SOCKADDR_STORAGE` [45] 41 o cmake: rework options to enable curl and libcurl docs [161] 42 o cmake: when USE_MANUAL=YES, build the curl.1 man page [113] 43 o cmdline-opts/write-out.d: remove spurious double quotes 44 o cmdline-opts: update availability for the *-ca-native options [66] 45 o cmdline/gen: fix the sorting of the man page options [33] 46 o configure: add libngtcp2_crypto_boringssl detection [155] 47 o configure: fix no default int compile error in ipv6 detection [69] 48 o configure: when enabling QUIC, check that TLS supports QUIC [87] 49 o connect: remove margin from eyeballer alloc [79] 50 o content_encoding: change return code to typedef'ed enum [94] 51 o cookie.d: document use of empty string to enable cookie engine [106] 52 o cookie: avoid fopen with empty file name [24] 53 o curl.h: CURLOPT_DNS_SERVERS is only available with c-ares [131] 54 o curl: show ipfs and ipns as supported "protocols" [15] 55 o curl_easy_getinfo.3: remove the wrong time value count [116] 56 o curl_multi_fdset.3: remove mention of null pointer support [134] 57 o CURLINFO_REFERER.3: clarify that it is the *request* header [70] 58 o CURLOPT_AUTOREFERER.3: mention CURLINFO_REFERER 59 o CURLOPT_POSTFIELDS.3: fix incorrect C string escape in example [27] 60 o CURLOPT_SSH_*_KEYFILE: clarify [57] 61 o dist: add tests/errorcodes.pl to the tarball [6] 62 o docs: clean up Protocols: for cmdline options [32] 63 o docs: describe and highlight super cookies [80] 64 o docs: do not start lines/sentences with So, But nor And [140] 65 o docs: install curl.1 with cmake [166] 66 o docs: mention env vars not used by schannel [124] 67 o doh: remove unused local variable [34] 68 o examples: add four new examples [99] 69 o file+ftp: use stack buffers instead of data->state.buffer [138] 70 o ftp: handle the PORT parsing without allocation [44] 71 o ftp: use dynbuf to store entrypath [83] 72 o ftp: use memdup0 to store the OS from a SYST 215 response [82] 73 o ftpserver.pl: send 213 SIZE response without spurious newline 74 o gen.pl: support ## for doing .IP in table-like lists [105] 75 o gen: do italics/bold for a range of letters, not just single word [78] 76 o GHA: add a job scanning for "bad words" in markdown [164] 77 o GHA: bump ngtcp2, gnutls, mod_h2, quiche [158] 78 o gnutls: fix build with --disable-verbose [3] 79 o haproxy-clientip.d: document the arg [68] 80 o headers: make sure the trailing newline is not stored [97] 81 o headers: remove assert from Curl_headers_push [115] 82 o hostip: return error immediately when Curl_ip2addr() fails [19] 83 o hsts: remove assert for zero length domain [96] 84 o http2: improved on_stream_close/data_done handling [49] 85 o http3/quiche: fix result code on a stream reset [91] 86 o http3: initial support for OpenSSL 3.2 QUIC stack [110] 87 o http: adjust_pollset fix [85] 88 o http: check for "Host:" case insensitively [154] 89 o http: fix off-by-one error in request method length check [14] 90 o http: only act on 101 responses when they are HTTP/1.1 [98] 91 o http: remove comment reference to a removed solution [156] 92 o http: use stack scratch buffer [150] 93 o http_proxy: a blank CURLOPT_USERAGENT should not be used in CONNECT [90] 94 o krb5: add prototype to silence clang warnings on mvsnprintf() [119] 95 o lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT [62] 96 o lib: error out on multissl + http3 [13] 97 o lib: fix variable undeclared error caused by `infof` changes [2] 98 o lib: reduce use of strncpy [30] 99 o lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding [36] 100 o lib: replace readwrite with write_resp [137] 101 o lib: strndup/memdup instead of malloc, memcpy and null-terminate [42] 102 o libssh2: use `libssh2_session_callback_set2()` with v1.11.1 [103] 103 o libssh: improve the deprecation warning dismissal [20] 104 o libssh: supress warnings without version check [18] 105 o Makefile.am: fix the MSVC project generation [22] 106 o Makefile.mk: drop Windows support [12] 107 o mbedtls: fix `-Wnull-dereference` and `-Wredundant-decls` [117] 108 o mbedtls: free the entropy when threaded [46] 109 o mime: use memdup0 instead of malloc + memcpy [63] 110 o mksymbolsmanpage.pl: provide references to where the symbol is used 111 o mprintf: overhaul and bugfixes [52] 112 o mqtt: use stack scratch buffer for recv+publish [148] 113 o multi: remove total timer reset in file_do() while fetching file:// [89] 114 o ngtcp2: put h3 at the front of alpn [58] 115 o ntlm_wb: do not use data->state.buffer any longer [151] 116 o openldap: fix an LDAP crash [75] 117 o openldap: fix STARTTLS [67] 118 o openssl: re-match LibreSSL deinit with init [17] 119 o openssl: when verifystatus fails, remove session id from cache [100] 120 o OS400: sync ILE/RPG binding [114] 121 o pingpong: stop using the download buffer [159] 122 o pop3: replace calloc + memcpy with memdup0 [60] 123 o pytest: scorecard tracking CPU and RSS [157] 124 o quiche: return CURLE_HTTP3 on send to invalid stream [65] 125 o readwrite_data: loop less [21] 126 o Revert "urldata: move async resolver state from easy handle to connectdata" [16] 127 o rtsp: deal with borked server responses [129] 128 o runtests: for mode="text" on <stdout>, fix newlines on both parts [64] 129 o sasl: make login option string override http auth [142] 130 o schannel: fix `-Warith-conversion` gcc 13 warning [28] 131 o sectransp: do verify_cert without memdup for blobs [93] 132 o sectransp_ make TLSCipherNameForNumber() available in non-verbose config [1] 133 o sendf: fix compiler warning with CURL_DISABLE_HEADERS_API [38] 134 o setopt: clear mimepost when formp is freed [92] 135 o setopt: use memdup0 when cloning COPYPOSTFIELDS [107] 136 o socks: fix generic output string to say SOCKS instead of SOCKS4 [144] 137 o socks: use own buffer instead of data->state.buffer [143] 138 o ssh: fix namespace of two local macros [51] 139 o ssh: use stack scratch buffer for seeks [146] 140 o strerror: repair get_winsock_error() [56] 141 o system.h: sync mingw `CURL_TYPEOF_CURL_SOCKLEN_T` with other compilers [9] 142 o system_win32: fix a function pointer assignment warning [71] 143 o telnet: use dynbuf instad of malloc for escape buffer [108] 144 o telnet: use stack scratch buffer for do [149] 145 o tests/server: delete workaround for old-mingw [25] 146 o tests: avoid int/size_t conversion size/sign warnings [163] 147 o tests: respect $TMPDIR when creating unix domain sockets [50] 148 o tool: make parser reject blank arguments if not supported [86] 149 o tool: prepend output_dir in header callback [95] 150 o tool_getparam: bsearch cmdline options [74] 151 o tool_getparam: do not try to expand without an argument [59] 152 o tool_getparam: stop supporting `@filename` style for --cookie [121] 153 o tool_listhelp: regenerate after recent .d updates [61] 154 o tool_operate: make --remove-on-error only remove "real" files [125] 155 o tool_operate: stop setting the file comment on Amiga [128] 156 o transfer: adjust_pollset improvements [81] 157 o transfer: fix upload rate limiting, add test cases [37] 158 o transfer: make the select_bits_paused condition check both directions [104] 159 o transfer: remove warning: Value stored to 'blen' is never read [136] 160 o url: don't set default CA paths for Secure Transport backend [126] 161 o url: for disabled protocols, mention if found in redirect [7] 162 o urlapi: remove assert [162] 163 o verify-examples.pl: fail verification on unescaped backslash [72] 164 o version: show only the libpsl version, not its dependencies [130] 165 o vquic: extract TLS setup into own source [88] 166 o vtls: fix missing multissl version info [73] 167 o vtls: receive max buffer [139] 168 o vtls: remove the Curl_cft_ssl_proxy object if CURL_DISABLE_PROXY [41] 169 o websockets: check for negative payload lengths [123] 170 o websockets: refactor decode chain [122] 171 o windows: delete redundant headers [43] 172 o windows: simplify detecting and using system headers [10] 173 o wolfssl: load certificate *chain* for PEM client certs [84] 174 o x509asn1: remove code for WANT_VERIFYHOST [132] 175 o x509asn1: switch from malloc to dynbuf [112] 176 177This release includes the following known bugs: 178 179 o see docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html) 180 181Planned upcoming removals include: 182 183 o support for space-separated NOPROXY patterns 184 185 See https://curl.se/dev/deprecate.html for details 186 187This release would not have looked like this without help, code, reports and 188advice from friends like these: 189 190 Andy Alt, annalee, Baruch Siach, Ben, Boris Verkhovskiy, Brad Harder, 191 bubbleguuum on github, Cajus Pollmeier, calvin2021y on github, Chara White, 192 Chris Sauer, Dan Fandrich, Daniel Gustafsson, Daniel Stenberg, 193 dependabot[bot], Dmitry Karpov, Gabe, Geeknik Labs, Gisle Vanem, 194 Graham Campbell, Hans-Christian Egtvedt, Harry Sintonen, Haydar Alaidrus, 195 hgdagon on github, Hiroki Kurosawa, iAroc on github, ivanfywang, 196 janko-js on github, Jay Wu, Jess Lowe, Karthikdasari0423 on github, 197 Lealem Amedie, Lin Sun, Marcel Raad, Mark Huang, Mark Sinkovics, 198 Mauricio Scheffer, Michał Antoniak, Mike Hommey, Mohammadreza Hendiani, 199 Ozan Cansel, Patrick Monnerat, Pavel Pavlov, promptfuzz_ on hackerone, 200 Ray Satiro, RevaliQaQ on github, Richard Levitte, Scarlett McAllister, 201 Sergey Bronnikov, Sergey Markelov, sfan5 on github, Stefan Eissing, 202 Tatsuhiko Miyagawa, Tatsuhiro Tsujikawa, Theo, Thomas Ferguson, 203 Viktor Szakats, Xi Ruoyao, Yadhu Krishna M, Yedaya Katsman, Yifei Kong, 204 YX Hao, zengwei, zengwei2000, ウさん 205 (65 contributors) 206 207References to bug reports and discussions on issues: 208 209 [1] = https://curl.se/bug/?i=12474 210 [2] = https://curl.se/bug/?i=12470 211 [3] = https://curl.se/bug/?i=12505 212 [4] = https://curl.se/bug/?i=12506 213 [5] = https://curl.se/bug/?i=12464 214 [6] = https://curl.se/bug/?i=12462 215 [7] = https://curl.se/bug/?i=12466 216 [8] = https://curl.se/bug/?i=12502 217 [9] = https://curl.se/bug/?i=12501 218 [10] = https://curl.se/bug/?i=12495 219 [11] = https://curl.se/bug/?i=12489 220 [12] = https://curl.se/bug/?i=12224 221 [13] = https://curl.se/bug/?i=12807 222 [14] = https://curl.se/bug/?i=12534 223 [15] = https://curl.se/mail/archive-2023-12/0026.html 224 [16] = https://curl.se/bug/?i=12524 225 [17] = https://curl.se/bug/?i=12525 226 [18] = https://curl.se/bug/?i=12523 227 [19] = https://curl.se/bug/?i=12522 228 [20] = https://curl.se/bug/?i=12519 229 [21] = https://curl.se/bug/?i=12504 230 [22] = https://curl.se/bug/?i=12564 231 [23] = https://curl.se/bug/?i=12570 232 [24] = https://curl.se/bug/?i=12514 233 [25] = https://curl.se/bug/?i=12510 234 [26] = https://curl.se/bug/?i=12557 235 [27] = https://curl.se/bug/?i=12588 236 [28] = https://curl.se/bug/?i=12616 237 [29] = https://curl.se/bug/?i=12550 238 [30] = https://curl.se/bug/?i=12499 239 [31] = https://curl.se/bug/?i=12503 240 [32] = https://curl.se/bug/?i=12496 241 [33] = https://curl.se/mail/archive-2023-12/0014.html 242 [34] = https://curl.se/bug/?i=12491 243 [35] = https://curl.se/bug/?i=12441 244 [36] = https://curl.se/bug/?i=12490 245 [37] = https://curl.se/bug/?i=12559 246 [38] = https://curl.se/bug/?i=12485 247 [39] = https://curl.se/bug/?i=12369 248 [40] = https://curl.se/bug/?i=12540 249 [41] = https://curl.se/bug/?i=12459 250 [42] = https://curl.se/bug/?i=12453 251 [43] = https://curl.se/bug/?i=12539 252 [44] = https://curl.se/bug/?i=12456 253 [45] = https://curl.se/bug/?i=12537 254 [46] = https://curl.se/bug/?i=12584 255 [47] = https://curl.se/bug/?i=12547 256 [48] = https://curl.se/bug/?i=12269 257 [49] = https://curl.se/bug/?i=10936 258 [50] = https://curl.se/bug/?i=12545 259 [51] = https://curl.se/bug/?i=12544 260 [52] = https://curl.se/bug/?i=12561 261 [53] = https://curl.se/bug/?i=12515 262 [54] = https://curl.se/bug/?i=12560 263 [55] = https://curl.se/bug/?i=12481 264 [56] = https://curl.se/bug/?i=12578 265 [57] = https://curl.se/bug/?i=12554 266 [58] = https://curl.se/bug/?i=12576 267 [59] = https://curl.se/bug/?i=12565 268 [60] = https://curl.se/bug/?i=12650 269 [61] = https://curl.se/bug/?i=12612 270 [62] = https://curl.se/bug/?i=12658 271 [63] = https://curl.se/bug/?i=12649 272 [64] = https://curl.se/bug/?i=12612 273 [65] = https://curl.se/bug/?i=12590 274 [66] = https://curl.se/bug/?i=12613 275 [67] = https://curl.se/bug/?i=12610 276 [68] = https://curl.se/bug/?i=12611 277 [69] = https://curl.se/bug/?i=12607 278 [70] = https://curl.se/bug/?i=12605 279 [71] = https://curl.se/bug/?i=12581 280 [72] = https://curl.se/bug/?i=12589 281 [73] = https://curl.se/bug/?i=12599 282 [74] = https://curl.se/bug/?i=12631 283 [75] = https://curl.se/bug/?i=12593 284 [76] = https://curl.se/bug/?i=12368 285 [77] = https://curl.se/bug/?i=12751 286 [78] = https://curl.se/bug/?i=12689 287 [79] = https://curl.se/bug/?i=12647 288 [80] = https://curl.se/bug/?i=12687 289 [81] = https://curl.se/bug/?i=12640 290 [82] = https://curl.se/bug/?i=12639 291 [83] = https://curl.se/bug/?i=12638 292 [84] = https://curl.se/bug/?i=12634 293 [85] = https://curl.se/bug/?i=12632 294 [86] = https://curl.se/bug/?i=12620 295 [87] = https://curl.se/bug/?i=12683 296 [88] = https://curl.se/bug/?i=12678 297 [89] = https://curl.se/bug/?i=12682 298 [90] = https://curl.se/bug/?i=12680 299 [91] = https://curl.se/bug/?i=12629 300 [92] = https://curl.se/bug/?i=12608 301 [93] = https://curl.se/bug/?i=12679 302 [94] = https://curl.se/bug/?i=12618 303 [95] = https://curl.se/bug/?i=12614 304 [96] = https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65661 305 [97] = https://curl.se/mail/lib-2024-01/0019.html 306 [98] = https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66184 307 [99] = https://curl.se/bug/?i=12671 308 [100] = https://curl.se/bug/?i=12760 309 [101] = https://curl.se/bug/?i=12772 310 [102] = https://curl.se/bug/?i=12730 311 [103] = https://curl.se/bug/?i=12754 312 [104] = https://curl.se/mail/lib-2024-01/0049.html 313 [105] = https://curl.se/bug/?i=12667 314 [106] = https://curl.se/bug/?i=12643 315 [107] = https://curl.se/bug/?i=12651 316 [108] = https://curl.se/bug/?i=12652 317 [109] = https://curl.se/bug/?i=12661 318 [110] = https://curl.se/bug/?i=12734 319 [111] = https://curl.se/bug/?i=12812 320 [112] = https://curl.se/bug/?i=12808 321 [113] = https://curl.se/bug/?i=12742 322 [114] = https://curl.se/bug/?i=12815 323 [115] = https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65839 324 [116] = https://curl.se/bug/?i=12727 325 [117] = https://curl.se/bug/?i=12720 326 [119] = https://curl.se/bug/?i=12803 327 [120] = https://curl.se/bug/?i=12726 328 [121] = https://curl.se/bug/?i=12645 329 [122] = https://curl.se/bug/?i=12713 330 [123] = https://curl.se/bug/?i=12707 331 [124] = https://curl.se/bug/?i=12711 332 [125] = https://curl.se/bug/?i=12710 333 [126] = https://curl.se/bug/?i=12704 334 [127] = https://curl.se/bug/?i=12703 335 [128] = https://curl.se/bug/?i=12709 336 [129] = https://curl.se/bug/?i=12701 337 [130] = https://curl.se/bug/?i=12700 338 [131] = https://curl.se/bug/?i=12695 339 [132] = https://curl.se/bug/?i=12804 340 [133] = https://curl.se/bug/?i=12697 341 [134] = https://curl.se/bug/?i=12691 342 [136] = https://curl.se/bug/?i=12693 343 [137] = https://curl.se/bug/?i=12480 344 [138] = https://curl.se/bug/?i=12789 345 [139] = https://curl.se/bug/?i=12801 346 [140] = https://curl.se/bug/?i=12802 347 [142] = https://curl.se/bug/?i=10259 348 [143] = https://curl.se/bug/?i=12788 349 [144] = https://curl.se/bug/?i=12797 350 [146] = https://curl.se/bug/?i=12794 351 [148] = https://curl.se/bug/?i=12792 352 [149] = https://curl.se/bug/?i=12793 353 [150] = https://curl.se/bug/?i=12791 354 [151] = https://curl.se/bug/?i=12787 355 [154] = https://curl.se/bug/?i=12784 356 [155] = https://curl.se/bug/?i=12724 357 [156] = https://curl.se/bug/?i=12785 358 [157] = https://curl.se/bug/?i=12765 359 [158] = https://curl.se/bug/?i=12778 360 [159] = https://curl.se/bug/?i=12757 361 [161] = https://curl.se/bug/?i=12773 362 [162] = https://curl.se/bug/?i=12775 363 [163] = https://curl.se/bug/?i=12768 364 [164] = https://curl.se/bug/?i=12764 365 [166] = https://curl.se/bug/?i=12759 366