RELEASE-NOTES 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379
  1. curl and libcurl 7.85.0
  2. Public curl releases: 210
  3. Command line options: 248
  4. curl_easy_setopt() options: 299
  5. Public functions in libcurl: 88
  6. Contributors: 2690
  7. This release includes the following changes:
  8. o quic: add support via wolfSSL [142]
  9. o schannel: Add TLS 1.3 support [96]
  10. o setopt: add CURLOPT_PROTOCOLS_STR and CURLOPT_REDIR_PROTOCOLS_STR [30]
  11. This release includes the following bugfixes:
  12. o amigaos: fix threaded resolver on AmigaOS 4.x [133]
  13. o amissl: allow AmiSSL to be used with AmigaOS 4.x builds [115]
  14. o amissl: make AmiSSL v5 a minimum requirement [117]
  15. o asyn-ares: make a single alloc out of hostname + async data [123]
  16. o asyn-thread: fix socket leak on OOM [128]
  17. o asyn-thread: make getaddrinfo_complete return CURLcode [53]
  18. o base64: base64url encoding has no padding [41]
  19. o BUGS.md: improve language [62]
  20. o build: improve OS string in CMake and `config-win32.h` [15]
  21. o cert.d: clarify that escape character works for file paths [161]
  22. o cirrus.yml: replace py38-pip with py39-pip [63]
  23. o cirrus/freebsd-ci: bootstrap the pip installer [104]
  24. o cmake: add detection of threadsafe feature [163]
  25. o cmake: do not force Windows target versions [28]
  26. o cmake: fix build for mingw cross compile [33]
  27. o cmake: link curl to its dependencies with PRIVATE [57]
  28. o cmake: remove APPEND in export(TARGETS) [58]
  29. o cmake: set feature PSL if present [168]
  30. o cmake: support ngtcp2 boringssl backend [18]
  31. o cmdline-opts/gen.pl: improve performance [97]
  32. o config: remove the check for and use of SIZEOF_SHORT [129]
  33. o configure: -pthread not available on AmigaOS 4.x [118]
  34. o configure: check for the stdatomic.h header in configure [7]
  35. o configure: fix --disable-headers-api [55]
  36. o configure: fix broken m4 syntax in TLS options [145]
  37. o configure: fixup bsdsocket detection code for AmigaOS 4.x [110]
  38. o configure: if asked to use TLS, fail if no TLS lib was detected [156]
  39. o configure: introduce CURL_SIZEOF [130]
  40. o connect: add quic connection information [100]
  41. o connect: close the happy eyeballs loser connection when using QUIC [109]
  42. o connect: revert the use of IP*_RECVERR [102]
  43. o connect: set socktype/protocol correctly [114]
  44. o cookie: reject cookies with "control bytes" [152]
  45. o cookie: treat a blank domain in Set-Cookie: as non-existing [40]
  46. o cookie: use %zu to infof() for size_t values [26]
  47. o curl-compilers.m4: make icc use -diag* options and disable two warnings [84]
  48. o curl-config: quote directories with potential space [132]
  49. o curl-confopts: remove leftover AC_REQUIREs [91]
  50. o curl-functions.m4: check whether atomics can link [86]
  51. o curl-wolfssl.m4: add options header when building test code [87]
  52. o curl.h: CURLE_CONV_FAILED is obsoleted [4]
  53. o curl.h: include <sys/select.h> on SunOS [151]
  54. o curl: output warning when a cookie is dropped due to size [5]
  55. o curl: writeout: fix repeated header outputs [47]
  56. o Curl_close: call Curl_resolver_cancel to avoid memory-leak [124]
  57. o curl_easy_header: Add CURLH_PSEUDO to sanity check [94]
  58. o curl_mime_data.3: polish the wording [6]
  59. o curl_multi_timeout.3: clarify usage [48]
  60. o CURLINFO_SPEED_UPLOAD/DOWNLOAD.3: fix examples [121]
  61. o CURLOPT_BUFFERSIZE.3: add upload buffersize to see also [159]
  62. o CURLOPT_CONNECT_ONLY.3: clarify multi API use [64]
  63. o CURLOPT_SERVER_RESPONSE_TIMEOUT: the new name [16]
  64. o digest: fix memory leak, fix not quoted 'opaque' [66]
  65. o digest: fix missing increment of 'nc' value for auth-int [39]
  66. o digest: pass over leading spaces in qop values [119]
  67. o digest: reject broken header with session protocol but without qop [120]
  68. o docs/cmdline-opts/gen.pl: encode leading single and double quotes [138]
  69. o docs/cmdline-opts: fix example and categories for --form-escape [125]
  70. o docs/cmdline: mark fail and fail-with-body as mutually exclusive [98]
  71. o docs: add dns category to --resolve [95]
  72. o docs: explain curl_easy_escape/unescape curl handle is ignored [23]
  73. o docs: remove him/her/he/she from documentation [103]
  74. o doh: move doh related struct definitions to doh.h [45]
  75. o doh: use https protocol by default [51]
  76. o easy_lock.h: include sched.h if available to fix build [13]
  77. o easy_lock.h: use __asm__ instead of asm to fix build [11]
  78. o easy_lock: fix build for mingw [34]
  79. o easy_lock: fix build with icc [54]
  80. o easy_lock: fix the #ifdef conditional for ia32_pause [8]
  81. o easy_lock: switch to using atomic_int instead of bool [9]
  82. o easyoptions: fix icc warning [42]
  83. o escape: remove outdated comment [25]
  84. o examples/curlx.c: remove [150]
  85. o file: add handling of native AmigaOS paths [108]
  86. o file: fix icc enumerated type mixed with another type warning [92]
  87. o ftp: use a correct expire ID for timer expiry [88]
  88. o getinfo: return better error on NULL as first argument [21]
  89. o GHA: add two Intel compiler CI jobs [85]
  90. o GHA: move libressl CI from zuul to GitHub [144]
  91. o gha: move over ngtcp2-gnutls CI job from zuul [162]
  92. o GHA: mv CI torture test from Zuul [135]
  93. o h2h3: fix overriding the 'TE: Trailers' header [43]
  94. o hostip: resolve *.localhost to 127.0.0.1/::1 [127]
  95. o HTTP3.md: update to msh3 v0.4.0 [126]
  96. o http: typecast the httpreq assignment to avoid icc compiler warning [76]
  97. o http_aws_sigv4.c: remove two unusued includes [36]
  98. o http_chunks: remove an assign + typecast [82]
  99. o hyper: customize test1274 to how hyper unfolds headers [131]
  100. o hyper: enable obs-folded multiline headers [101]
  101. o hyper: use wakers for curl pause/resume [2]
  102. o imap: use ISALNUM() for alphanumeric checks [134]
  103. o ldap: adapt to conn->port now being an 'int' [106]
  104. o lib/curl_path.c: add ISC to license expression [1]
  105. o lib3026: reduce the number of threads to 100 [44]
  106. o libcurl-security.3: fix typo on macro "SH_" [12]
  107. o libssh2: make atime/mtime date overflow return error [148]
  108. o libssh2: provide symlink name in SFTP dir listing [155]
  109. o libssh: ignore deprecation warnings [157]
  110. o libssh: make atime/mtime date overflow return error [149]
  111. o Makefile.m32: add `CURL_RC` and `CURL_STRIP` variables [ci skip] [17]
  112. o Makefile.m32: add `NGTCP2_LIBS` option [ci skip] [38]
  113. o makefile.m32: add support for custom ARCH [ci skip] [27]
  114. o Makefile.m32: allow -nghttp3/-ngtcp2 without -ssl [ci skip] [141]
  115. o Makefile.m32: do not set the libcurl.rc debug flag [ci skip] [3]
  116. o Makefile.m32: stop trying to build libcares.a [ci skip] [46]
  117. o memdebug: add annotation attributes [143]
  118. o mprintf: fix *dyn_vprintf() when out-of-memory [90]
  119. o mprintf: make dprintf_formatf never return negative [49]
  120. o msh3: fix the QUIC disconnect function [107]
  121. o multi: fix the return code from Curl_pgrsDone() [80]
  122. o multi: have curl_multi_remove_handle close CONNECT_ONLY transfer [136]
  123. o multi: use a pipe instead of a socketpair on apple platforms [154]
  124. o multi: use larger dns hash table for multi interface [140]
  125. o multi_wait: fix and improve Curl_poll error handling on Windows [146]
  126. o multi_wait: fix skipping to populate revents for extra_fds [147]
  127. o netrc.d: remove spurious quote [37]
  128. o netrc: Use the password from lines without login [166]
  129. o ngtcp2: Fix build error due to change in nghttp3 prototypes [61]
  130. o ngtcp2: fix incompatible function pointer types [10]
  131. o ngtcp2: Fix missing initialization of nghttp3_nv.flags [31]
  132. o ngtcp2: fix stall or busy loop on STOP_SENDING with upload data [19]
  133. o ngtcp2: implement cb_h3_stop_sending and cb_h3_reset_stream callbacks [59]
  134. o openssl: add `CURL_BORINGSSL_VERSION` to identify BoringSSL [24]
  135. o openssl: add cert path in error message [160]
  136. o openssl: add details to "unable to set client certificate" error [116]
  137. o openssl: fix BoringSSL symbol conflicts with LDAP and Schannel [52]
  138. o quiche: fix build failure [99]
  139. o select: do not return fatal error on EINTR from poll() [32]
  140. o sendf: fix paused header writes since after the header API [89]
  141. o sendf: make Curl_debug a void function [81]
  142. o sendf: skip storing HTTP headers if HTTP disabled [73]
  143. o sendf: store the header type in an usigned char to avoid icc warnings [79]
  144. o splay: avoid using -1 in unsigned variable [78]
  145. o test3026: add support for Windows using native Win32 threads [65]
  146. o test3026: require 'threadsafe' [56]
  147. o test44[2-4]: add '--resolve' to the keywords [122]
  148. o tests/server/sockfilt.c: avoid race condition without a mutex [139]
  149. o tests: fix http2 tests to use CRLF headers [153]
  150. o tests: several enumerated type cleanups [67]
  151. o THANKS: merged two entries for Evgeny Grin
  152. o tidy-up: delete unused build configuration macros [93]
  153. o tool: reintroduce set file comment code for AmigaOS [111]
  154. o tool_cfgable: make 'synthetic_error' a plain bool [70]
  155. o tool_formparse: fix variable may be used before its value is set [72]
  156. o tool_getparam: make --doh-url "" switch it off [60]
  157. o tool_getparam: repair cleanarg [22]
  158. o tool_operate: better cleanup of easy handle in exit path [20]
  159. o tool_paramhlp: fix "enumerated type mixed with another type" [68]
  160. o tool_paramhlp: make check_protocol return ParameterError [71]
  161. o tool_progress: avoid division by zero in parallel progress meter [35]
  162. o tool_writeout: fix enumerated type mixed with another type [69]
  163. o trace: 0x7F character is non-printable [50]
  164. o unit1303: four tests should have TRUE for 'connecting' [158]
  165. o url: enumerated type mixed with another type [74]
  166. o url: really use the user provided in the url when netrc entry exists [165]
  167. o url: reject URLs with hostnames longer than 65535 bytes [137]
  168. o url: treat missing usernames in netrc as empty [167]
  169. o urldata: change second proxytype field to unsigned char to match [75]
  170. o urldata: make 'negnpn' use less storage [112]
  171. o urldata: make state.httpreq an unsigned char [77]
  172. o urldata: make three *_proto struct fields smaller [113]
  173. o urldata: move smaller fields down in connectdata struct [105]
  174. o urldata: reduce size of several struct fields [14]
  175. o vtls: make Curl_ssl_backend() return the enum type curl_sslbackend [83]
  176. o windows: improve random source [29]
  177. This release includes the following known bugs:
  178. o see docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)
  179. This release would not have looked like this without help, code, reports and
  180. advice from friends like these:
  181. Adam Sampson, Alessandro Ghedini, Alexandre Bury, Andreas Sommer,
  182. Andrew Lambert, Axel Chong, Brad Forschinger, Brian Carpenter,
  183. Cering on github, Chris Paulson-Ellis, Chris Young, Daniel Katz,
  184. Daniel Stenberg, David Carlier, dEajL3kA on github, Domen Kožar,
  185. Dominik Thalhammer, Don J Olmstead, Dustin Howett, Emanuele Torre,
  186. Emil Engler, Érico Nogueira Rolim, Even Rouault, Evgeny Grin (Karlson2k),
  187. Fabian Fischer, Fabian Keil, Gisle Vanem, Gwen Shapira, Harry Sintonen,
  188. highmtworks on github, Ivan Tsybulin, Jacob Tolar, Jakub Zakrzewski,
  189. Jilayne Lovejoy, Joshua Root, jurisuk on github, jvvprasad78 on github,
  190. Kai Pastor, Litter White, lwthiker on github, Marcel Raad, Marc Hörsken,
  191. Marco Kamner, MasterInQuestion on github, Matthew Thompson, Maxim Ivanov,
  192. Michael Trebilcock, Michał Antoniak, Nao Yonashiro, Nick Banks,
  193. Oliver Roberts, opensignature on github, Orgad Shaneh, Patrick Monnerat,
  194. Philip H, privetryan on github, Ray Satiro, rcombs on github, Rosen Penev,
  195. Ryan Schmidt, Ryan Sleevi, rzrymiak on github, Samuel Henrique,
  196. Sean McArthur, Sergey Ogryzkov, Somnath Kundu, Stefan Eissing,
  197. Sukanya Hanumanthu, Tatsuhiro Tsujikawa, Ted Lyngmo, TheKnarf on github,
  198. Thomas Weißschuh, Tobias Nygren, Viktor Szakats, vlubart on github, Wu Zheng,
  199. Wyatt O'Day, Xiaoke Wang, yiyuaner on github
  200. (79 contributors)
  201. References to bug reports and discussions on issues:
  202. [1] = https://curl.se/bug/?i=9073
  203. [2] = https://curl.se/bug/?i=9070
  204. [3] = https://curl.se/bug/?i=9069
  205. [4] = https://curl.se/bug/?i=9067
  206. [5] = https://curl.se/bug/?i=9064
  207. [6] = https://curl.se/bug/?i=9063
  208. [7] = https://curl.se/bug/?i=9059
  209. [8] = https://curl.se/bug/?i=9058
  210. [9] = https://curl.se/bug/?i=9055
  211. [10] = https://curl.se/bug/?i=9056
  212. [11] = https://curl.se/bug/?i=9056
  213. [12] = https://curl.se/bug/?i=9057
  214. [13] = https://curl.se/bug/?i=9054
  215. [14] = https://curl.se/bug/?i=9106
  216. [15] = https://curl.se/bug/?i=9117
  217. [16] = https://curl.se/bug/?i=9104
  218. [17] = https://curl.se/bug/?i=9132
  219. [18] = https://curl.se/bug/?i=9065
  220. [19] = https://curl.se/bug/?i=9122
  221. [20] = https://curl.se/bug/?i=9114
  222. [21] = https://curl.se/bug/?i=9114
  223. [22] = https://curl.se/bug/?i=9128
  224. [23] = https://curl.se/bug/?i=9115
  225. [24] = https://curl.se/bug/?i=9113
  226. [25] = https://curl.se/bug/?i=9115
  227. [26] = https://curl.se/bug/?i=9095
  228. [27] = https://curl.se/bug/?i=9092
  229. [28] = https://curl.se/bug/?i=9046
  230. [29] = https://curl.se/bug/?i=9027
  231. [30] = https://curl.se/bug/?i=8992
  232. [31] = https://curl.se/bug/?i=9118
  233. [32] = https://bugs.archlinux.org/task/75201
  234. [33] = https://curl.se/bug/?i=9084
  235. [34] = https://curl.se/bug/?i=8997
  236. [35] = https://curl.se/bug/?i=9082
  237. [36] = https://curl.se/bug/?i=9080
  238. [37] = https://curl.se/bug/?i=9111
  239. [38] = https://curl.se/bug/?i=9109
  240. [39] = https://curl.se/bug/?i=9090
  241. [40] = https://curl.se/bug/?i=9164
  242. [41] = https://curl.se/bug/?i=9139
  243. [42] = https://curl.se/bug/?i=9176
  244. [43] = https://curl.se/bug/?i=9170
  245. [44] = https://curl.se/bug/?i=9172
  246. [45] = https://curl.se/bug/?i=9174
  247. [46] = https://curl.se/bug/?i=9169
  248. [47] = https://curl.se/bug/?i=9150
  249. [48] = https://curl.se/bug/?i=9155
  250. [49] = https://curl.se/bug/?i=9149
  251. [50] = https://curl.se/bug/?i=9162
  252. [51] = https://curl.se/bug/?i=9163
  253. [52] = https://curl.se/bug/?i=9110
  254. [53] = https://curl.se/bug/?i=9081
  255. [54] = https://curl.se/bug/?i=9081
  256. [55] = https://curl.se/bug/?i=9134
  257. [56] = https://curl.se/bug/?i=9141
  258. [57] = https://curl.se/bug/?i=9125
  259. [58] = https://curl.se/bug/?i=9124
  260. [59] = https://curl.se/bug/?i=9135
  261. [60] = https://curl.se/bug/?i=9207
  262. [61] = https://curl.se/bug/?i=9204
  263. [62] = https://curl.se/bug/?i=9205
  264. [63] = https://curl.se/bug/?i=9201
  265. [64] = https://curl.se/bug/?i=9244
  266. [65] = https://curl.se/bug/?i=9012
  267. [66] = https://curl.se/bug/?i=9199
  268. [67] = https://curl.se/bug/?i=9179
  269. [68] = https://curl.se/bug/?i=9179
  270. [69] = https://curl.se/bug/?i=9179
  271. [70] = https://curl.se/bug/?i=9179
  272. [71] = https://curl.se/bug/?i=9179
  273. [72] = https://curl.se/bug/?i=9179
  274. [73] = https://curl.se/bug/?i=9179
  275. [74] = https://curl.se/bug/?i=9179
  276. [75] = https://curl.se/bug/?i=9179
  277. [76] = https://curl.se/bug/?i=9179
  278. [77] = https://curl.se/bug/?i=9179
  279. [78] = https://curl.se/bug/?i=9179
  280. [79] = https://curl.se/bug/?i=9179
  281. [80] = https://curl.se/bug/?i=9179
  282. [81] = https://curl.se/bug/?i=9179
  283. [82] = https://curl.se/bug/?i=9179
  284. [83] = https://curl.se/bug/?i=9179
  285. [84] = https://curl.se/bug/?i=9179
  286. [85] = https://curl.se/bug/?i=9179
  287. [86] = https://curl.se/bug/?i=9190
  288. [87] = https://curl.se/bug/?i=9187
  289. [88] = https://curl.se/bug/?i=9184
  290. [89] = https://curl.se/bug/?i=9180
  291. [90] = https://curl.se/bug/?i=9185
  292. [91] = https://curl.se/bug/?i=9183
  293. [92] = https://curl.se/bug/?i=9181
  294. [93] = https://curl.se/bug/?i=9044
  295. [94] = https://curl.se/bug/?i=9235
  296. [95] = https://curl.se/bug/?i=9229
  297. [96] = https://curl.se/bug/?i=8419
  298. [97] = https://curl.se/bug/?i=9230
  299. [98] = https://curl.se/bug/?i=9221
  300. [99] = https://curl.se/bug/?i=9223
  301. [100] = https://curl.se/bug/?i=9286
  302. [101] = https://curl.se/bug/?i=9216
  303. [102] = https://curl.se/bug/?i=9209
  304. [103] = https://curl.se/bug/?i=9208
  305. [104] = https://curl.se/bug/?i=9213
  306. [105] = https://curl.se/bug/?i=9280
  307. [106] = https://curl.se/bug/?i=9281
  308. [107] = https://curl.se/bug/?i=8915
  309. [108] = https://curl.se/bug/?i=9259
  310. [109] = https://curl.se/bug/?i=9303
  311. [110] = https://curl.se/bug/?i=9268
  312. [111] = https://curl.se/bug/?i=9258
  313. [112] = https://curl.se/bug/?i=9279
  314. [113] = https://curl.se/bug/?i=9278
  315. [114] = https://curl.se/bug/?i=9274
  316. [115] = https://curl.se/bug/?i=9269
  317. [116] = https://curl.se/bug/?i=9228
  318. [117] = https://curl.se/bug/?i=9267
  319. [118] = https://curl.se/bug/?i=9266
  320. [119] = https://curl.se/bug/?i=9264
  321. [120] = https://curl.se/bug/?i=9077
  322. [121] = https://curl.se/bug/?i=9239
  323. [122] = https://curl.se/bug/?i=9250
  324. [123] = https://curl.se/bug/?i=9310
  325. [124] = https://curl.se/bug/?i=9310
  326. [125] = https://curl.se/bug/?i=9298
  327. [126] = https://curl.se/bug/?i=9297
  328. [127] = https://curl.se/bug/?i=9192
  329. [128] = https://curl.se/bug/?i=9310
  330. [129] = https://curl.se/bug/?i=9291
  331. [130] = https://curl.se/bug/?i=9291
  332. [131] = https://curl.se/bug/?i=9217
  333. [132] = https://curl.se/bug/?i=9253
  334. [133] = https://curl.se/bug/?i=9265
  335. [134] = https://curl.se/bug/?i=9289
  336. [135] = https://curl.se/bug/?i=9310
  337. [136] = https://curl.se/bug/?i=9335
  338. [137] = https://curl.se/bug/?i=9317
  339. [138] = https://curl.se/bug/?i=9352
  340. [139] = https://curl.se/bug/?i=9023
  341. [140] = https://curl.se/bug/?i=9376
  342. [141] = https://curl.se/bug/?i=9314
  343. [142] = https://curl.se/bug/?i=9290
  344. [143] = https://curl.se/bug/?i=9306
  345. [144] = https://curl.se/bug/?i=9309
  346. [145] = https://curl.se/bug/?i=9344
  347. [146] = https://curl.se/bug/?i=9372
  348. [147] = https://curl.se/bug/?i=9361
  349. [148] = https://curl.se/bug/?i=9328
  350. [149] = https://curl.se/bug/?i=9328
  351. [150] = https://curl.se/bug/?i=9330
  352. [151] = https://curl.se/bug/?i=9329
  353. [152] = https://curl.se/docs/CVE-2022-35252.html
  354. [153] = https://curl.se/bug/?i=9364
  355. [154] = https://curl.se/bug/?i=6132
  356. [155] = https://curl.se/bug/?i=9369
  357. [156] = https://curl.se/bug/?i=9367
  358. [157] = https://curl.se/bug/?i=9382
  359. [158] = https://curl.se/bug/?i=9356
  360. [159] = https://curl.se/bug/?i=9354
  361. [160] = https://curl.se/bug/?i=9349
  362. [161] = https://curl.se/bug/?i=9349
  363. [162] = https://curl.se/bug/?i=9331
  364. [163] = https://curl.se/bug/?i=9312
  365. [165] = https://curl.se/bug/?i=9243
  366. [166] = https://curl.se/bug/?i=9248
  367. [167] = https://curl.se/bug/?i=8653
  368. [168] = https://curl.se/bug/?i=9391