ydb/contrib/libs/curl/RELEASE-NOTES

curl and libcurl 7.86.0

 Public curl releases:         211
 Command line options:         248
 curl_easy_setopt() options:   300
 Public functions in libcurl:  91
 Contributors:                 2733

This release includes the following changes:

 o NPN: remove support for and use of [16]
 o Websockets: initial support [23]

This release includes the following bugfixes:

 o altsvc: reject bad port numbers [86]
 o altsvc: use 'h3' for h3 [46]
 o amiga: do not hardcode openssl/zlib into the os config [158]
 o amiga: set SIZEOF_CURL_OFF_T=8 by default [150]
 o amigaos: add missing curl header [159]
 o asyn-ares: set hint flags when calling ares_getaddrinfo [93]
 o autotools: allow --enable-symbol-hiding with windows [65]
 o autotools: allow unix sockets on Windows [144]
 o autotools: reduce brute-force when detecting recv/send arg list [66]
 o aws_sigv4: fix header computation [139]
 o bearssl: make it proper C89 compliant
 o CI/GHA: cancel outdated CI runs on new PR changes [20]
 o CI/GHA: merge msh3 and openssl3 builds into linux workflow [110]
 o cirrus-ci: add macOS build with m1 [81]
 o cirrus: use make LDFLAGS=-all-static instead of curl_LDFLAGS [129]
 o cli tool: do not use disabled protocols
 o cmake: add missing inet_ntop check [145]
 o cmake: add the check of HAVE_SOCKETPAIR [98]
 o cmake: define BUILDING_LIBCURL in lib/CMakeLists, not config.h [5]
 o cmake: delete duplicate HAVE_GETADDRINFO test [149]
 o cmake: enable more detection on Windows [143]
 o cmake: fix original MinGW builds [177]
 o cmake: improve usability of CMake build as a sub-project [186]
 o cmake: set HAVE_GETADDRINFO_THREADSAFE on Windows [147]
 o cmake: set HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID on Windows [146]
 o cmake: sync HAVE_SIGNAL detection with autotools [148]
 o cmdline/docs: add a required 'multi' keyword for each option [160]
 o configure: correct the wording when checking grep -E [13]
 o configure: deprecate builds with small curl_off_t [89]
 o configure: fail if '--without-ssl' + explicit parameter for an ssl lib [164]
 o configure: the ngtcp2 option should default to 'no' [125]
 o connect: change verbose IPv6 address:port to [address]:port [83]
 o connect: fix builds without AF_INET6 [152]
 o connect: fix Curl_updateconninfo for TRNSPRT_UNIX [108]
 o connect: fix the wrong error message on connect failures [55]
 o content_encoding: use writer struct subclasses for different encodings [8]
 o cookie: reject cookie names or content with TAB characters [94]
 o ctype: remove all use of <ctype.h>, use our own versions [12]
 o curl-compilers.m4: for gcc + want warnings, set gnu89 standard [72]
 o curl-compilers.m4: use -O2 as default optimize for clang [6]
 o curl-wolfssl.m4: error out if wolfSSL is not usable [102]
 o curl.h: fix mention of wrong error code in comment
 o curl/add_file_name_to_url: use the libcurl URL parser [99]
 o curl/add_parallel_transfers: better error handling [101]
 o curl/get_url_file_name: use libcurl URL parser [97]
 o curl: warn for --ssl use, considered insecure [49]
 o curl_ctype: convert to macros-only [10]
 o curl_easy_pause.3: unpausing is as fast as possible [14]
 o curl_escape.3: fix typo [50]
 o curl_setup: disable use of FLOSS for 64-bit NonStop builds [69]
 o curl_setup: include curl.h after platform setup headers [37]
 o curl_setup: include only system.h instead of curl.h [34]
 o curl_strequal.3: fix argument typo [60]
 o curl_url_set.3: document CURLU_APPENDQUERY proper [96]
 o CURLMOPT_PIPELINING.3: dedup manpage xref [111]
 o CURLOPT_ACCEPT_ENCODING.3: remove "four" as they are five [85]
 o CURLOPT_AUTOREFERER.3: highlight the privacy leak risk [161]
 o CURLOPT_COOKIEFILE: insist on "" for enable-without-file [119]
 o CURLOPT_COOKIELIST.3: fix formatting mistake [80]
 o CURLOPT_DNS_INTERFACE.3: mention it works for almost all protocols [15]
 o CURLOPT_MIMEPOST.3: add an (inline) example [126]
 o CURLOPT_POSTFIELDS.3: refer to CURLOPT_MIMEPOST [167]
 o CURLOPT_PROXY_SSLCERT_BLOB.3: this is for HTTPS proxies [9]
 o CURLOPT_WILDCARDMATCH.3: Fix backslash escaping under single quotes [172]
 o CURLSHOPT_UNLOCKFUNC.3: the callback has no 'access' argument [84]
 o DEPRECATE.md: Support for systems without 64 bit data types [19]
 o docs/examples: avoid deprecated options in examples where possible [115]
 o docs/INSTALL: update Android Instructions for newer NDKs [151]
 o docs/libcurl/symbols-in-versions: add several missing symbols
 o docs: 100+ spellfixes
 o docs: correct missing uppercase in Markdown files [38]
 o docs: document more server names for test files
 o docs: fix deprecation versions inconsistencies [123]
 o docs: make sure libcurl opts examples pass in long arguments [182]
 o docs: remove mentions of deprecated '--without-openssl' parameter [170]
 o docs: tag curl options better in man pages
 o docs: tell about disabled protocols in CURLOPT_*PROTOCOLS_STR.
 o docs: update sourceforge project links [95]
 o easy: fix the #include order [53]
 o easy: fix the altsvc init for curl_easy_duphandle [77]
 o easy_lock: check for HAVE_STDATOMIC_H as well [187]
 o examples/chkspeed: improve portability [48]
 o formdata: fix warning: 'CURLformoption' is promoted to 'int' [24]
 o ftp: ignore a 550 response to MDTM [1]
 o ftp: remove redundant if [163]
 o functypes: provide the recv and send arg and return types [87]
 o getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled [17]
 o GHA: build tests in a separate step from the running of them [78]
 o GHA: run proselint on markdown files [22]
 o github: initial CODEOWNERS setup for CI configuration [52]
 o header: define public API functions as extern c [26]
 o headers: reset the requests counter at transfer start [25]
 o hostip: guard PF_INET6 use [157]
 o hostip: lazily wait to figure out if IPv6 works until needed [36]
 o http, vauth: always provide Curl_allow_auth_to_host() functionality [90]
 o http2: make nghttp2 less picky about field whitespace [27]
 o HTTP3.md: update Caddy example [76]
 o http: try parsing Retry-After: as a number first [122]
 o http_proxy: restore the protocol pointer on error [104]
 o httpput-postfields.c: shorten string for C89 compliance [57]
 o ldap: delete stray CURL_HAS_MOZILLA_LDAP reference [79]
 o lib1560: extended to verify detect/reject of unknown schemes
 o lib517: fix C89 constant signedness [73]
 o lib: add missing limits.h includes [35]
 o lib: add required Win32 setup definitions in setup-win32.h [4]
 o lib: prepare the incoming of additional protocols [71]
 o lib: sanitize conditional exclusion around MIME [82]
 o lib: set more flags in config-win32.h [109]
 o lib: the number four in a sequence is the "fourth" [28]
 o libssh: if sftp_init fails, don't get the sftp error code [132]
 o Makefile.m32: deduplicate build rules [131]
 o Makefile.m32: drop CROSSPREFIX and our CC/AR defaults [137]
 o Makefile.m32: exclude libs & libpaths for shared mode exes [127]
 o Makefile.m32: fix regression with tool_hugehelp [130]
 o Makefile.m32: major rework [92]
 o Makefile.m32: reintroduce CROSSPREFIX and -W -Wall [179]
 o Makefile.m32: support more options [142]
 o manpage-syntax.pl: all libcurl option symbols should be \fI-tagged [75]
 o manpages: Fix spelling of "allows to" -> "allows one to" [171]
 o misc: ISSPACE() => ISBLANK() [11]
 o misc: use the term "null-terminate" consistently [41]
 o mprintf: reject two kinds of precision for the same argument [162]
 o mprintf: use snprintf if available [74]
 o mqtt: return error for too long topic [133]
 o mqtt: spell out CONNECT in comments [166]
 o msh3: change the static_assert to make the code C89
 o netrc: compare user name case sensitively [118]
 o netrc: replace fgets with Curl_get_line [174]
 o netrc: use the URL-decoded user [103]
 o ngtcp2: fix build errors due to changes in ngtcp2 library [107]
 o ngtcp2: fix C89 compliance nit
 o noproxy: support proxies specified using cidr notation [184]
 o openssl: make certinfo available for QUIC [91]
 o README.md: add GHA status badges for Linux and macOS builds [40]
 o RELEASE-PROCEDURE.md: mention patch releases [21]
 o resolve: make forced IPv4 resolve only use A queries [61]
 o runtests: fix uninitialized value on ignored tests [128]
 o schannel: ban server ALPN change during recv renegotiation [63]
 o schannel: don't reset recv/send function pointers on renegotiation [156]
 o schannel: when importing PFX, disable key persistence [141]
 o scripts: use `grep -E` instead of `egrep` [30]
 o setopt: use the handler table for protocol name to number conversions [45]
 o setopt: when POST is set, reset the 'upload' field [51]
 o setup-win32: no longer define UNICODE/_UNICODE implicitly [3]
 o single_transfer: use the libcurl URL parser when appending query parts [100]
 o smb: replace CURL_WIN32 with WIN32 [138]
 o strcase: add and use Curl_timestrcmp [106]
 o strerror: improve two URL API error messages
 o symbol-scan.pl: also check for LIBCURL* symbols [43]
 o symbol-scan.pl: scan and verify .3 man pages [42]
 o symbols-in-versions: add missing LIBCURL* symbols
 o symbols-in-versions: CURLOPT_ENCODING is deprecated since 7.21.6
 o test1119: scan all public headers [44]
 o test1275: verify uppercase after period in markdown [135]
 o test972: verify the output without using external tool [32]
 o tests/certs/scripts: insert standard curl source headers [169]
 o tests/Makefile: remove run time stats from ci-test [120]
 o tests: avoid CreateThread if _beginthreadex is available [155]
 o tests: fix tag syntax errors in test files
 o tests: skip mime/form tests when mime is not built-in [54]
 o tidy-up: delete parallel/unused feature flags [117]
 o tidy-up: delete unused HAVE_STRUCT_POLLFD [134]
 o TODO: provide the error body from a CONNECT response [67]
 o tool: avoid generating ambiguous escaped characters in --libcurl [124]
 o tool: remove dead code [70]
 o tool: reorganize function c_escape around a dynbuf [121]
 o tool_hugehelp: make hugehelp a blank macro when disabled [7]
 o tool_main: exit at once if out of file descriptors [113]
 o tool_operate: avoid a few #ifdefs for disabled-libcurl builds [29]
 o tool_operate: more transfer cleanup after parallel transfer fail [165]
 o tool_operate: prevent over-queuing in parallel mode [176]
 o tool_operate: reduce errorbuffer allocs [173]
 o tool_paramhelp: asserts verify maximum sizes for string loading [112]
 o tool_paramhelp: make the max argument a 'double' [136]
 o tool_progress: remove 'Qd' from the parallel progress bar [175]
 o tool_setopt: use better English in --libcurl source comments [39]
 o tool_xattr: save the original URL, not the final redirected one [181]
 o unit test 1655: make it C89-compliant [59]
 o url: a zero-length userinfo part in the URL is still a (blank) user [64]
 o url: allow non-HTTPS HSTS-matching for debug builds [105]
 o url: rename function due to name-clash in Watt-32 [62]
 o url: use IDN decoded names for HSTS checks [140]
 o urlapi: detect scheme better when not guessing [56]
 o urlapi: fix parsing URL without slash with CURLU_URLENCODE [154]
 o urlapi: leaner with fewer allocs [2]
 o urlapi: reject more bad characters from the host name field [88]
 o winbuild/MakefileBuild.vc: handle spaces in libssh(2) include paths [18]
 o winbuild: use NMake batch-rules for compilation [47]
 o windows: add .rc support to autotools builds [33]
 o windows: adjust name of two internal public functions [58]
 o windows: autotools .rc warnings fixup [68]
 o wolfSSL: fix session management bug. [31]

This release includes the following known bugs:

 o see docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)

Planned upcoming removals include:

 o NSS
 o Support for systems without 64 bit data types

 See https://curl.se/dev/deprecate.html for details

This release would not have looked like this without help, code, reports and
advice from friends like these:

  12932 on github, a1346054 on github, Aftab Alam, ajak in #curl,
  Andrew Lambert, Benjamin Loison, Brad Harder, bsergean on github,
  Christopher Sauer, Dan Fandrich, Daniel Gustafsson, Daniel Hallberg,
  Daniel Stenberg, David Hu, David McLaughlin, Dmitry Karpov, Dominik Klemba,
  Don J Olmstead, Dustin Howett, Edoardo Lolletti, Eloy Degen, Emanuele Torre,
  Emilio López, Gisle Vanem, Hayden Roche, Hiroki Kurosawa, James Fuller,
  Jeremy Maitin-Shepard, Joel Depooter, John Bampton, Jonas Haag,
  jurisuk on github, justchen1369 on github, Keitagit-kun on github,
  Kelly Kaoudis, Marcel Raad, Marc Hörsken, Mark Itzcovitz, Martin Ågren,
  Martin Strunz, Mathieu Carbonneaux, Matthias Gatto, Matt Holt, Max Dymond,
  Michael Drake, Michael Heimpold, n0name321 on github, Orgad Shaneh,
  Patrick Monnerat, Paul Seligman, Peter Goodman, Petr Štetiar, Philip H,
  Philip H., Philip Heiduck, ProceduralMan on github, Randall S. Becker,
  Ray Satiro, Rickard Hallerbäck, RobBotic1 on github, Robby Simpson,
  Samuel Henrique, Sergey Bronnikov, ShadowZzj on github, Shaun Mirani,
  ssdbest on github, Thiago Suchorski, Tobias Schaefer, Trail of Bits,
  Vasiliy Ulyanov, Viktor Szakats, Xiang Xiao, Yuriy Chernyshov,
  zhanghu on xiaomi
  (74 contributors)

References to bug reports and discussions on issues:

 [1] = https://curl.se/bug/?i=9357
 [2] = https://curl.se/bug/?i=9408
 [3] = https://curl.se/bug/?i=9375
 [4] = https://curl.se/bug/?i=9375
 [5] = https://curl.se/bug/?i=9498
 [6] = https://curl.se/bug/?i=9444
 [7] = https://curl.se/bug/?i=9485
 [8] = https://curl.se/bug/?i=9455
 [9] = https://curl.se/bug/?i=9434
 [10] = https://curl.se/bug/?i=9429
 [11] = https://curl.se/bug/?i=9432
 [12] = https://curl.se/bug/?i=9433
 [13] = https://curl.se/bug/?i=9471
 [14] = https://curl.se/bug/?i=9410
 [15] = https://curl.se/bug/?i=9427
 [16] = https://curl.se/bug/?i=9307
 [17] = https://curl.se/bug/?i=9485
 [18] = https://curl.se/mail/lib-2022-09/0038.html
 [19] = https://curl.se/bug/?i=9604
 [20] = https://curl.se/bug/?i=9533
 [21] = https://curl.se/bug/?i=9495
 [22] = https://curl.se/bug/?i=9520
 [23] = https://curl.se/bug/?i=8995
 [24] = https://curl.se/bug/?i=9484
 [25] = https://curl.se/bug/?i=9424
 [26] = https://curl.se/bug/?i=9424
 [27] = https://curl.se/bug/?i=9448
 [28] = https://curl.se/bug/?i=9535
 [29] = https://curl.se/bug/?i=9486
 [30] = https://curl.se/bug/?i=9491
 [31] = https://curl.se/bug/?i=9492
 [32] = https://curl.se/bug/?i=9563
 [33] = https://curl.se/bug/?i=9521
 [34] = https://curl.se/bug/?i=9453
 [35] = https://curl.se/bug/?i=9453
 [36] = https://curl.se/bug/?i=9553
 [37] = https://curl.se/bug/?i=9453
 [38] = https://curl.se/bug/?i=9474
 [39] = https://curl.se/bug/?i=9475
 [40] = https://curl.se/bug/?i=9530
 [41] = https://curl.se/bug/?i=9527
 [42] = https://curl.se/bug/?i=9544
 [43] = https://curl.se/bug/?i=9544
 [44] = https://curl.se/bug/?i=9544
 [45] = https://curl.se/bug/?i=9472
 [46] = https://curl.se/bug/?i=9515
 [47] = https://curl.se/bug/?i=9512
 [48] = https://curl.se/bug/?i=9562
 [49] = https://curl.se/bug/?i=9519
 [50] = https://curl.se/bug/?i=9517
 [51] = https://curl.se/bug/?i=9507
 [52] = https://curl.se/bug/?i=9505
 [53] = https://curl.se/bug/?i=9560
 [54] = https://curl.se/bug/?i=9596
 [55] = https://curl.se/bug/?i=9549
 [56] = https://curl.se/bug/?i=9503
 [57] = https://curl.se/bug/?i=9555
 [58] = https://curl.se/bug/?i=9598
 [59] = https://curl.se/bug/?i=9551
 [60] = https://curl.se/bug/?i=9548
 [61] = https://curl.se/bug/?i=9540
 [62] = https://curl.se/bug/?i=9585
 [63] = https://curl.se/bug/?i=9463
 [64] = https://curl.se/bug/?i=9088
 [65] = https://curl.se/bug/?i=9586
 [66] = https://curl.se/bug/?i=9591
 [67] = https://curl.se/bug/?i=9513
 [68] = https://curl.se/bug/?i=9582
 [69] = https://curl.se/bug/?i=9575
 [70] = https://curl.se/bug/?i=9576
 [71] = https://curl.se/bug/?i=9534
 [72] = https://curl.se/bug/?i=9542
 [73] = https://curl.se/bug/?i=9572
 [74] = https://curl.se/bug/?i=9569
 [75] = https://curl.se/bug/?i=9574
 [76] = https://curl.se/bug/?i=9623
 [77] = https://curl.se/bug/?i=9624
 [78] = https://curl.se/bug/?i=9619
 [79] = https://curl.se/bug/?i=9625
 [80] = https://curl.se/bug/?i=9639
 [81] = https://curl.se/bug/?i=9565
 [82] = https://curl.se/bug/?i=9610
 [83] = https://curl.se/mail/archive-2022-02/0041.html
 [84] = https://curl.se/bug/?i=9612
 [85] = https://curl.se/bug/?i=9614
 [86] = https://curl.se/bug/?i=9607
 [87] = https://curl.se/bug/?i=9592
 [88] = https://curl.se/bug/?i=9608
 [89] = https://curl.se/bug/?i=9605
 [90] = https://curl.se/bug/?i=9600
 [91] = https://curl.se/bug/?i=9584
 [92] = https://curl.se/bug/?i=9632
 [93] = https://curl.se/bug/?i=9694
 [94] = https://curl.se/bug/?i=9659
 [95] = https://curl.se/bug/?i=9630
 [96] = https://curl.se/bug/?i=9628
 [97] = https://curl.se/bug/?i=9684
 [98] = https://curl.se/bug/?i=9686
 [99] = https://curl.se/bug/?i=9683
 [100] = https://curl.se/bug/?i=9681
 [101] = https://curl.se/bug/?i=9729
 [102] = https://curl.se/bug/?i=9682
 [103] = https://curl.se/bug/?i=9709
 [104] = https://curl.se/bug/?i=9790
 [105] = https://curl.se/bug/?i=9728
 [106] = https://curl.se/bug/?i=9658
 [107] = https://curl.se/bug/?i=9747
 [108] = https://curl.se/bug/?i=9664
 [109] = https://curl.se/bug/?i=9712
 [110] = https://curl.se/bug/?i=9646
 [111] = https://curl.se/bug/?i=9776
 [112] = https://curl.se/bug/?i=9719
 [113] = https://curl.se/bug/?i=9663
 [115] = https://curl.se/bug/?i=9661
 [117] = https://curl.se/bug/?i=9652
 [118] = https://curl.se/bug/?i=9657
 [119] = https://curl.se/bug/?i=9654
 [120] = https://curl.se/bug/?i=9656
 [121] = https://curl.se/bug/?i=9653
 [122] = https://curl.se/bug/?i=9718
 [123] = https://curl.se/bug/?i=9711
 [124] = https://curl.se/bug/?i=9643
 [125] = https://curl.se/mail/lib-2022-10/0007.html
 [126] = https://curl.se/bug/?i=9637
 [127] = https://curl.se/bug/?i=9651
 [128] = https://curl.se/bug/?i=9648
 [129] = https://curl.se/bug/?i=9633
 [130] = https://curl.se/bug/?i=9645
 [131] = https://curl.se/bug/?i=9642
 [132] = https://curl.se/bug/?i=9737
 [133] = https://curl.se/bug/?i=9744
 [134] = https://curl.se/bug/?i=9707
 [135] = https://curl.se/bug/?i=9697
 [136] = https://curl.se/bug/?i=9700
 [137] = https://curl.se/bug/?i=9698
 [138] = https://curl.se/bug/?i=9701
 [139] = https://curl.se/bug/?i=7966
 [140] = https://curl.se/bug/?i=9791
 [141] = https://curl.se/bug/?i=9300
 [142] = https://curl.se/bug/?i=9680
 [143] = https://curl.se/bug/?i=9687
 [144] = https://github.com/curl/curl-for-win/blob/73a070d96fd906fdee929e2f1f00a9149fb39239/curl-autotools.sh#L44-L47
 [145] = https://curl.se/bug/?i=9689
 [146] = https://curl.se/bug/?i=9726
 [147] = https://curl.se/bug/?i=9727
 [148] = https://curl.se/bug/?i=9725
 [149] = https://curl.se/bug/?i=9731
 [150] = https://curl.se/bug/?i=9771
 [151] = https://curl.se/bug/?i=9732
 [152] = https://curl.se/bug/?i=9770
 [154] = https://curl.se/bug/?i=9763
 [155] = https://curl.se/bug/?i=9705
 [156] = https://curl.se/bug/?i=9451
 [157] = https://curl.se/bug/?i=9760
 [158] = https://curl.se/bug/?i=9762
 [159] = https://curl.se/bug/?i=9761
 [160] = https://curl.se/bug/?i=9759
 [161] = https://curl.se/bug/?i=9757
 [162] = https://curl.se/bug/?i=9754
 [163] = https://curl.se/bug/?i=9753
 [164] = https://curl.se/bug/?i=9414
 [165] = https://curl.se/bug/?i=9749
 [166] = https://curl.se/bug/?i=9751
 [167] = https://curl.se/bug/?i=9752
 [169] = https://curl.se/bug/?i=9417
 [170] = https://curl.se/bug/?i=9415
 [171] = https://curl.se/bug/?i=9419
 [172] = https://curl.se/bug/?i=9418
 [173] = https://curl.se/bug/?i=9394
 [174] = https://curl.se/bug/?i=9789
 [175] = https://curl.se/bug/?i=9389
 [176] = https://curl.se/bug/?i=8933
 [177] = https://curl.se/bug/?i=9214
 [179] = https://curl.se/bug/?i=9784
 [181] = https://curl.se/bug/?i=9766
 [182] = https://curl.se/bug/?i=9779
 [184] = https://curl.se/bug/?i=9773
 [186] = https://curl.se/bug/?i=9638
 [187] = https://curl.se/bug/?i=9755