curl

curl / Docs / Releases / Changes in 8.21.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.20.0 all changes pending release

Changes in 8.21.0 - June 24 2026

8.21.0 8.21.0 Changes:

• curl: named globs in output filename for upload glob references
• HTTP/3: add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC)
• http2: remove stream dependency tracking
• lib: drop support for CURLAUTH_DIGEST_IE
• libssh: add support for SHA256 host public keys
• tool_urlglob: add named globs Bugfixes:
• _ENVIRONMENT.md. Windows does case insensitive env variables
• _URL.md: remove the zone-id mention
• AmigaOS: curl_setup.h avoid explicit_bzero with clib2
• AmigaOS: fix build fallouts, re-add to CI
• asyn-thrdd: add IPv6 guards
• asyn-thrdd: fix result processing without wakeup socketpair
• autotools: mbedtls detection fixes
• BINDINGS: Update Hollywood link
• BUFQ.md: re-sync with source code
• build: enable -Wlogical-op picky warning for GCC 4.4+
• build: omit zlib pkg-config reference for Android
• cf-h2-prox: fix peer leak
• cf-h2-proxy: drop interim responses
• cf-https-connect: do not engage on proxy origin
• cf-ip-happy.c: minor comment typo
• cf-ip-happy: update documentation
• cf-socket: make Curl_addr2string static
• cf-socket: set scope_id for IPv6 link-local addresses
• cf-socket: store errno from do_connect in ctx->error
• cfilters: fix busy loop on blocked transfers
• chunked: reject invalid bytes in trailer
• CIPHERS.md: fix the example that uses only TLS 1.3
• cmake/FindGSS: drop "MIT Unknown" version value, related tidy ups
• cmake/FindGSS: drop CMake <3.16 compatibility logic
• cmake/FindGSS: fix comment, adjust custom flavor property name
• cmake/FindGSS: prioritize MIT over GNU in pkg-config detection
• cmake: auto-select static nghttp2/nghttp3/ngtcp2 Config
• cmake: export/forward NGTCP2_CRYPTO_BACKEND
• cmake: fix three issues generating lib options in config files
• cmake: fix zstd CMake config name
• cmake: opt in MSVC_VERSION 1951 to picky warnings
• cmake: quote COMPONENTS string in curl-config.in.cmake
• cmake: simplify LINK_ONLY imported target extraction
• config2setopts: use default protocol properly
• connect: remove deref of freed pointer in trace call
• content_encoding: fix limit failure message
• content_encoding: fix non-last chunked rejection
• content_encoding: timeout during slow decoding
• cookie: check __Secure- and __Host- case sensitively when read from file
• cookie: compare path case sensitively
• cookie: reject control octets in file-loaded cookies
• cookie: simplify strstore(), remove outdated comment
• cookie: tailmatch the domains for secure override
• cookie: trim trailing dots when checking PSL
• creds: add sasl service name
• creds: create with empty user+pass
• creds: mask OAuth bearer token in trace logs
• creds: remove two unused functions
• curl_easy_pause.md: rephrase the stream cache when pause clause
• curl_easy_setopt.md: change options when no transfer runs
• curl_formdata: fix to pass long where missing, document CURLFORM_NAMELENGTH
• curl_multi_assign.md: clarify lifetime
• curl_ntlm_core: fix nettle 4+ builds in certain MultiSSL combos
• curl_ntlm_core: propagate DES CryptEncrypt() error
• curl_sha512_256: fix result code on error
• CURLINFO_CONTENT_LENGTH_UPLOAD_T.md: expand
• CURLMOPT_SOCKETFUNCTION.md: this sends all file descriptors
• CURLOPT_CHUNK_BGN_FUNCTION: target is there for symlinks only
• CURLOPT_DISALLOW_USERNAME_IN_URL: is for CURLOPT_URL only
• CURLOPT_DOH_URL.md: does not inherit proxy options
• CURLOPT_ECH.md: simplify the description language
• CURLOPT_HAPROXYPROTOCOL.md: only sent for newly setup connections
• CURLOPT_MAXFILESIZE: clarify this also works for on-going transfers
• CURLOPT_PINNEDPUBLICKEY.md: does not apply for other origins
• CURLOPT_PORT.md: use stronger language
• CURLOPT_SHARE: warn about early remove
• CURLOPT_SSH_HOSTKEYFUNCTION.md: for new connections only
• CURLOPT_WRITEFUNCTION.md: mention redirects
• CURLOPT_WRITEFUNCTION.md: remove stray reference to HSTS
• delta: harden external command invocations
• digest: escape control codes too
• digest: flush proxy state on proxy or credential change
• digest: flush state on origin or credential change
• dns-httpsrr-lookup: use origin, not peer
• dnscache: remove Curl_dns_entry_link
• docs/libcurl: fix the version for curl_multi_socket_action
• docs: end "...can be used several times..." sentences with period
• docs: fix --follow doc typo
• docs: fix a couple of typos
• docs: fix grammar and wording in FAQ
• docs: fix odd wording in CONTRIBUTE.md
• docs: note CURLOPT_PINNEDPUBLICKEY has no effect on legacy LDAP backend
• docs: returned header size reflects HTTP/1-style format
• doh: cap the maximum TTL to 24 hours
• doh: stricter HTTPS RNAME parsing
• ECH: cleanups
• event: fix wakeup consumption
• ftp: avoid accessing EPSV response one byte past the NULL
• ftp: remove 2 Curl_resolv_blocking() calls
• ftp: remove bits.ftp_use_control_ssl
• ftplistparser: clear strings.target if not symlink
• gnutls: allow building with nettle 4.0
• gnutls: fix more nettle 4+ compatibility issues
• gnutls: require 3.7.2 for earlydata
• gsasl: fix potential double free
• gtls: fix ignored return and uninitialized status in OCSP check
• gtls: fix some typos
• gtls: minor fixes and improvements
• gtls: use the correct return code in trace output
• gtls: verify OCSP response signature in gtls_verify_ocsp_status
• h3-proxy: fix callback return values, and a typo in tests
• hostip: remove unused MAX_HOSTCACHE_LEN and MAX_DNS_CACHE_SIZE
• hsts.md: mention multiple curl invokes effect
• hsts: duplicate live HSTS data in curl_easy_duphandle
• http-proxy: verify CONNECT response headers
• HTTP3.md: update quiche build
• http: don't pass on set cookies to new origins
• http: prefer chunked encoding over Content-Length: 0
• http: reject spurious CR bytes in headers
• http_digest: return better error
• idn: replace header guards with forward declaration
• INSTALL-CMAKE.md: document CMake environment variables
• INTERNALS.md: document minimum nghttp3 and ngtcp2 versions
• KNOWN_BUGS.md: remove fixed GnuTLS <-> OpenSSL incompat bug
• KNOWN_BUGS: remove stale Threads::Threads entry
• krb5_sspi: fix error message on DecryptMessage() fail
• ldap: base64 encode binary LDIF values with WinLDAP
• ldap: fix minor leak on write callback error
• ldap: fix to not leak attribute on OOM (WinLDAP)
• ldap: switch off chasing referrals
• lib678: fix to not be perma-skipped
• lib: make __STDC_VERSION__ literals L (where missing)
• lib: transfer origin and proxy handling
• lib: two minor typos
• libcurl-easy.md: minor clarifications
• libssh2: do not use deprecated macros when unavailable
• libssh2: drop stray double-negative from strncmp() result
• libssh2: fix to return error code on missing parameter
• libssh2: replace macro names with non-misspelled alternatives
• libssh2: save non-standard port to known_hosts
• libssh2: sync version check with INTERNALS.md
• libssh2: use non-deprecated libssh2_knownhost_addc()
• libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
• m4: drop redundant conditions in TLS library detections
• Makefile.am: drop test1190 listed twice
• managen: apply minor fixes and improvements
• mbedtls: null-terminate the private key blob
• mk-unity.pl: #include, and not concatenate input headers
• mqtt: return error on truncated Remaining Length
• mqtt: validate PINGRESP and DISCONNECT have remaining_length == 0
• multi: handle pause in multi socket callback
• multi: remove a stale comment
• multi: silence gcc 16 -Wnull-dereference, bump CI job to test
• multi: xfers_really_alive
• netrc: remember and check filename loaded
• netrc: scanner refactor
• ngtcp2: fail handshake directly
• openssl: do not mix OpenSSL int result with CURLcode variable
• os400sys: fix theoretical length overflows
• peer.h: fix typo in comment
• pingpong: reject nul byte in server response line
• progress: fix CURLINFO time reporting
• psl: require libpsl 0.16.0 (2016-12-10) or greater
• pytest: pass --disable to curl
• pytest: re-enable test test_05_01 and test_05_02 for quiche 0.29.0+
• pythonlint.sh: make it fail on error, fix ruff warnings in pytest
• quic: count zero length packets against max
• ratelimits: use minimal burst rate
• RELEASE-PROCEDURE.md: update coming release dates
• resolve: mention in error that IP address is expected
• rtsp: bump buf after rtsp_filter_rtp()
• runner.pm: apply minor correctness fix
• runner.pm: set CURL_TESTNUM for precheck commands
• runtests: fix tests for curl builds with embedded CA bundle
• rustls: error on CURLOPT_CRLFILE with native CA store
• schannel: check schannel_sha256sum() success, and more
• schannel: enforce Extended Key Usage for custom CA roots
• schannel: error on TLS 1.3-only with cipher list
• schannel: fix https proxy for client cert and certinfo
• schannel: fix revoke_best_effort setting for proxy
• schannel: use fopen instead CreateFile
• schannel_verify: avoid out of blob access
• schannel_verify: simplify CryptQueryObject use
• scripts: catch Credits-to contributors
• SECURITY-ADVISORY.md: expand
• setopt: changing the proxy port is also a proxy change
• setopt: clear proxy auth properly on NULL
• setopt: clear the "custom" CA booleans when set to NULL
• setopt: CURLOPT_MAXCONNECTS set to 0 restores default value
• setopt: defref the old referer when setting a new
• setopt: fix to honor CURLOPT_PROXY_CAINFO_BLOB over Native CA
• setopt: gate a few proxy TLS options by checking backend support
• setopt: more careful cleanup of the HSTS cache
• setopt: return error if received curl_blob->data is NULL
• show-headers.md: mention bold headers and --no-styled-output
• sigv4: URL encode the username in the header
• smb: constify strchr() result variable
• smb: integer overflow proof a size check
• smbserver: update internal id generation for Python 3
• socket: introduce SOCK_EAGAIN() and use it
• socket: use name sockerr for socket error variables
• socks_sspi: invalid response length is a fatal error
• socks_sspi: store socks5_gssapi_enctype
• spnego_sspi: honor CURLOPT_GSSAPI_DELEGATION for Windows SSPI
• spnego_sspi: preserve distinction btw policy-only and uncond delegation
• src: fix comment typos
• src: sync nghttp2 versions checks with current requirements
• ssl native_ca_store: always reinit
• SSLCERTS: document 8.19.0 default Native CA builds (Windows)
• sspi: clear SSPI credentials on AcquireCredentialsHandle failure
• sspi: free libcurl allocated memory with curlx_free
• telnet: drop an int cast no longer necessary
• telnet: drop redundant interim variables
• telnet: fix error message typos
• telnet: fix old copy-paste typo in variable name
• telnet: honor CURLOPT_TIMEOUT in send_telnet_data()
• test1588: use %TESTNUMBER, not hard-coded number
• test1981: explicitly set the locale
• tests: add cookies feature to some tests
• tests: add an assert to avoid IPC blocking
• tests: add the "--resolve" keyword to tests that lack it
• tests: fix unit1636 with --disable-progress-meter
• tftp: avoid the timeout calc if the timeout is crazy
• tftp: stricter option name checks
• tidy-up: add space around operators, where missing
• tidy-up: apply clang-format fixes
• tidy-up: drop stray casts for allocated pointers
• tidy-up: miscellaneous
• tls: fix incomplete mTLS config in conn reuse and session cache
• tls: wolfssl: fixes for PQC key shares
• tool: warn when --ssl and --ftp-ssl-control override each other
• tool_formparse.c: fix two minor comment typos
• tool_formparse: polish error message + make two functions static
• tool_formparse: tool2curlparts is no longer recursive
• tool_help: rectify a bad assert
• tool_operhlp: avoid NULL to %s
• tool_urlglob: avoid overflow at end of range
• tool_urlglob: better 'Duplicate glob name' position
• tool_urlglob: make globbing error reported for correct position …

curl / Docs / Releases / Changes in 8.20.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.19.0 all changes 8.21.0 🠲

Changes in 8.20.0 - April 29 2026

8.20.0 8.20.0 Changes:

• async-thrdd: use thread queue for resolving
• build: make NTLM disabled by default
• cmake: drop support for CMake 3.17 and older
• lib: add thread pool and queue
• lib: drop support for < c-ares 1.16.0
• lib: make SMB support opt-in
• multi.h: add CURLMNWC_CLEAR_ALL
• rtmp: drop support Bugfixes:
• altsvc: cap the list at 5,000 entries
• altsvc: drop the prio field from the struct
• altsvc: skip expired entries read from file
• asyn-ares: connect async
• asyn-ares: drop orphaned variable references
• asyn-ares: fix HTTPS-lookup when not on port 443
• asyn-thrdd: drop redundant result check
• asyn-thrdd: fix clang-tidy unused value warning
• async-ares: fix query counter handling
• autotools: limit checksrc target to ignore non-repo test sources
• badwords-all: exit with correct code on errors
• badwords: combine the whitelisting into a single regex
• badwords: detect 'the the' and 'with with'
• badwords: only check comments and strings in source code
• badwords: rework exceptions, fix many of them
• boringssl: fix more coexist cases with Schannel/WinCrypt
• build: adjust/add casts to fix -Wformat-signedness
• build: assume snprintf() in mprintf, drop feature check
• build: compiler warning silencing tidy-ups
• build: drop openssl module dependency for BoringSSL from libcurl.pc
• build: drop duplicate pthread.h includes
• build: drop redundant USE_QUICHE guards
• build: enable -Wimplicit-int-enum-cast compiler warning, fix issues
• build: fix -Wformat-signedness by adjusting printf masks
• build: link bcrypt.lib via vcxproj files
• build: skip detecting pipe2() for Apple targets
• cf-https-connect: silence -Wimplicit-int-enum-cast with HTTPS-RR
• cf-https-connect: silence -Wimplicit-int-enum-cast with HTTPS-RR
• cf-ip-happy: limit concurrent attempts
• cf-socket: avoid low risk integer overflow on ancient Solaris
• cfilters: fix Curl_pollset_poll() return code mixup
• clang-tidy: avoid assignments in if expressions
• clang-tidy: enable more checks, fix fallouts
• cmake: add CMake Config-based dependency detection
• cmake: add CMake Config-based dependency detection for c-ares, wolfSSL
• cmake: document functions used from Windows system DLLs
• cmake: enable pthreads for BoringSSL/AWS-LC
• cmake: resolve targets recursively when generating libcurl.pc
• cmake: rework binutils ld hack to not read LOCATION property
• cmake: silence bad library Threads::Threads warning
• cmake: use AIX built-in variable (with CMake 4.0+)
• config2setopts: make --capath work in proxy disabled builds
• configure: fix --with-ngtcp2=<path> option for crypto libs
• configure: fix LibreSSL ngtcp2 1.15.0+ crypto lib selection logic
• configure: prefer dependency-specific variables over $withval
• configure: remove superfluous experimental warning for HTTP/3
• configure: silence useless clang warnings in C89 builds
• configure: tidy up comments
• connect: fix typo on error message
• cookie: fix rejection when tabs in value
• curl-wolfssl.m4: fix to use the correct value for pkg-config directory
• curl.h: replace macros with C++-friendly method to enforce 3 args
• curl_ctype.h: fix spelling in a couple of locally used macros
• curl_get_line: error out on read errors
• curl_get_line: fix potential infinite loop when filename is a directory
• curl_ngtcp2: extend and update callbacks for 1.22.0+
• curl_ntlm_core: drop redundant PP condition
• curl_ntlm_core: use wolfCrypt DES API with wolfSSL
• curl_setup.h: drop stray/unused USE_OPENSSL_QUIC guard
• curl_sha512_256: support delegating to wolfSSL API
• curl_version_info.md: clarify age details
• CURLOPT_HAPROXY_CLIENT_IP.md: mention assumption on data format
• CURLOPT_RTSP_SESSION_ID.md: clarify reuse "dangers"
• CURLOPT_RTSP_SESSION_ID.md: expand the comment
• CURLOPT_RTSP_SESSION_ID.md: minor language fix
• CURLOPT_SOCKS5_AUTH.md: an access property
• CURLOPT_SSL_CTX_FUNCTION.md: expand on effects connection reuse
• CURLOPT_UPLOAD_FLAGS.md: expand
• curlx_now(), prevent zero timestamp
• DEPRECATE: fix minor release number typo
• digest: pass in the username quoted (as well)
• dns: https-eyeballing async
• dnscache: own source file, improvements
• docs/cmdline-opts: tidy up retry-connrefused
• docs/lib: fix typos
• docs/libcurl: improve easy setopt examples
• docs: clarify retry-max-time timing
• docs: CURLOPT_LOGIN_OPTIONS is a login property
• docs: enable more compiler warnings for C snippets, fix 3 finds
• docs: list more dependencies for running Python HTTP tests
• docs: mention more zip bomb precautions
• docs: minor wording tweaks
• docs: noproxy wants the punycoded hostname version
• docs: SSH host verification is done at connect time
• docs: use the correct CURLOPT_WRITEFUNCTION signature
• doh: fix memory-leak when doing a second DoH resolve
• doh: remove superfluous doh_req check
• examples/websocket: fix to sleep more on Windows
• examples: drop warning silencers no longer hit
• examples: fix typo in comment
• file: init fd to -1 to prevent close fd 0 on early failure
• fopen: for temp files, inherit permissions only for owner
• ftp: do not strdup DATA hostname
• ftp: make the MDTM date parser stricter (again)
• ftp: reject PWD responses containing control characters
• gcc: guard #pragma diagnostic in core code for <4.6
• generate.bat: remove extra % from VC11 and VC12 runs
• genserv.pl: make external calls safe
• getinfo: initialize PureInfo field used_proxy
• getinfo: repair CURLINFO_TLS_SESSION
• gnutls: fix clang-tidy warning with !verbose
• gtls: fail for large files in load_file()
• h3: HTTPS-RR use in HTTP/3
• Happy Eyeballs: add resolution time delay
• haproxy: use correct ip version on client supplied address
• hostip: clear the sockaddr_in6 structure before use
• hostip: init the curl_jmpenv_lock appropriately
• hostip: resolve user supplied ip addresses
• HSTS: cap the list
• hsts: make the HSTS read callback handle name dupes
• hsts: skip expired HSTS entries read from file
• hsts: when a dupe host adds subdomains, use that
• http2: clear the h2 session at delete
• http2: prevent secure schemes pushed over insecure connections
• http2: return error on OOM in push headers
• HTTP3.md: drop outdated mentions of OpenSSL-QUIC
• http: clear credentials better on redirect
• http: clear digest nonce on cross-origin redirect
• http: clear the proxy credentials as well on port or scheme change
• http: fix auth_used and auth_avail
• http: fix Curl_compareheader for multi value headers
• http: make Curl_compareheader handle multiple commas in header
• http: on 303, switch to GET
• http: use header_has_value() instead of duplicate code
• imap: reset the UIDVALIDITY state between transfers
• include: drop badword from public headers
• INSTALL.md: update Cygwin instructions
• keylog.h: replace literal number with macro in declaration
• keylog: drop unused/redundant includes and guards
• ldap: drop duplicate ldap_set_option() on Windows
• ldap: fix to initialize cleartext connection on Windows
• lib1560: fix comment typo
• lib1960: fix test failure
• lib: accept larger input to md5/hmac/sha256/sha512 functions
• lib: always use Curl_1st_fatal instead of Curl_1st_err
• lib: fix typos in comments
• lib: make resolving HTTPS DNS records reliable:
• lib: minor comment typos
• lib: move request specific allocations to the request struct
• lib: replace PRI*32 printf masks with C89 ones
• libssh2: allocate libssh2-friendly memory in kbd_callback
• libssh2: fix error handling on quote errors
• libssh: fix 64-bit printf mask for mingw-w64 <=6.0.0
• libssh: fix -Wsign-compare in 32-bit builds
• libssh: path length precaution
• libssh: propagate error back in SFTP function
• libtest: drop duplicate include
• location/follow: mention netrc
• man: fix argument type for CURLSHOPT_[UN]SHARE options
• mbedtls: cleanup more without care for 'initialized'
• mbedtls: fix ECJPAKE matching
• mbedtls: remove failf() call with first argument as NULL
• md4, md5: switch to wolfCrypt API in wolfSSL builds
• mime: only allow 40 levels of calls
• misc: fix code quality findings
• mk-ca-bundle.pl: make ca-bundle.crt timestamp match certdata.txt's
• multi: enhance pending handles fairness
• multi: fix connection retry for non-http
• multi: improve wakeup and wait code
• netrc: find login-less password when user is given in URL
• netrc: remove unused parsenetrc() macro for netrc-disabled
• netrc: skip malformed macdef lines
• openssl channel_binding: lookup digest algorithm without NID
• openssl: drop obsolete SSLv2 logic
• openssl: fix build with 4.0.0-beta1 no-deprecated
• openssl: fix memory leaks in ECH code (OpenSSL 3)
• openssl: fix unused variable warnings in !verbose builds
• openssl: trace count of found / imported Windows native CA roots
• OS400: add new definitions to the ILE/RPG binding.
• os400sys: fix typo in comment (symmetry)
• parsedate: bsearch the time zones
• parsedate: fix wrong treatment of "military time zones"
• parsedate: refactor
• perl: harden external command invocations
• progress: count amount of data "delivered" to application
• protocol.h: fix the CURLPROTO_MASK
• protocol: disable connection reuse for SMB(S)
• protocol: use scheme names lowercase
• proxy: chunked response, error code
• pytest: add additional quiche check for flaky test_05_01
• pytest: check 429 handling
• rand: use BCryptGenRandom() in UWP builds
• ratelimit: reset on start
• request: reset resp_trailer in new requests
• runtests: skip setting ed25519 SSH key format
• rustls: fix memory leak on repeated SSLKEYLOGFILE fails
• rustls: handle EOF during initial handshake
• schannel: increase renegotiation timeout to 60 seconds
• scripts: drop redundant double-quotes: "$var" -> $var (Perl)
• scripts: harden / tidy up more Perl system() calls
• sendf: fix CR detection if no LF is in the chunk
• setopt: fix typos in comments
• setopt: move CURLOPT_CURLU
• setup connection filter: mark as setup
• sha256, sha512_256: switch to wolfCrypt API
• sha256: support delegating to wolfSSL API
• share: concurrency handling, easy updates
• share: do bitshifts after the type is checked to be valid
• socks: reject zero-length GSSAPI/SSPI tokens from proxy
• socks: use dns filter for resolving
• spelling: fix typos
• src: use ftruncate() unconditionally
• sshserver.pl: harden more system() calls
• sshserver.pl: pass command-line to system() safely
• strerr: correct the strerror_s() return code condition
• sws: fix potential OOB write
• synctime: fix off-by-one read and write to a read-only buffer (Windows)
• test 766: flag as timing-dependent
• test1675: unit tests for URL API helper functions
• test459: switch to mode="warn" for stderr check
• testcurl.pl: replace shell commands with Perl rmtree()
• tests/unit/README: describe how to unit test static functions
• tests: avoid infinite recursion for make check
• tests: use %b64[] instead of "raw" base64
• tool: check for curlinfo->age when determining if ssh backend
• tool: fix memory mixups
• tool: fix retries in parallel mode
• tool: fix two more allocator mismatches
• tool_cb_hdr: only truncate etags output when regular file
• tool_cb_rea: make waitfd() return void
• tool_cb_wrt: fix no-clobber error handling
• tool_cfgable: free the SSL signature algorithms
• tool_formparse: propagate my_get_line errors when reading headers
• tool_getparam: use correct free function for libcurl memory
• tool_ipfs: accept IPFS gateway URL without set port number
• tool_msgs: avoid null pointer deref for early errors
• tool_operate: actually apply the --parallel-max-host limit
• tool_operate: drop the scheme-guessing in the -G handling
• tool_operate: fix condition for loading curl-ca-bundle.crt (Windows)
• tool_operate: fix memory-leak on failed uploads …

curl / Docs / Releases / Changes in 8.19.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.18.0 all changes 8.20.0 🠲

Changes in 8.19.0 - March 11 2026

8.19.0 8.19.0 Changes:

• BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026
• cmake: add CURL_BUILD_EVERYTHING option
• mqtt: initial support for MQTTS
• tool: support fractions for --limit-rate and --max-filesize
• tool_cb_hdr: with -J, use the redirect name as a backup
• vquic: drop support for OpenSSL-QUIC
• windows: add build option to use the native CA store
• windows: bump minimum to Vista (from XP) Bugfixes:
• altsvc: only accept 17 byte dates from files
• asyn-ares: abort with OOM error when Curl_dnscache_mk_entry fails
• async-ares: blocking resolve timeout handling, better
• badwords: move into ./scripts, speed up
• build: add missing GENERATEDCERTS files
• build: adjust minimum version for some clang picky warnings
• build: check MSG_NOSIGNAL directly, drop detection and interim macro
• build: constify memchr()/strchr()/etc result variables (cont.)
• build: detect and include inttypes.h again
• build: do not include wolfSSL header in curl_setup.h
• build: drop duplicate C includes
• build: drop global suppression of -Wformat-nonliteral, fix fallouts
• build: drop unused snprintf() feature check on Windows
• build: fix -Wunused-macros warnings, and related tidy-ups
• build: fix building rare combinations
• build: fully omit verbose strings and code when disabled
• build: globally suppress DJGPP warnings in FD_SET()
• build: merge TrackMemory (CURLDEBUG) into debug-enabled option
• build: move curl stat struct type to the curlx namespace
• build: opt-in MSVC to C99-style verbose logging logic
• build: require POSIX strdup()
• build: tidy up and dedupe strdup functions
• cf-socket: ignore SOCK_CLOEXEC etc for socktype equality checks
• cf-socket: use SOCK_CLOEXEC in socket_open when available
• checksrc-all.pl: skip non-repository files
• checksrc: do not apply BANNEDFUNC to struct member functions
• checksrc: warn for leading spaces before the preprocessor hash
• clang-tidy: add missing and delete redundant parentheses
• clang-tidy: add more missing parentheses in macro values
• clang-tidy: avoid/silence bugprone-not-null-terminated-result
• clang-tidy: check bugprone-macro-parentheses, fix fallouts
• clang-tidy: drop redundant conditions reported by misc-redundant-expression
• clang-tidy: enable bugprone-signed-char-misuse, fix fallouts
• clang-tidy: enable more checks
• clang-tidy: enable scanning headers
• clang-tidy: fix issues found with build-fuzzing
• clang-tidy: silence more minor issues found by v22
• cmake/FindMbedTLS: add workaround for missing static MSVC mbedcrypto.lib 4.0.0
• cmake: add CURL_DROP_UNUSED option to reduce binary sizes
• cmake: add native clang-tidy support for tests, with concatenated sources
• cmake: always build curlu and curltool test libs in unity mode
• cmake: always define CURL::win32_winsock on Windows in curl-config.cmake
• cmake: convert curl_add_clang_tidy_test_target() macro to function
• cmake: enable binutils ld workaround for all toolchains at build-time
• cmake: fix LOCATION property access condition (debug)
• cmake: fix LOCATION property read errors in target debug function
• cmake: fix building with CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON
• cmake: fix confusing error when a dependency is undetected in curl-config.cmake
• cmake: fix logic for openssl/zlib binutils ld workaround
• cmake: fix passing system header directories to clang-tidy for tests
• cmake: fix system include directory position for clang-tidy in tests
• cmake: improve clang-tidy test command-line reproduction
• cmake: minor fixes to test targets after prev
• cmake: normalize uppercase hex winver (for display)
• cmake: omit curl.rc from curltool lib
• cmake: reference OpenSSL and ZLIB imported targets only when enabled
• cmake: replace internal option with a new tt (test tools) target
• cmake: silence potential unused var warnings in C++ test snippet
• cmake: silence silly Apple clang warnings in C89 mode, test in CI
• cmake: silence useless compiler warnings triggered by the FASTBuild generator
• cmake: skip binutils ld hack if zlib/openssl target is not IMPORTED
• cmake: warn for invalid CURL_TARGET_WINDOWS_VERSION values
• cmke: add *_USE_STATIC_LIBS options for 9 dependencies
• config-plan9: set HAVE_STDINT_H again
• config2setopts: acknowledge OOM error from CURLOPT_MIMEPOST
• config2setopts: fix for --disable-aws build configuration
• configure: drop always true if check (Windows)
• content_encoding: return 'identity' if none other exists
• curl: add -I and -i to -h important
• curl: limit Windows-specific code to Windows builds, other tidy-ups
• curl_easy_nextheader.md: a new transfer invalidates 'prev'
• curl_get_line: drop single-use macro
• curl_multi_perform.md: resolve inconsistency
• curl_ntlm_core: merge two #if blocks
• curl_setup.h: drop extra header guard for internal include
• curl_setup.h: merge back single-use internal header curl_setup_once.h
• curl_setup.h: simplify curl memory macro mappings
• curl_setup_once: allow CURL_DEBUGASSERT for customization
• CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md: fix available protocols
• curlx: drop unused curlx_saferealloc()
• digest: escape double quotes and backslashes in realm and nonce
• digest: fix memory leak in auth_create_digest_http_message()
• digest: handle quotes in the path
• docs/INSTALL: update configure details
• docs/libcurl: unify WARNING use
• docs: add LibreELEC to DISTROS.md
• docs: add reproducible example for generating man page
• docs: avoid starting sentences with However,
• docs: avoid using the word 'magic'
• docs: clarify --ipv4 and --ipv6
• docs: document the need for a 64-bit type and stdint.h
• docs: drop 'basically'
• docs: explicitly call out Slowloris as not a security flaw
• docs: fix grammar nitpicks
• docs: handle error in curl_global_init* examples
• docs: replace instances of the vague qualifier 'quite'
• docs: reword explanation of --variable option
• docs: some nitpicks
• docs: use dot instead of comma at end of sentences
• easy: reset errorbuf on eyeballing success
• easy: reset pausing when resetting request
• examples/usercertinmem: use modern OpenSSL API, drop mentions of RSA
• examples: improve OpenSSL certificate examples
• examples: omit forward declarations, apply misc fixes
• FAQ: syntax improvements
• fopen.h: simplify curl memory macro mappings
• ftp: replace a curlx_free() with curlx_dyn_free()
• ftp: split ftp_state_use_port into sub functions
• GOVERNANCE.md: Post-Daniel BDFL
• gss: exclude verbose error logic from non-verbose builds
• h2+h3: align stream close handling
• hostip.c: fix leak of addrinfo
• hostip6: remove debug-only code
• hostip: fix unreachable code in rare build configuration
• http/3: add description for known server error codes
• http1: fix potential NULL dereference in Curl_h1_req_parse_read()
• http: only send bearer if auth is allowed
• http_aws_sigv4: fix query normalization of %2b
• imap: add a check for Curl_meta_get()
• imap: check imap_sendf() printf masks at compile-time
• imap: skip literals inside quoted strings
• include: avoid recursive macros
• include: mask computed auth/proto bitmasks to 32 bits
• INSTALL-CMAKE.md: document Apple framework options
• INSTALL.md: fix typo
• INSTALL.md: suggest -Wl,-dead_strip for Apple targets
• KNOWN_BUGS.md: absolute Unix domain filename for SOCKS on Windows
• ldap: silence clang-tidy v22 warning
• ldap: silence potential unused variable warning (OS400)
• lib: delete unused local includes
• lib: disable websockets early if no http
• lib: make sigpipe handling more lazy
• lib: reorder protocol functions to avoid forward declarations (email)
• lib: reorder protocol functions to avoid forward declarations (ftp)
• lib: reorder protocol functions to avoid forward declarations (misc cont.)
• lib: reorder protocol functions to avoid forward declarations (misc)
• lib: reorder protocol functions to avoid forward declarations (ssh)
• lib: separate scheme info from protocol implementation
• lib: skip compiling code with features disabled
• lib: use (u)int64_t instead of long long
• libcurl docs: reduce 'since ...' in descriptions
• libcurl-security.md: fix typos and add a point about URLs
• libtests: drop two redundant memset()s
• Makefile.am: delete RPM targets referencing non-existent files
• Makefile.am: drop stray VC project files from dist
• managen: silence Perl warnings
• mbedtls: guard TLS 1.3 + session tickets usage inside ifdef
• mbedtls: no pinnedpubkey wo MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
• mbedtls: remove newline from failf() call
• mbedtls: split mbed_connect_step1 into sub functions
• md4, md5: drop redundant forward declarations
• md4, md5: replace custom types with uint32_t
• memdebug: include backtrace.h as system header
• mime: drop fallback for unused R_OK macro
• mimepost: allocate main struct on-demand
• mk-ca-bundle.pl: drop support for obsolete/insecure fingerprint algos
• mod_curltest: silence unused argument compiler warning
• mprintf: drop old sprintf fallback
• mprintf: rename internal enum to avoid collision with AmigaOS symbol
• mprintf: silence clang-tidy readability-suspicious-call-argument
• mprintf: use _snprintf() when compiled with VS2013 and older
• mqtt: better too-big-message-check
• mqtt: fix EOF handling
• mqtt: verify Remaining Length for CONNACK and PUBACK
• msvc: drop exception, make BIT() a bitfield with Visual Studio
• msvc: VS2026: unlock picky warning in cmake, test in CI
• multi: avoid a theoretical 32-bit wrap
• multi: fix unreachable code compiler warning
• multi: probe for IPv6 functionality in multi_init()
• multi: split multi_runsingle into sub functions
• multi: update timer unconditionally in multi_remove_handle
• ngtcp2: stabilize recv
• noproxy: simplify, don't mix const non-const in strchr()
• openldap: avoid forward declarations in ldaps code
• openssl+ech: workaround for insecure handshakes
• openssl: adapt to OpenSSL master adding const to more APIs
• OpenSSL: check reuse of sessions for verify status
• openssl: disable local keylog feature if built-in upstream
• openssl: fix compiler warning with OpenSSL master
• openssl: fix potential NULL dereference when loading certs (Windows)
• openssl: fix potential OOB read in debug/verbose logging
• plan9: drop special build and orphaned references
• proxy-auth: additional tests
• pytest: remove 03_02
• quiche: use PRIu64 for outputting the stream id
• rand: drop impossible preprocessor branches (wincrypt)
• rand: drop scan-build silencer
• ratelimit: download finetune
• request.h: rename parameter 'buf' to 'req' in Curl_req_send
• REUSE: drop broken reference to MAIL-ETIQUETTE
• rtsp: fix assertion failure on zero-length RTP payload
• rtspd: fix to check realloc() result
• runtests: pass config filename to stunnel in native format (Windows)
• schannel: refactor: reduce variable scopes, fix comment, fix indent
• send: drop CURL_UNCONST() from buffer argument on most platforms
• setopt: fix checking range for CURLOPT_MAXCONNECTS
• setopt: refuse blobs with zero length
• setup-os400.h: drop no longer used custom type u_int32_t
• sigpipe: unset SA_SIGINFO since it is using sa_handler
• silent.md: also mention it shuts off warning messages
• smb: free the path in the request struct properly
• smb: include arpa/inet.h for NonStop
• socket: check result of SO_NOSIGPIPE
• socketpair: clear 'err' when retrying due to EINTR
• socketpair: set SO_NOSIGPIPE where possible
• socks: ensure DNS is freed in failure cases.
• src: simplify declaring curl_ca_embed
• ssh: dedupe state change function
• stop using the word 'just'
• sws: prevent "connection monitor" to say disconnect twice
• synctime: fix use of uninitialized buffer on non-Windows
• system_win32: replace manual init code with curlx_now_init() call …

curl / Docs / Releases / Changes in 8.18.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.17.0 all changes 8.19.0 🠲

Changes in 8.18.0 - January 7 2026

8.18.0 8.18.0 Changes:

• build: drop support for VS2008 (Windows)
• build: drop Windows CE / CeGCC support
• gnutls: drop support for GnuTLS < 3.6.5
• gnutls: implement CURLOPT_CAINFO_BLOB
• openssl: bump minimum OpenSSL version to 3.0.0 Bugfixes:
• _PROGRESS.md: add the E unit, mention kibibyte
• alt-svc: more flexibility on same destination
• altsvc: accept ma/persist per alternative entry
• altsvc: make it one malloc instead of three per entry
• AmigaOS: increase minimum stack size for tool_main
• apple sectrust: fix ancient evaluation
• apple-sectrust: always ask when native_ca_store is in use
• asyn-ares: handle Curl_dnscache_mk_entry() OOM error
• asyn-ares: remove hostname free on OOM
• asyn-thrdd: fix Curl_async_getaddrinfo() on systems without getaddrinfo
• asyn-thrdd: release rrname if ares_init_options fails
• auth: always treat Curl_auth_ntlm_get() returning NULL as OOM
• autotools: add nettle library detection via pkg-config (for GnuTLS)
• autotools: drop autoconf <2.59 compatibility code (zz60-xc-ovr)
• autotools: fix LargeFile feature display on Windows (after prev patch)
• autotools: tidy-up if expressions
• badwords: add mistyped 'first', fix fallouts
• badwords: catch and fix threading-related words
• badwords: fix issues found in scripts and other files
• badwords: fix issues found in tests
• build: add build-level CURL_DISABLE_TYPECHECK options
• build: exclude clang prereleases from compiler warning options
• build: replace -pedantic with -Wpedantic when supported
• build: set -Wno-format-signedness
• build: tidy-up MSVC CRT warning suppression macros
• ccsidcurl: make curl_mime_data_ccsid() use the converted size
• cf-h1-proxy: support folded headers in CONNECT responses
• cf-https-connect: allocate ctx at first in cf_hc_create()
• cf-socket: drop feature check for IPV6_V6ONLY on Windows
• cf-socket: enable Win10 TCP_KEEP* options with old SDKs
• cf-socket: limit use of TCP_KEEP* to Windows 10.0.16299+ at runtime
• cf-socket: return OOM error if socket() fails due to OOM
• cf-socket: trace ignored errors
• cfilters: make conn_forget_socket a private libssh function
• checksrc.pl: detect assign followed by more than one space
• cmake: adjust defaults for target platforms not supporting shared libs
• cmake: define dependencies as IMPORTED interface targets
• cmake: delete unused file CMake/CMakeConfigurableFile.in
• cmake: disable CURL_CA_PATH auto-detection if USE_APPLE_SECTRUST=ON
• cmake: fix ws2_32 reference in curl-config.cmake
• cmake: honor CURL_DISABLE_INSTALL and CURL_ENABLE_EXPORT_TARGET
• cmake: replace deprecated OPENSSL_FOUND with OpenSSL_FOUND
• cmake: replace deprecated PERL_FOUND with Perl_FOUND
• cmake: save and restore CMAKE_MODULE_PATH in curl-config.cmake
• cmake: set found status to OFF when not found (for compression deps)
• code: minor indent fixes before closing braces
• CODE_STYLE.md: sync banned function list with checksrc.pl
• compressed.md: might generate a huge amount of bytes
• config-win32.h: delete obsolete, non-Windows comments
• config-win32.h: drop unused/obsolete CURL_HAS_OPENLDAP_LDAPSDK
• config2setopts: add space in cookie header with multiple -b
• config2setopts: bail out if curl_url_get() returns OOM
• config2setopts: exit if curl_url_set() fails on OOM
• configure: delete unused variable
• conncache: silence -Wnull-dereference on gcc 14 RISC-V 64
• conncontrol: reuse handling
• connect: reshuffle Curl_timeleft_ms to avoid 'redundant condition'
• connection: attached transfer count
• content_encoding: avoid strcpy
• cookie. return proper error on OOM
• cookie: allocate the main struct once cookie is fine
• cookie: flush better
• cookie: only keep and use the canonical cleaned up path
• cookie: propagate errors better, cleanup the internal API
• cookie: return error on OOM
• cookie: when parsing a cookie header, delay all allocations until okay
• cshutdn: acknowledge FD_SETSIZE for shutdown descriptors
• curl: fix progress meter in parallel mode
• curl_fopen: do not pass invalid mode flags to open() on Windows
• curl_gssapi: make sure Curl_gss_log_error() has an initialized buffer
• curl_ntlm_core: fix DES_* symbols for some wolfSSL builds
• curl_quiche: refuse headers with CR, LF or null bytes
• curl_sasl: if redirected, require permission to use bearer
• curl_sasl: make Curl_sasl_decode_mech compare case insensitively
• curl_setup.h: document more funcs flagged by _CRT_SECURE_NO_WARNINGS
• curl_setup.h: drop stray #undef stat (Windows)
• curl_setup.h: drop superfluous parenthesis from Curl_safefree macro
• curl_threads: don't do another malloc if the first fails
• curl_trc: delete unused DoH remains
• CURLINFO: remove 'get' and 'get the' from each short desc
• CURLINFO_SCHEME/PROTOCOL: they return the "scheme" for a "transfer"
• CURLINFO_TLS_SSL_PTR.md: remove CURLINFO_TLS_SESSION text
• CURLMOPT_SOCKETFUNCTION.md: fix the callback argument use
• CURLOPT_ACCEPT_ENCODING.md: warn about the expansion
• CURLOPT_FOLLOWLOCATION.md: s/Authentication:/Authorization:/
• CURLOPT_HAPROXY_CLIENT_IP.md: emphasize reused connection use
• CURLOPT_READFUNCTION.md: clarify the size of the buffer
• CURLOPT_SSH_KEYFUNCTION.md: fix minor indent mistake in example
• curlx/fopen: replace open CRT functions their with _s counterparts (Windows)
• curlx/multibyte: stop setting macros for non-Windows
• curlx/strerr: use strerror_s() on Windows
• curlx: add curlx_rename(), fix to support long filenames on Windows
• curlx: curlx_strcopy() instead of strcpy()
• curlx: limit use of system allocators to the minimum possible
• curlx: replace mbstowcs/wcstombs with _s counterparts (Windows)
• curlx: replace sprintf with snprintf
• curlx: use curl alloc in curlx_win32_stat() (Windows)
• curlx: use curlx allocators in non-memdebug builds (Windows)
• DEPRECATE: add CMake <3.18 deprecation for April 2026
• digest: fix OWS and escaped quote handling
• digest_sspi: fix a memory leak on error path
• digest_sspi: properly free sspi identity
• DISTROS.md: add OpenBSD
• DISTROS: fix a Mageia URL
• DISTROS: remove broken URLs for buildroot
• doc: some returned in-memory data may not be altered
• Dockerfile: update debian:bookworm-slim digest to e899040
• docs/libcurl: fix C formatting nits
• docs: add a note about --compressed to note about binary output
• docs: clarify how to do unix domain sockets with SOCKS proxy
• docs: fix checksrc EQUALSPACE warnings
• docs: fix time_posttransfer output unit as seconds
• docs: mention umask need when curl creates files
• docs: remove dead URLs
• docs: rename CURLcode variables to 'result'
• docs: spell it Rustls with a capital R
• docs: switch more URLs to https://
• docs: use .example URLs for proxies
• docs: use mresult as variable name for CURLMcode
• escape: add a length check in curl_easy_escape
• example: fix formatting nits
• examples/crawler: fix variable
• examples/multi-uv: fix invalid req->data access
• examples/threaded-ssl: delete in favor of examples/threaded
• examples/threaded: fix race condition
• examples: fix minor typo
• examples: make functions/data static where missing
• examples: tidy-up headers and includes
• examples: use 64-bit fstat on Windows
• FAQ/TODO/KNOWN_BUGS: convert to markdown
• FAQ: fix hackerone URL
• file: do not pass invalid mode flags to open() on upload (Windows)
• formdata: validate callback is non-NULL before use
• ftp: make EPRT connections non-blocking
• ftp: refactor a piece of code by merging the repeated part
• ftp: remove #ifdef for define that is always defined
• ftp: return better on OOM in two places
• ftp: return from ftp_state_use_port immediately on OOM
• getenv: drop internal 1-to-1 wrapper
• getinfo: improve perf in debug mode
• gnutls: add PROFILE_MEDIUM as default
• gnutls: report accurate error when TLS-SRP is not built-in
• gtls: add return checks and optimize the code
• gtls: Call keylog_close in cleanup
• gtls: skip session resumption when verifystatus is set
• h2/h3: handle methods with spaces
• headers: add length argument to Curl_headers_push()
• hostcheck: fail wildcard match if host starts with a dot
• hostip.h: drop redundant setjmp.h include
• hostip: don't store negative lookup on OOM
• hostip: make more functions return CURLcode
• hostip: only store negative response for CURLE_COULDNT_RESOLVE_HOST
• hsts: propagate and error out correctly on OOM
• hsts: use one malloc instead of two per entry
• http: acknowledge OOM errors from Curl_input_ntlm
• http: avoid two strdup()s and do minor simplifications
• http: error on OOM when creating range header
• http: fix OOM exit in Curl_http_follow
• http: handle oom error from Curl_input_digest()
• http: replace atoi use in Curl_http_follow with curlx_str_number
• http: return OOM errors from hsts properly
• http: the :authority header should never contain user+password
• http: unfold response headers earlier
• idn: avoid allocations and wcslen on Windows
• idn: clarify null-termination on Windows
• idn: fix memory leak in win32_ascii_to_idn()
• idn: use curlx allocators on Windows
• imap: check buffer length before accessing it
• imap: make sure Curl_pgrsSetDownloadSize() does not overflow
• inet_ntop: avoid the strlen()
• INSTALL-CMAKE.md: document static option defaults more
• krb5: fix detecting channel binding feature
• krb5_sspi: unify a part of error handling
• ldap: call ldap_init() before setting the options
• ldap: drop PP logic for old, unsupported, Windows SDKs
• ldap: improve detection of Apple LDAP
• ldap: provide version for "legacy" ldap as well
• lib/sendf.h: forward declare two structs
• lib: cleanup for some typos about spaces and code style
• lib: create unitprotos.h in the builddir, not srcdir
• lib: drop unused or duplicate curlx/timeval.h includes
• lib: drop unused protocol headers
• lib: eliminate size_t casts
• lib: error for OOM when extracting URL query
• lib: fix formatting nits (part 2)
• lib: fix formatting nits (part 3)
• lib: fix formatting nits
• lib: fix gssapi.h include on IBMi
• lib: name the main CURLMcode variable 'mresult'
• lib: refactor the type of funcs which have useless return and checks
• lib: replace _tcsncpy/wcsncpy/wcscpy with _s counterparts (Windows)
• lib: timer stats improvements
• lib: use SOCKET_WRITABLE()/SOCKET_READABLE() where possible
• libssh2: add paths to error messages for quote commands
• libssh2: cleanup ssh_force_knownhost_key_type
• libssh2: consider strdup() failures OOM and return correctly
• libssh2: replace atoi() in ssh_force_knownhost_key_type
• libssh: fix state machine loop to progress as it should
• libssh: properly free sftp_attributes
• libssh: require private key or user-agent for public key auth
• libssh: set both knownhosts options to the same file
• libtests: replace atoi() with curlx_str_number()
• limit-rate: add example using --limit-rate and --max-time together
• localtime: detect thread-safe alternatives and use them
• m4/sectrust: fix test(1) operator
• manage: expand the 'libcurl support required' message
• mbedTLS: cleanup insecure/deprecated code
• mbedtls: fix potential use of uninitialized nread
• mbedtls: sync format across log messages
• mbedtls_threadlock: avoid calloc, use array
• mdlinkcheck: ignore IP numbers, allow '@' in raw URLs
• mdlinkcheck: only look for markdown links in markdown files
• memdebug: add mutex for thread-safety
• memdebug: fix realloc logging
• mk-ca-bundle.md: the file format docs URL is permaredirected
• mk-ca-bundle.pl: default to SHA256 fingerprints with -t option
• mk-ca-bundle.pl: use open() with argument list to replace backticks
• mqtt: reject overly big messages
• mqtt: return error when a too large packet is decoded
• multi: make max_total_* members size_t
• multi: remove MSTATE_TUNNELING …

curl / Docs / Releases / Changes in 8.17.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.16.0 all changes 8.18.0 🠲

Changes in 8.17.0 - November 5 2025

8.17.0 8.17.0 Changes:

• build: drop Heimdal support
• build: drop the winbuild build system
• krb5: drop support for Kerberos FTP
• libssh2: up the minimum requirement to 1.9.0
• multi: add notifications API
• progress: expand to use 6 characters per size
• ssl: support Apple SecTrust configurations
• tool_getparam: add --knownhosts
• vssh: drop support for wolfSSH
• wcurl: import v2025.11.04
• write-out: make %header{} able to output all occurrences of a header Bugfixes:
• ares: fix leak in tracing
• asyn-ares: remove wrong comment about the callback argument
• asyn-ares: use the duped hostname pointer for all calls
• asyn-thrdd resolver: clear timeout when done
• asyn-thrdd: drop pthread_cancel
• autotools: add support for libgsasl auto-detection via pkg-config
• autotools: capitalize Rustls in the log output
• autotools: drop detection of ancient OpenSSL libs RSAglue and rsaref
• autotools: fix duplicate UNIX and BSD flags in buildinfo.txt
• autotools: fix silly mistake in clang detection for buildinfo.txt
• autotools: make --enable-code-coverage support llvm/clang
• autotools: merge ifs in GnuTLS/OpenSSL feature detection
• aws-lc: re-enable large read-ahead with v1.61.0 again
• base64: accept zero length argument to base64_encode
• build: address some -Weverything warnings, update picky warnings
• build: avoid overriding system open and stat symbols
• build: avoid overriding system symbols for fopen functions
• build: avoid overriding system symbols for socket functions
• build: show llvm/clang in platform flags and buildinfo.txt
• c-ares: when resolving failed, persist error
• cf-h2-proxy: break loop on edge case
• cf-ip-happy: mention unix domain path, not port number
• cf-socket: always check Curl_cf_socket_peek() return code
• cf-socket: check params and remove accept procondition
• cf-socket: make set_local_ip void, and remove failf()
• cf-socket: set FD_CLOEXEC on all sockets opened
• cf-socket: tweak a memcpy() to read better
• cf-socket: use the right byte order for ports in bindlocal
• cfilter: unlink and discard
• cfilters: check return code from Curl_pollset_set_out_only()
• checksrc: allow disabling warnings on FIXME/TODO comments
• checksrc: catch banned functions when preceded by (
• checksrc: fix possible endless loop when detecting BANNEDFUNC
• checksrc: fix possible endless loops in the banned function logic
• checksrc: fix to handle ) predecing a banned function
• checksrc: reduce directory-specific exceptions
• CI.md: refresh
• cmake/FindGSS: dedupe pkg-config module strings
• cmake/FindGSS: drop wrong header check for GNU GSS
• cmake/FindGSS: fix pkg-config fallback logic for CMake <3.16
• cmake/FindGSS: simplify/de-dupe lib setup
• cmake/FindGSS: whitespace/formatting
• cmake: add and use local FindGnuTLS module
• cmake: add CURL_CODE_COVERAGE option
• cmake: build the "all" examples source list dynamically
• cmake: clang detection tidy-ups
• cmake: drop exclamation in comment looking like a name
• cmake: fix HAVE_GNUTLS_SRP detection after adding local FindGnuTLS module
• cmake: fix building docs when the base directory contains .3
• cmake: fix Linux pre-fill HAVE_POSIX_STRERROR_R (when _CURL_PREFILL=ON)
• cmake: fix Linux pre-fills for non-glibc (when _CURL_PREFILL=ON)
• cmake: minor Heimdal flavour detection fix
• cmake: pre-fill three more type sizes on Windows
• cmake: say 'absolute path' in option descriptions and docs
• cmake: support building some complicated examples, build them in CI
• cmake: use modern alternatives for get_filename_component()
• cmake: use more COMPILER_OPTIONS, LINK_OPTIONS / LINK_FLAGS
• cmdline-docs: extended, clarified, refreshed
• cmdline-opts/_PROGRESS.md: explain the suffixes
• configure: add "-mt" for pthread support on HP-UX
• conn: fix hostname move on connection reuse
• conncache: prevent integer overflow in maxconnects calculation
• connect: for CONNECT_ONLY, CURLOPT_TIMEOUT does not apply
• connect: remove redundant condition in shutdown start
• cookie: avoid saving a cookie file if no transfer was done
• cookie: only count accepted cookies in Curl_cookie_add
• cookie: remove the temporary file on (all) errors
• cpool: make bundle->dest an array; fix UB
• curl.h: remove incorrect comment about CURLOPT_PINNEDPUBLICKEY
• curl_easy_getinfo: error code on NULL arg
• curl_easy_setopt.md: add missing CURLOPT_POSTFIELDS
• curl_mem_undef.h: limit to CURLDEBUG for non-memalloc overrides
• curl_ngtcp2: fix -Wunreachable-code with H3 !verbose !unity clang
• curl_osslq: error out properly if BIO_ADDR_rawmake() fails
• curl_path: make sure whitespace-only is illegal
• Curl_resolv: fix comment. 'entry' argument is not optional
• curl_slist_append.md: clarify that a NULL pointer is not acceptable
• curl_threads: delete WinCE fallback branch
• CURLINFO_FTP_ENTRY_PATH.md: this is for SFTP as well
• CURLOPT_COOKIEFILE.md: clarify when the cookies are loaded
• CURLOPT_COPYPOSTFIELDS.md: used with MQTT and RTSP as well
• CURLOPT_HEADER/WRITEFUNCTION.md: drop '* size' since size is always 1
• CURLOPT_MAXLIFETIME_CONN: make default 24 hours
• CURLOPT_POSTFIELDSIZE*: these also work for MQTT and RTSP
• CURLOPT_SERVER_RESPONSE_TIMEOUT*: add default and see-also
• CURLOPT_SSL_VERIFYHOST.md: add see-also to two other VERIFYHOST options
• CURLOPT_TIMECONDITION.md: works for FILE and FTP as well
• cw-out: fix EAGAIN handling on pause
• cw-out: unify the error handling pattern in cw_out_do_write
• digest_sspi: fix two memory leaks in error branches
• dist: do not distribute CI.md
• docs/cmdline-opts: drop double quotes from GLOBBING and URL examples
• docs/libcurl: clarify some timeout option behavior
• docs/libcurl: remove ancient version references
• docs/libcurl: use lowercase must
• docs: expand on quoting rules for filenames in SFTP quote
• docs: fix/tidy code fences
• doh: cleanup resources on error paths
• doswin: CloseHandle the thread on shutdown
• easy_getinfo: check magic, Curl_close safety
• ECH.md: make OpenSSL branch clone instructions work
• examples/chkspeed: portable printing when outputting curl_off_t values
• examples/http2-serverpush: fix file handle leaks
• examples/sessioninfo: cast printf string mask length to int
• examples/sessioninfo: do not disable security
• examples/synctime: fix null-termination assumptions
• examples/synctime: make the sscanf not overflow the local buffer
• examples/usercertinmem: avoid stripping const
• examples/websocket: fix use of uninitialized rlen
• examples: call curl_global_cleanup() where missing
• examples: check more errors, fix cleanups, scope variables
• examples: drop unused curl/mprintf.h includes
• examples: fix build issues in 'complicated' examples
• examples: fix more potential resource leaks, and more
• examples: fix two build issues surfaced with WinCE
• examples: fix two issues found by CodeQL
• examples: fix two more cases of stat() TOCTOU
• examples: improve global init, error checks and returning errors
• examples: replace casts with curl_off_t printf masks
• examples: return curl_easy_perform() results
• firefox-db2pem.sh: add macOS support, tidy-ups
• form.md: drop reference to MANUAL
• ftp: add extra buffer length check
• ftp: check errors on remote ip for data connection
• ftp: fix ftp_do_more returning with *completep unset
• ftp: fix port number range loop for PORT commands
• ftp: fix the 213 scanner memchr buffer limit argument
• ftp: improve fragile check for first digit > 3
• ftp: reduce size of some struct fields
• ftp: remove 'newhost' and 'newport' from the ftp_conn struct
• ftp: remove misleading comments
• ftp: remove the retr_size_saved struct field
• ftp: remove the state_saved struct field
• ftp: replace strstr() in ;type= handling
• ftp: simplify the 150/126 size scanner
• gnutls: check conversion of peer cert chain
• gnutls: fix re-handshake comments
• gssapi: make channel binding conditional on GSS_C_CHANNEL_BOUND_FLAG
• gtls: avoid potential use of uninitialized variable in trace output
• gtls: check the return value of gnutls_pubkey_init()
• header.md: see-also --proxy-header and vice versa
• hmac: free memory properly on errors
• hostip: don't store negative resolves due unrelated errors
• hostip: fix infof() output for non-ipv6 builds using IPv6 address
• hostip: remove leftover INT_MAX check in Curl_dnscache_prune
• http2: check push header names by length first
• http2: cleanup pushed newhandle on fail
• http2: ingress handling edge cases
• HTTP3: clarify the status for "old" OpenSSL, not current
• http: check the return value of strdup
• http: fix -Wunreachable-code in !websockets !unity builds
• http: fix -Wunused-variable in !alt-svc !proxy !ws builds
• http: handle user-defined connection headers
• http: look for trailing 'type=' in ftp:// without strstr
• http: make Content-Length parser more WHATWG
• http: only accept ';' as a separator for custom headers
• http: return error for a second Location: header
• http_aws_sigv4: check the return value of curl_maprintf()
• http_proxy: fix adding custom proxy headers
• httpsrr: free old pointers when storing new
• httpsrr: send HTTPS query to the right target
• imap: fix custom FETCH commands to handle literal responses
• imap: parse and use UIDVALIDITY as a number
• imap: treat capabilities case insensitively
• INSTALL-CMAKE.md: add manual configuration examples
• INSTALL-CMAKE.md: document useful build targets
• INSTALL-CMAKE.md: fix descriptions for LDAP dependency options
• INSTALL: update the list of known operating systems
• INTERNALS: drop Winsock 2.2 from the dependency list
• ip-happy: do not set unnecessary timeout
• ip-happy: prevent event-based stall on retry
• kerberos: bump minimum to 1.3 (2003-07-08), drop legacy logic
• kerberos: drop logic for MIT Kerberos <1.2.3 (pre-2002) versions
• kerberos: stop including gssapi/gssapi_generic.h
• krb5: fix output_token allocators in the GSS debug stub (Windows)
• krb5: return appropriate error on send failures
• krb5_gssapi: fix memory leak on error path
• krb5_sspi: the chlg argument is NOT optional
• ldap: avoid null ptr deref on failure
• ldap: do not base64 encode zero length string
• ldap: do not pass a \n to failf()
• ldap: tidy-up types, fix error code confusion
• lib1514: fix return code mixup
• lib: delete unused crypto header includes
• lib: drop unused include and duplicate guards
• lib: fix build error with verbose strings disabled
• lib: remove newlines from failf() calls
• lib: remove personal names from comments
• lib: SSL connection reuse
• lib: stop NULL-checking conn->passwd and ->user
• lib: upgrade/multiplex handling
• libcurl-multi.md: added curl_multi_get_offt mention
• libcurl-security.md: mention long-running connections
• libssh/libssh2: reject quote command lines with too much data
• libssh/sftp: fix resume corruption by avoiding O_APPEND with rresume
• libssh2/sftp: fix resume corruption by avoiding O_APPEND with rresume
• libssh2/sftp_realpath: change state consistently
• libssh2: avoid risking using an uninitialized local struct field
• libssh2: bail out on chgrp and chown number parsing errors
• libssh2: clarify that sshp->path is always at least one byte
• libssh2: drop two redundant null-terminations
• libssh2: error check and null-terminate in ssh_state_sftp_readdir_link()
• libssh2: fix EAGAIN return in ssh_state_auth_agent
• libssh2: fix return code for EAGAIN
• libssh2: use sockindex consistently
• libssh: acknowledge SSH_AGAIN in the SFTP state machine
• libssh: catch a resume point larger than the size
• libssh: clarify myssh_block2waitfor
• libssh: drop two unused assignments
• libssh: error on bad chgrp number
• libssh: error on bad chown number and store the value
• libssh: fix range parsing error handling mistake
• libssh: make atime and mtime cap the timestamp instead of wrap …

curl / Docs / Releases / Changes in 8.16.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.15.0 all changes 8.17.0 🠲

Changes in 8.16.0 - September 10 2025

8.16.0 8.16.0 Changes:

• build: bump minimum required mingw-w64 to v3.0 (from v1.0)
• curl: add --follow
• curl: add --out-null
• curl: add --parallel-max-host to limit concurrent connections per host
• curl: make --retry-delay and --retry-max-time accept decimal seconds
• hostip: cache negative name resolves
• ip happy eyeballing: keep attempts running
• mbedtls: bump minimum version required to 3.2.0
• multi: add curl_multi_get_offt
• multi: add CURLMOPT_NETWORK_CHANGED to signal network changed
• netrc: use the NETRC environment variable (first) if set
• smtp: allow suffix behind a mail address for RFC 3461
• tls: make default TLS version be minimum 1.2
• tool_getparam: add support for --longopt=value
• vquic: drop msh3
• websocket: support CURLOPT_READFUNCTION
• writeout: add %time{} Bugfixes:
• _PROTOCOLS.md: mention file:// is only for absolute paths
• acinclude: --with-ca-fallback only works with OpenSSL
• alpn: query filter
• ares: destroy channel on shutdown
• ares: use ares_strerror() to retrieve error messages
• asyn-thrdd: fix --disable-socketpair builds
• asyn-thrdd: fix Curl_async_pollset without socketpair
• asyn-thrdd: fix no HAVE_GETADDRINFO builds
• asyn-thrdd: manage DEFERRED and locks better
• autotools: make curl-config executable
• aws-lc: do not use large buffer
• BINDINGS.md: add LibQurl
• bufq: add integer overflow checks before chunk allocations
• bufq: removed "Useless Assignment"
• bufq: simplify condition
• build: allow libtests/clients to use libcurl dependencies directly
• build: disable TCP_NODELAY for emscripten
• build: enable _GNU_SOURCE on GNU/Hurd
• build: extend GNU C guards to clang where applicable, fix fallouts
• build: fix build errors/warnings in rare configurations
• build: fix disable-verbose
• build: fix mingw-w64 version guard for mingw32ce
• build: if no perl, fix to use the pre-built hugehelp, if present
• build: link to Apple frameworks required by static wolfSSL
• build: support LibreSSL native crypto lib with ngtcp2 1.15.0+
• build: tidy up compiler definition for tests
• cf-https-connect: delete unused declaration
• clang-tidy: disable clang-analyzer-security.ArrayBound
• cmake: CURL_CA_FALLBACK only works with OpenSSL
• cmake: capitalize 'Rustls' in the config summary
• cmake: defer building unitprotos.h till a test target needs it
• cmake: define WIN32_LEAN_AND_MEAN for examples
• cmake: drop redundant unity mode for curlinfo
• cmake: enable -Wall for MSVC 1944
• cmake: fix ENABLE_UNIX_SOCKETS=OFF with pre-fill enabled on unix
• cmake: fix setting LTO properties on the wrong targets
• cmake: fix to disable Schannel and SSPI for non-Windows targets
• cmake: fix to restrict SystemConfiguration to macOS
• cmake: honor CMAKE_C_FLAGS in test 1119 and 1167
• cmake: improve error message for invalid HTTP/3 MultiSSL configs
• cmake: keep websockets disabled if HTTP is disabled
• cmake: make runtests targets build the curl tool
• cmake: make the ExternalProject test work
• cmake: omit linking duplicate/unnecessary libs to tests & examples
• cmake: re-add simple test target, and name it tests
• cmake: set CURL_DIRSUFFIX automatically in multi-config builds
• CODE_STYLE: sync with recent checksrc.pl updates
• config-win32.h: do not use winsock2 inet_ntop()/inet_pton()
• configure: if no perl, disable unity and shell completion, related tidy ups
• configure: tidy up internal names in ngtcp2 ossl detection logic
• connectdata: remove primary+secondary ip_quadruple
• connection: terminate after goaway
• contrithanks: fix for BSD sed tool
• cookie: don't treat the leading slash as trailing
• cookie: remove expired cookies before listing
• curl-config: remove X prefix use
• curl/system.h: fix for GCC 3.3.x and older
• curl: make the URL indexes 64-bit
• curl: tool_read_cb fix of segfault
• curl_addrinfo: drop workaround for old-mingw
• curl_easy_ssls_export: make the example more clear
• curl_fnmatch, servers: drop local macros in favor of sizeof()
• curl_mime_data_cb.md: mention what datasize is for
• curl_ossl: extend callback table for nghttp3 1.11.0
• curl_setup.h: include stdint.h earlier
• curl_setup.h: move UWP detection after config-win32.h (revert)
• curl_setup.h: move UWP detection after config-win32.h
• CURLINFO_FILETIME*.md: correct the examples
• CURLOPT: bump CURL_REDIR_* macros to long
• CURLOPT: bump CURL_SSLVERSION_* macros to long
• CURLOPT: bump CURLALTSVC_* macros to long
• CURLOPT: bump CURLFTP* enums to long, drop casts
• CURLOPT: bump CURLHEADER_* macros to long, drop casts
• CURLOPT: bump CURLPROTO_* macros to long
• CURLOPT: bump CURLPROXY_* enums to long, drop casts
• CURLOPT: bump CURLWS_NOAUTOPONG, CURLWS_RAW_MODE macros to long
• CURLOPT: bump remaining macros to long
• CURLOPT: drop redundant long casts
• CURLOPT: replace (long) cast with L suffix for CURLHSTS_* macros
• CURLOPT_HTTP_VERSION: mention new default value
• CURLOPT_SSL_CTX_*: replace the base64 with XXXX
• delta: fix warnings, fix for non-GNU date tool
• DEPRECATE.md: drop old OpenSSL versions
• DEPRECATE.md: drop support for c-ares versions before 1.16.0
• DEPRECATE.md: drop support for Windows XP/2003
• DEPRECATE.md: remove leftover "nothing"
• DISTROS.md: add Haiku
• docs/cmdline-opts: the auth types are not mutually exclusive
• docs: add CURLOPT type change history, drop casts where present
• docs: fix link CONTRIBUTE.md link
• docs: fix name in curl_easy_ssls_export man page
• docs: fix typo (staring -> starting)
• docs: point two broken links to archive.org
• doh: rename symbols to avoid collision with mingw-w64 headers
• easy handle: check validity on external calls
• examples: drop long cast for CURLALTSVC_*
• examples: make CURLPIPE_MULTIPLEX fallback long
• examples: remove base64 encoded chunks from examples
• examples: remove href_extractor.c
• ftp: store directory components as start+len instead of memdup'ing
• ftp: use 'conn' instead of 'data->conn'
• gnutls: fix building with older supported GnuTLS versions
• gnutls: some small cleanups
• hmac: return error if init fails
• hostip: do DNS cache pruning in milliseconds
• HTTP3.md: avoid configure issue for ngtcp2 1.14.0+ compatibility
• http: const up readonly H2_NON_FIELD
• http: do the cookie list access under lock
• http: silence -Warray-bounds with gcc 13+
• idn: reject conversions that end up as a zero length hostname
• inet_pton, inet_ntop: drop declarations when unused
• lib1560: fix memory leak when run without UTF-8 support
• lib1560: replace an int with bool
• lib2700: use testnum
• lib517: use LL 64-bit literals & re-enable a test case (time_t)
• lib: drop UNUSED_PARAM macro
• libcurl: reset rewind flag in curl_easy_reset()
• libssh: Use sftp_aio instead of sftp_async for sftp_recv
• libtests: update format strings to avoid casts, drop some macros
• libtests: use FMT_SOCKET_T, drop more casts
• managen: reset text mode at end of table marker
• mbedtls: check for feature macros instead of version
• mdlinkcheck: handle links with a leading slash properly
• memanalyze: fix warnings
• memory: make function overrides work reliably in unity builds
• multi event: remove only announced
• multi: don't insert a node into the splay tree twice
• multi: fix assert in multi_getsock()
• multi: fix bad splay management
• multi: process pending, one by one
• multi: replace remaining EXPIRE_RUN_NOW
• multissl: initialize when requesting a random number
• ngtcp2: extend callback tables for nghttp3 1.11.0 and ngtcp2 1.14.0
• ngtcp2: handshake timeout should be equal to --connect-timeout
• ngtcp2: use custom mem funcs
• openssl: add and use HAVE_BORINGSSL_LIKE internal macro
• openssl: add and use HAVE_OPENSSL3 internal macro
• openssl: assume OPENSSL_VERSION_NUMBER
• openssl: auto-pause on verify callback retry
• openssl: check SSL_write() length on retries
• openssl: clear errors after a failed d2i_X509()
• openssl: drop more legacy cruft
• openssl: drop redundant HAVE_OPENSSL_VERSION macro
• openssl: drop redundant version check
• openssl: drop single-use interim macro USE_OPENSSL_SRP
• openssl: enable HAVE_KEYLOG_CALLBACK for AWS-LC
• openssl: merge two #if blocks
• openssl: output unescaped UTF-8 x509 issuer/subject DNs
• openssl: remove legacy cruft, document macro guards
• openssl: save and restore OpenSSL error queue in two functions
• openssl: some small cleanups
• openssl: split cert_stuff into smaller sub functions
• openssl: sync an AWS-LC guard with BoringSSL
• openssl: use RSA_flags() again with BoringSSL
• parallel-max: bump the max value to 65535
• parsedate: make Curl_getdate_capped able to return epoch
• processhelp.pm: fix to use the correct null device on Windows
• processhelp.pm: use Win32::Process* perl modules if available
• projects: drop unused logic from generate.bat
• projects: fix Windows project 'clean' function
• pytest: add SOCKS tests and scoring
• pytest: fix test_17_09_ssl_min_max for BoringSSL
• pytest: increase server KeepAliveTimeout
• pytest: relax error check on test_07_22
• resolving: dns error tracing
• runtests: assume Time::HiRes, drop Perl Win32 dependency
• runtests: remove warning message
• runtests: replace --ci with --buidinfo, show OS/Perl version again
• runtests: show still running tests when nothing has happened for a while
• schannel: add an error message for client cert not found
• schannel: assume CERT_CHAIN_REVOCATION_CHECK_CHAIN
• schannel: drop fallbacks for 4 macros
• schannel: drop fallbacks for unused BCRYPT_* macros
• schannel: drop old-mingw special case
• schannel: fix recent update for mingw32ce
• schannel: fix renegotiation
• schannel: improve handshake procedure
• schannel: not supported with UWP, drop redundant code
• schannel: use if(result) like the code style says
• scripts: enable strict warnings in Perl where missing, fix fallouts
• scripts: fix two Perl uninitialized value warnings
• sendf: getting less data than "max allowed" is okay
• servers: convert two macros to scoped static const strings
• setopt: refactor out the booleans from setopt_long to setopt_bool
• setopt: split out cookielist() and cookiefile()
• socks: do_SOCKS5: Fix invalid buffer content on short send
• socks_sspi: simplify, clean up Curl_SOCKS5_gssapi_negotiate
• spacecheck.pl: when detecting unicode, mention line number
• spacecheck: warn for 3+ empty lines in a row, fix fallouts
• spelling: file system
• test1148: drop redundant LC_NUMBER= env setting
• test1557: pass long type to multi_setopt()
• test1560: set locale/codeset with LC_ALL (was: LANG), test in CI
• test1560: skip some URLs if UTF-8 is not supported
• test1: raise alloc limits
• test428: re-enable for Windows
• test436: fix running on Windows with _curlrc present
• test: add cygwin feature and use it (test 1056, 1517)
• tests/ech_tests.sh: indent, if/for style, inline ifs
• tests: constify command-line arguments
• tests: delete unused commands
• tests: drop unused BLANK envs, unset CURL_NOT_SET
• tests: drop unused CURL_FORCEHOST envs
• tests: fix perl warnings in http2-server, http3-server
• tests: fix prechecks to call the bundle libtest tool
• tests: fix UTF-8 detection, per-test LC_* settings, CI coverage
• tests: merge clients into libtests, drop duplicate code
• tests: remove the QUIT filters
• tests: set CURL_ENTROPY per test, not globally
• tests: unset some envs instead of blanking them
• threaded-resolver: fix shutdown
• tidy-up: Curl_thread_create() callback return type
• tidy-up: move literal to the right side of comparisons
• tidy-up: prefer ifdef/ifndef for single checks
• tls: CURLINFO_TLS_SSL_PTR testing
• TODO: remove session export item
• TODO: remove the expand ~ idea …

curl / Docs / Releases / Changes in 8.15.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.14.1 all changes 8.16.0 🠲

Changes in 8.15.0 - July 16 2025

8.15.0 8.15.0 Changes:

• TLS: remove support for Secure Transport and BearSSL Bugfixes:
• altsvc: accept 'clear' without semicolon as well
• asyn-ares: remove redundant NULL check
• asyn-thrdd: free the previous name before strdup'ing the new
• autotools: detect and link brotlicommon library for brotli
• autotools: drop $top_builddir/src from src header path
• autotools: drop headers from src mk-unity rules (fixup)
• autotools: drop no longer necessary --srcdir unity options
• autotools: drop redundant Makefile.inc from EXTRA_DIST in src
• autotools: simplify configuration in tests, examples
• bufq: change read/write signatures
• bufq: remove the unused Curl_bufq_unwrite function
• build: assume sys/socket.h, sys/time.h on non-Windows (as in curl/curl.h)
• build: drop HAVE_SYS_SOCKET_H and HAVE_SYS_TIME_H macros
• build: drop explicit curlx from hdr paths, refer headers with curlx/ prefix
• build: drop unused variables in tests
• build: fix libcurltool with cmake and tunits, related tidy-ups
• build: split .c and .h file lists in tests
• build: stop checking for sys/stat.h
• build: stubgss tidy-ups (in tests)
• build: sync build scripts between client/libtest
• build: tidy up Makefile.inc use in lib and src
• build: tidy up header paths, use srcdir where possible
• cf-socket: make socket data_pending a nop
• checksrc-all: rewrite in Perl, remove checksrc.bat
• checksrc: reduce exceptions, apply again to curlx
• cmake/FindGSS: fix processing C header path options
• cmake/FindGSS: initialize result variables
• cmake: curl_add_clang_tidy_test_target tidy-ups
• cmake: build stubgss library for libtests to match autotools
• cmake: check USE_WINDOWS_SSPI when adding secur32 to CURL_LIBS
• cmake: configure c-ares header directory in project root (was: lib)
• cmake: document OpenSSL and ngtcp2 crypto lib custom variables
• cmake: drop never propagated C macros
• cmake: drop passing redundant CURL_STATICLIB in examples and clients
• cmake: drop redundant macro from test clients
• cmake: drop reference to future variable
• cmake: enable soversion by default for OpenHarmony OS
• cmake: fix curl_add_clang_tidy_test_target when no -D option
• cmake: fix generator expression in docs/examples
• cmake: gather options recursively in curl_add_clang_tidy_test_target
• cmake: make docs depend on support files
• cmake: move OUTPUT argument in the add_custom_command() line
• cmake: omit clang-tidy on internal libs curlu and curltool
• cmake: replace cmakelint with cmake-lint from cmakelang, fix issues
• cmake: replace the way clang-tidy verifies tests, fix issues found
• cmake: simplify handling generated lib1521.c in libtests
• cmake: sync target_link_libraries() order in tests more
• cmake: sync tests scripts by using the variable BUNDLE
• cmake: sync tests scripts with each other and autotools (more)
• cmake: use target_link_options() when available
• config-win32: fix default targets, shorten macro logic
• configure: order LDAP after the SSL libraries
• connect: drop unused struct member
• connection: clarify transport
• connection: eliminate member remote_addr
• curl-config: fix whitespace in usage text
• curl.h: make CURL_IPRESOLVE_* symbols defined as longs
• curl.h: make CURLSSLOPT_* symbols defined as longs
• curl.h: remove the "RESERVED" error codes
• curl: implement non-blocking STDIN read on Windows
• curl: improve non-blocking STDIN performance
• curl: remove the global argument from many functions
• curl: unify pointer names to global config
• curl_get_line: make sure lines end with newline
• curl_memory.h: fix to undefine accept4
• curl_path: make SFTP handle a path like /~ properly.
• curlinfo: provide the 'digest' feature
• CURLSHOPT_SHARE.md: mention multi-threading requires callbacks
• DEPRECATE.md: add VS2005 removal to the list
• digest: fix build with disabled digest auth
• DISTROS: update NixOS link
• docs,tests: fix english grammar "allow to" -> "allow to"
• docs/CONTRIBUTE: fix broken link
• docs/examples: add ftp-delete.c
• docs: beef up examples/websocket.c
• docs: fix broken link in CODE_REVIEW.md
• docs: fix broken link in INSTALL.md
• docs: fix docs for CURLOPT_PREQUOTE after #17616
• docs: fix documentation of connect_only 2
• docs: fix two typos
• docs: mention that the netrc file works without port numbers
• docs: mention the as-is concept generically
• docs: note SSLS-EXPORT feature in -ssl-sessions doc
• docs: reflect that delimiter-separated capath is only OpenSSL
• docs: sync -tls-earlydata support w/ CURLOPT_SSL_OPTIONS
• docs: warn about lifetime in CURLOPT_CLOSESOCKET*
• easy: fix comment-documentation
• easygetopt: fix curl logo in header comment
• firefox-db2pem: avoid use of eval in script
• ftp: fix prequotes for a directory in URL
• ftplistparser: split parse_unix into sub functions
• h2_serverpush: fix file handle leaks reported by clang-tidy
• h3: fix query of concurrent streams
• http/3: report handshake with version and cipher as for TCP connections
• http2: do not delay RST send on aborted transfer
• http2: fix var types in is_alive() implementations
• http: explicitly ignore parsing errors for Retry-After
• http: fix build with cookies and HSTS disabled
• http_ntlm: protect against null deref
• http_ntlm: remove unreachable code
• INSTALL.md: cygwin details and add source code link
• ldap: avoid automake caching issues with LDAP library names
• ldap: if ldap-lib is sufficient, add it to LIBS.
• ldap: initial support for --with-ldap option
• lib2082: drop typedef struct
• lib: address singleuse issues
• lib: avoid reusing unclean connection
• lib: drop two interim macros in favor of native libcurl API calls
• lib: fix unused parameter/function compiler warnings
• lib: make CURLX_SET_BINMODE() and use it
• lib: make curlx_wait_ms() and use it
• lib: replace scache no-op macros with #ifdef
• lib: stop time() debug overrides at the end of source in altsvc, hsts
• lib: unify recv/send function signatures
• libcurl-env.md: drop LOGNAME, USER and NTLMUSER
• libcurl.m4: fix indentation
• libssh2: remove use of 'initialised' for cleanup
• libssh: de-complex myssh_statemach_act()
• libssh: fix readdir issues
• libtests: make test 1503,1504,1505 use the 1502 binary
• libtests: more header tidy-ups
• libtests: stop building the sames source multiple times
• memdebug.h: #undef fclose before defining it
• memdebug.h: eliminate global macro CURL_MT_LOGFNAME_BUFSIZE
• memdebug: include in unity batch
• memory: stop overriding unused wcsdup()/_wcsdup() system functions
• memory: tidy up _tcsdup() override
• misc: fix typos
• mk-lib1521: replace printf with curl_mprintf
• multi: add dirty bitset
• multi: do no expire a blocked transfer
• multi: fix polling with pending input
• multi: remove careful bounds check as coverity says it is not needed
• multi: xfer table/bitset, handle limits
• ngtcp2: fix coverity warning about result handling
• openssl: enable readahead
• openssl: error on SSL_ERROR_SYSCALL
• openssl: fix handling of buffered data
• openssl: fix openssl engine use
• openssl: fix pkcs11 provider available check
• os400: upgrade ILE/RPG bindings with latest definitions.
• pingpong: on disconnect, check for unflushed pingpong state
• projects/build-openssl.bat: remove
• pytest test_07_70, weaken early data check
• pytest: adapt for runs with openssl-1.1.1
• pytest: disable test_07_37 and test_07_36 with openssl's quic
• quic: implement CURLINFO_TLS_SSL_PTR
• RELEASE-PROCEDURE.md: update docs/VERSIONS
• runtests.pl: fix sprintf() using one too many %s
• runtests: fix LD_PRELOAD detection for cmake-built curl binaries
• runtests: support memory-limits per test
• rustls: apply memory function overrides, fixing an ECH buffer free
• rustls: don't try printing the not provided file
• schannel: allow partial chains for manual peer verification
• schannel: drop Windows 2000 compatibility logic
• scorecard: flame graphs and documentation
• SCP/SFTP: avoid busy loop after EAGAIN
• scripts: fix to quote the copyright email address
• socks: fix query when filter context is null
• system.h: remove some macros
• test1117: reduce write delays
• test1175: fix to run, and fix documentation issues detected
• test1222: fix for out-of-tree and no-libcurl-manual builds
• test1499, 1599: use %LOGDIR
• test1499: verify two chunked responses on reused connection
• test1596: let test pass after year 2036
• test1706: pass include directory to managen for out-of-tree builds
• tests/client: drop autotools logic no longer necessary
• tests/client: use curl_mfprintf()
• tests/dnsd: read config from file
• tests/http/clients: drop hack and use curl_setup.h again
• tests/http/clients: move to tests/client
• tests/http/requirements: remove multipart
• tests/libtest: call curlx_now_init() for unit 1399, 2600 (Windows)
• tests/libtest: drop TEST_HANG_TIMEOUT redefinition hack
• tests/libtest: drop a checksrc exception
• tests/libtest: use curltime from curlx
• tests/server/util.c: include netinet/in6.h
• tests/server: de-dupe/merge three sockdaemon() clones into one
• tests/server: drop memdebug.h
• tests/server: make all global vars/funcs static
• tests/server: move memory init to memptr.c
• tests/servers.pm: add more ways to figure out current user
• tests: always make bundles, adapt build and tests
• tests: bundle http clients, de-dupe, enable for MSVC
• tests: constify, make consts static
• tests: drop BUNDLE_SRC variable
• tests: drop mk-bundle exceptions
• tests: drop unused or redundant includes
• tests: drop useless "nodist_SOURCES" assignments
• tests: fail torture if !valgrind&threaded resolver
• tests: fix 1301, 1308 to fail on error
• tests: fix BUNDLE variable references in Makefile.am
• tests: make all names < 75 characters long
• tests: make individual test sources compile cleanly
• tests: make sshserver less verbose
• tests: move curlcheck.h to libtest as unitcheck.h
• tests: move GSS-API dynamic stub into debug-mode libcurl
• tests: torture: don't duplicate valgrind command
• tests: use %b64[] to base64 data
• tests: use %b64[] to base64 data in 2056, 2057
• tftpd: use CURLMIN() macro
• tidy-up: replace <memdebug.h> with "memdebug.h" (src, units)
• tls: remove Curl_ssl false_start
• tool1621: drop unused internal libcurl headers
• tool_getparam: fix --ftp-pasv
• tool_operate: fix return code when --retry is used but not triggered
• tool_paramhelp: fix language in comments
• top-complexity: lower max allowed complexity threshold to 90
• unit tests: extract "private" prototypes at build time
• unit1302: expand the base64 encode/decode tests
• url: fix connection lifetime checks
• url: fix NULL deref with bad password when no user is provided
• urlapi: simplify and split into sub functions
• urlapi: use uppercase hex encoding
• vauth: move auth structs to conn meta data
• vtls: change send/recv signatures of tls backends
• vtls: fix a copy-pasted early data comment typo
• vtls: log rustls negotiated KEX group name
• vtls: prefer ciphersuite to cipher in msgs
• vtls: prefer rustls-ffi ciphersuite name API
• VULN-DISCLOSURE-POLICY.md: fix typos
• VULN-DISCLOSURE-POLICY: all reports should be disclosed
• VULN-DISCLOSURE-POLICY: exclude not installed software
• VULN-DISCLOSURE-POLICY: minor language polish
• warnless: drop parts of the read/write preprocessor hack (Windows)
• warnless: replace read()/write() wrapper functions with macros (Windows)
• windows: drop redundant curl_wcsdup_callback callback
• windows: fixup fopen() in CURLDEBUG builds
• windows: reduce/stop loading DLLs at runtime
• wolfssl: add support for ML_KEM hybrids
• ws: drop redundant CURL_EXTERN from function definitions
• xfer: manage pause bits

Further

…

curl / Docs / Releases / Changes in 8.14.1 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.14.0 all changes 8.15.0 🠲

Changes in 8.14.1 - June 4 2025

8.14.1 8.14.1 Changes: Bugfixes:

• asyn-thrdd: fix cleanup when RR fails due to OOM
• autotools: recognize more Linux targets when setting -D_GNU_SOURCE
• BUG-BOUNTY.md. mention the medium bounty amount in 2025
• cmake: fix missed version number for multi-pkg-config detections
• cmdline-docs: mention HTTP resumed uploads to be shaky
• curl: make -N handled correctly
• curl: upload from '.' fix
• dllmain: exclude from Cygwin builds
• docs/tests: remove mention of hyper
• docs: fix typos
• ftp: fix teardown of DATA connection in done
• http: fail early when rewind of input failed when following redirects
• license: update some copyright links to curl.se
• memanalyze.pl: fix getaddrinfo/freeaddrinfo checks
• misc: fix spelling
• misc: we write an IPv6 address
• multi: fix add_handle resizing
• spelling: 'a' vs 'an'
• spelling: call it null-terminate consistently
• test1510: fix expectation
• tests: await portfile to be complete
• tests: fix checks for https-mtls proto
• tests: improve server start reliability
• tests: move test docs into /docs
• tests: re-enable 1510, document heimdal memleak
• tests: test mtls also w/ clientAuth EKU only
• tests: test mtls with --insecure
• tls BIOs: handle BIO_CTRL_EOF correctly
• tool_getparam: make --no-anyauth not be accepted
• tool_getparam: refactored, simplified
• tool_getparam: remove two nextarg NULL checks
• VULN-DISCLOSURE-POLICY.md: the distros list wants <= 7 days embargo
• wolfssl: fix sending of early data
• ws: handle blocked sends better
• ws: tests and fixes

Further

The previous release was 8.14.0. The next release was 8.15.0.

curl / Docs / Releases / Changes in 8.14.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.13.0 all changes 8.14.1 🠲

Changes in 8.14.0 - May 28 2025

8.14.0 8.14.0 Changes:

• mqtt: send ping at upkeep interval
• schannel: handle pkcs12 client certificates containing CA certificates
• TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
• vquic: ngtcp2 + openssl support
• wcurl: import v2025.04.20 script + docs
• websocket: add option to disable auto-pong reply Bugfixes:
• _SEEALSO.md: remove spaces around command and man page section
• asyn-thrdd: fix detach from running thread
• asyn-thrdd: explain how this is okay with a comment
• asyn resolver code improvements
• async-threaded resolver: use ref counter
• async: DoH improvements
• autotools: detect wolfSSL_set_quic_use_legacy_code like cmake does
• autotools: install shell completion files on cross build
• aws-sigv4: allow a blank string
• build: check required rustls-ffi version
• build: enable gcc-12/13+, clang-10+ picky warnings
• build: enable gcc-15 picky warnings
• certs: drop unused default_bits from .prm files
• cf-https-connect: use the passed in dns struct pointer
• cf-socket: fix FTP accept connect
• cfilters: remove assert
• cmake/FindNGTCP2: simplify multi-pkg-config detection
• cmake: append picky warnings to CMAKE_REQUIRED_FLAGS as string
• cmake: avoid 'target is imported but not globally visible' when consuming libcurl with old cmake
• cmake: do not install mk-ca-bundle script and man page
• cmake: enable -Wall for MSVC when PICKY_COMPILER=ON
• cmake: extend integration tests
• cmake: fix fish install directory detection via pkg-config
• cmake: fix nghttp3 static linking with USE_OPENSSL_QUIC=ON
• cmake: fix option() and mark_as_advanced() mixed order
• cmake: fix shell completion install when only one flavor is enabled
• cmake: honor individual picky option overrides found in CMAKE_C_FLAGS
• cmake: install shell completions for cross-builds
• cmake: link crypt32 for OpenSSL feature detection
• cmake: merge CURL_WERROR logic into PickyWarnings.cmake
• cmake: prefer COMPILE_OPTIONS over CMAKE_C_FLAGS for custom C options
• cmake: quotes, whitespace, use VERSION_GREATER_EQUAL
• cmake: revert CURL_LTO behavior for multi-config generators
• cmake: set BUILDING_LIBCURL directly for unit test targets
• cmake: stop deleting -W<n> from CMAKE_C_FLAGS (MSVC)
• cmake: tidy up and document feature detections in dependencies
• cmake: use CMAKE_COMPILE_WARNING_AS_ERROR if available
• cmake: use INCLUDE_DIRECTORIES prop to specify local header dirs
• cmake: use LIB_NAME in curl-config.cmake.in
• cmake: use absolute paths for completion targets
• cmake: use the LINK_OPTIONS property with CMake 3.13+
• configure: catch asking for double resolver without https-rr
• configure: fix --disable-rt
• configure: restore link checks
• configure: suppress command not found for brew
• conncache: make Curl_cpool_init return void
• connect: shutdown timer fix
• content_encoding: Transfer-Encoding parser improvements
• CONTRIBUTE: add project guidelines for AI use
• contrithanks.sh: drop set -e
• cpool/cshutdown: force close connections under pressure
• curl: fix memory leak when -h is used in config file
• curl: only warn once for --manual in manual-disabled build
• curl_get_line: handle lines ending on the buffer boundary
• curl_krb5: only use functions if FTP is still enabled
• curl_multibyte: fixup low-level calls, include in unity builds
• curl_osslq: remove a leftover debug fprintf() call
• curl_version_info.md: clarify ssl_version for MultiSSL
• CURLMOPT_TIMERFUNCTION.md: correct the example
• CURLOPT_ERRORBUFFER.md: buffer is read only after curl takes ownership
• CURLOPT_FOLLOWLOCATION.md: switch to GET => no body
• CURLOPT_READFUNCTION.md: mention the seek callback
• CURLOPT_XFERINFOFUNCTION.md: fix the callback return type in example
• curlx: move the docs to docs/internals/
• DEPRECATE.md: drop support for VS2008
• DEPRECATE.md: drop Windows CE support
• dist: drop duplicate entry from CMAKE_DIST
• dns_entry: move from conn to data->state
• Dockerfile: update debian:bookworm-slim Docker digest to 90522ee
• docs/INSTALL.md: drop reference to removed configure option
• docs/libcurl: fix type and prototype problems in examples
• docs/libcurl: make examples build with picky compiler options
• docs/libcurl: mention sensitive data/headers
• docs: add missing return statement in examples
• docs: fix incorrect shell substitution in docker run example command
• docs: fix typo in retry.md
• docs: update distros links
• doh: httpsrr fix
• doh: make sure CURLOPT_PROTOCOLS is set a with a "long" arg
• doh: reduce the DNS request buffer size
• easy_reset: fix dohfor_mid member
• ECH: reference the OpenSSL ECH feature branch
• etag-save.md: mention how using both options is a good idea
• eventfd: fix feature guards
• formdata: cleanups
• ftp: fix bug in failed init
• ftp: fix race in upload handling
• ftplistparser: add two overflow preventions
• ftplistparser: split up into more functions
• generate.bat: exclude curlinfo.c from legacy VS projects
• genserv.pl: fail with a message if openssl is missing or failing
• headers: enforce a max number of response header to accept
• headers: set an error message on illegal response headers
• hostip: fix build without threaded-resolver and without DoH
• hostip: show the correct name on proxy resolve error
• http2: fix stream window size after unpausing
• HTTP3.md: fix incorrect variable placeholders
• http: fix a build error when all auths are disabled
• http: fix HTTP/2 handling of TE request header using "trailers"
• http: in alt-svc negotiation only allow supported HTTP versions
• http_aws_sigv4: add additional verbose log statements
• http_aws_sigv4: improve sigv4 URL encoding and canonicalization
• http_chunks: narrow variable scope for 'trlen'
• http_negotiate: fix non-SSL build with GSSAPI
• https-connect: fix httpsrr target check
• HTTPSRR.md: clarify somewhat
• if2ip: build the function also if FTP is present
• imap: remove redundant condition
• INSTALL-CMAKE.md: fix typo
• INSTALL.md: update the minimal libcurl size example
• KNOWN_BUGS: fix link in sivg4 issue 16.3
• lib/src/docs/test: improve curl_easy_setopt() calls
• lib1560: use hex notation, drop non-ASCII exception
• lib3026: drop DLL pre-load perf mitigation for old mingw
• lib: add const to clientwriter tables
• lib: drop curlx_getpid, use fake pid in SMB
• lib: include files using known path
• lib: make Curl_easyopts const
• lib: unify conversions to/from hex
• libcurl-tutorial.md: fix read callback explanation
• libssh: add NULL check for Curl_meta_get()
• libssh: fix memory leak
• libssh: remove a condition that always equals false
• libtest/first: stop defining MEMDEBUG_NODEFINES
• libtests: define CURL_DISABLE_DEPRECATION first
• make: clean tests better
• mbedtls: TLS 1.3 is max when mbedtls has 1.3 support
• metahash: add asserts to help analyzers
• mk-ca-bundle.pl: follow redirects
• mk-ca-bundle: switch URLs to GitHub versions
• mkhelp: fix to not generate a line-ending space in some cases
• mqtt: use conn/easy meta hash
• multi: do transfer book keeping using mid
• multi: init_do(): check result
• netrc: avoid NULL deref on weird input
• netrc: avoid strdup NULL
• netrc: deal with null token better
• ngtcp2: clarify ignoring of result
• openssl-quic: avoid potential -Wnull-dereference, add assert
• openssl-quic: fix printf mask
• openssl-quic: fix shutdown when stream not open
• openssl: enable builds for both engines and providers
• openssl: set the cipher string before doing private cert
• parsedate: provide Curl_wkday also for GnuTLS builds
• processhelp.pm: always call taskkill with -f (force)
• processhelp.pm: avoid potential endless loop, log more (Windows)
• progress: avoid integer overflow when gathering total transfer size
• pytest tls: extend coverage
• pytest-xdist: pytest in parallel
• pytest: add pinnedpubkey test cases
• pytest: give parameterised tests better ids for read- and parsability
• pytest: make test_07_22 more lenient to exit codes
• quic: no local idle connection timeout, ngtcp2 keep-alive
• rand: update comment on Curl_rand_bytes weak random
• RELEASE-PROCEDURE.md: release candidate git tagging explained
• rtsp: remove redundant condition
• runtests: add retry option to reduce flakiness
• runtests: fix indentation
• runtests: recognize lowercase windows in curl -V
• runtests: remove server verification after start
• runtests: split SSH_PWD into SCP_PWD and SFTP_PWD, and more
• rustls: make max size of cert and key reasonable
• sasl: give help when unable to select AUTH
• scripts: completion.pl: sort the completion file for all shells
• scripts: drop unused import, formatting
• scripts: fix --opts-dir help in completion.pl
• scripts: fix perl indentation, whitespace, semicolons
• sectransp: fix building for macOS Sierra and older
• setopt: provide info for CURLE_BAD_FUNCTION_ARGUMENT
• smb: avoid integer overflow on weird input date
• socket: use accept4 when available
• socketpair: support pipe2 where available
• spacecheck.pl: check for non-ASCII chars, fix fallouts
• spacecheck.pl: verify tests/data/test* for non-ASCII chars
• src: drop strcase.[ch] from tool builds
• src: include memdebug.h consistently with angle brackets <>
• src: rename curlx_safefree to tool_safefree
• test1173.pl: whitelist some option-looking names that aren't options
• test1658: add unit test for the HTTPS RR decoder
• test: make unittest 1308 into a libtest
• tests/ech_tests.sh: sync shebang with rest of bash scripts
• tests/FILEFORMAT.md: clarify %hex[] formatting
• tests/FILEFORMAT.md: document the aws feature
• tests/README.md: document --test-duphandle
• tests/README.md: list the openssl tool among the prerequisites
• tests/server/dnsd: basic DNS server for test suite
• tests/server: check for stream != NULL in mqttd
• tests/server: fix typo in comment
• tests/server: stop using libcurl string comparisons
• tests/server: stop using libcurl's printf functions
• tests/serverhelp: remove last remnants of http-pipe server
• tests/tunit: make a separate directory for tool-based unit tests
• tests: add aws feature to the related tests
• tests: Add https-mtls server to force client auth
• tests: fix some test tag mismatches
• tests: mark ipfs tests to require ipfs
• tests: move a boolean variable out of the path section
• tests: prefer --insecure over -k
• tests: provide all non-ascii data hex encoded
• tests: remove some unused test case sections
• tests: require IPv6 for 1265, 1324, 2086
• tests: separate tunit tests from unit tests more
• tests: stop using libcurl's strdup
• tests: unify test case keywords
• tests: use a more portable null device path
• TODO: remove "nicer lacking perl message"
• tool_cb_write.c: handle EINTR on flush
• tool_getparam: clear argument only when needed
• tool_operate: make retrycheck() a separate function
• tool_operate: when retrying, only truncate regular files
• tool_paramhlp: avoid integer overflow in secs2ms()
• tool_parsecfg: make get_line handle lines ending on the buffer boundary
• typecheck-gcc.h: fix the typechecks
• urlapi: redirecting to "" is considered fine
• urlapi: remove unneeded guards around PUNY2IDN
• urldata: remove the unused struct field 'hide_progress'
• VERSIONS: list all past releases
• vquic: consistent name for the stream struct across backends
• vquic: init for every call to recvmsg
• vtls: avoid NULL deref on bad PEM input
• vtls: fix build with ssl but without http
• VULN-DISCLOSURE-POLICY: use of weak algos
• winbuild: add the deprecation warning to the README
• winbuild: curl_get_line is not used for tool builds
• windows: fix builds targeting WinXP, test it in CI
• wolfssl: fix to enable ALPN when available
• ws: fix the header replace check
• ws: store protocol context as connection meta data

Further

…

curl / Docs / Releases / Changes in 8.13.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.12.1 all changes 8.14.0 🠲

Changes in 8.13.0 - April 2 2025

8.13.0 8.13.0 Changes:

• curl: add write-out variable 'tls_earlydata'
• curl: make --url support a file with URLs
• gnutls: set priority via --ciphers
• IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
• lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
• OpenSSL/quictls: add support for TLSv1.3 early data
• rustls: add support for CERTINFO
• rustls: add support for SSLKEYLOGFILE
• rustls: support ECH w/ DoH lookup for config
• rustls: support native platform verifier
• var: add a '64dec' function that can base64 decode a string
• wolfssl: tls early data support Bugfixes:
• addrinfo: add curl macro to avoid redefining foreign symbols
• asyn-thread: avoid the separate 'struct resdata' alloc
• asyn-thread: avoid the separate curl_mutex_t alloc
• asyn-thread: do not allocate thread_data separately
• asyn-thread: remove 'status' from struct Curl_async
• autotools: fix dllmain.c in unity builds
• autotools: fix libtest bundle to depend on FIRSTFILES
• autotools: use CURLDEBUG to exclude TrackMemory code from unity
• aws_sigv4: cannot be used for proxy
• aws_sigv4: merge repeated headers in canonical request
• aws_sigv4: use strparse more for parsing
• base64: drop BUILDING_CURL macro, always include in tests/server
• build: add Windows CE / CeGCC support, with CI jobs
• build: cmake multi-pkg-config detection improvements (brotli, ldap, mbedtls)
• build: do not apply curl debug macros to tests/server by default
• build: drop unused getpart tool
• build: enable -Wjump-misses-init for GCC 4.5+
• build: enable -Wcast-qual, fix or silence compiler warnings
• build: fix compiler warnings in feature detections
• build: replace Curl_ prefix with curlx_ for functions used in servers
• build: set -O3 and tune WinCE in CI, fix getpart, vtls_scache fallouts
• build: set HAVE_STDINT_H if stdint.h is available
• build: set HAVE_WRITABLE_ARGV for Apple cross-builds
• build: silence bogus -Wconversion warnings with gcc 5.1-5.4
• build: silence mingw32ce C99 format warnings, simplify CI
• build: tidy-ups around inet_pton
• c-ares httpsrr: fix ifdef
• c-ares: error out for unsupported versions, drop unused macros
• ca-native.md: sync with CURLSSLOPT_NATIVE_CA
• cf-socket: deduplicate Windows Vista detection
• cf-socket: remove empty switch
• client writer: handle pause before decoding
• cmake: CURL_LIBDIRS improvements (upstreamed from vcpkg)
• cmake: SHARE_LIB_OBJECT=ON requires CMake 3.12 or newer
• cmake: add custom command scripts as dependencies where missing
• cmake: add pre-fill for Unix, enable in GHA/macos, verify pre-fills
• cmake: add shell completion support
• cmake: allow CURL_STATIC_CRT with shared libcurl and no curl exe
• cmake: allow CURL_STATIC_CRT with UCRT VS2015+ builds
• cmake: allow empty IMPORT_LIB_SUFFIX, add suffix collision detection
• cmake: avoid -Wnonnull warning in HAVE_FSETXATTR_5 detection
• cmake: disable HTTPS-proxy as a feature if proxy is disabled
• cmake: drop CURL_DISABLE_TESTS option
• cmake: drop HAVE_C_FLAG_Wno_long_double logic for ancient Apple gcc
• cmake: drop HAVE_IN_ADDR_T from pre-fill too
• cmake: drop two stray TLS feature checks for wolfSSL
• cmake: exclude -MP for clang-cl again
• cmake: fix HAVE_ATOMIC/HAVE_STDATOMIC pre-fill for clang-cl
• cmake: fix clang-tidy builds to verify tests, fix fallouts
• cmake: fix detection pre-fills for iOS
• cmake: fix ECH detection in custom-patched OpenSSL
• cmake: fix typo in ECH config error msg
• cmake: hide empty MINGW64_VERSION output for mingw32ce
• cmake: improve httpd detection for pytest
• cmake: mention 'insecure' in the debug build warning
• cmake: misc tidy-ups
• cmake: pre-fill known type sizes for Windows OSes
• cmake: replace CMAKE_COMPILER_IS_GNUCC with CMAKE_C_COMPILER_ID
• cmake: replace exec_program() with execute_process()
• cmake: restrict static CRT builds to static curl exe, test in CI
• cmake: sync cutoff version with autotools for picky option -ftree-vrp
• cmake: sync OpenSSL(-fork) feature checks with ./configure
• cmake: unity mode optimization for non-CURLDEBUG testdeps targets
• CODE_STYLE: readability and banned functions
• config-win32: set HAVE_STDINT_H where available
• configure: call the blocking resolver "blocking", not "default"
• configure: fix ECH detection with MultiSSL
• configure: silence compiler warnings in feature checks, drop duplicates
• configure: tidy up shell completion rules
• configure: use curl_cv_apple variable
• conn: eliminate conn->now
• conn: fix connection reuse when SSL is optional
• conncache: eliminate conn->destination_len as premature optimization
• contributors.sh: lowercase 'github' for consistency
• contrithanks.sh: update docs/THANKS in place
• cookie: do prefix matching case-sensitively
• cookie: minor parser simplification
• cookie: simplify invalid_octets()
• core: stop redefining E* macros on Windows, map EACCES, related fixes
• curl.h: change some enums to defines with L suffix
• curl.h: convert CURLUSESSL* names to defines
• curl.h: stop defining non-curl __has_declspec_attribute
• curl.h: switch CURL_HTTP_VERSION* enums to long constants
• curl/system.h: drop leftover comment about 32-bit curl_off_t
• curl: add my_setopt_long() and _offt()
• curl_msh3: remove verify bypass from DEBUGBUILDs
• curl_setup: drop ERANGE (for WinCE), no longer used
• curl_setup_once: drop E* macro redefines unused (with winsock2)
• curl_setup_once: stop redefining ENAMETOOLONG to winsock2 error code
• curl_trc: fix build with CURL_DISABLE_VERBOSE_STRINGS
• curl_ws_recv.md: expand a little on the fragments the API delivers
• CURLMOPT_SOCKETFUNCTION.md: add advice for socket callback invocation
• CURLOPT_HTTPHEADER.md: add comments to the example
• CURLOPT_HTTPHEADER.md: rephrases
• curltime: use libcurl time functions in src and tests/server
• DISABLED: add 313 for sectransp (move from GHA/macos)
• docs/cmdline-opts: use imperative form
• docs: adapt to removed --with-random
• docs: add FD_ZERO to curl_multi_fdset example
• docs: bump rustls to 0.14.1
• docs: correct argument names & URL redirection
• docs: minor edits to please the new spellchecker regime
• docs: rework RUSTLS install instructions
• docs: unify HTTP version style in --help output
• docs: vulnerabilities in debug code are not eligible for a bounty
• doh: improve HTTPS RR svcparams parsing
• doh: remove wrong but unreachable exit path from doh_decode_rdata_name
• dynbuf: assert init on free
• easy: drop break after return
• easy: fix warning about possible comma misuse
• eventfd: allow use on all CPUs
• examples: prefer return over exit() (cont.)
• ftp/sftp: strdup data info memory
• ftp: fix comment
• gnutls: fix connection state check on handshake
• gnutls: fix use of pkcs11 URLs for keys/certs
• gtls: fix uninitialized variable
• hash: use single linked list for entries
• hostip: don't use alarm() for DoH resolves
• hostip: make CURLOPT_RESOLVE support replacing IPv6 addresses
• http2: add on_invalid_frame callback for error detection
• http2: detect session being closed on ingress handling
• http2: enhance error messages on Curl_dyn* upon receiving headers
• http2: fix stream assignment for pushes
• http2: reset stream on response header error
• HTTP3.md: only speak about minimal versions
• http: convert parsers to strparse
• http: fix NTLM info message typo
• http: fix the auth check
• http: make the RTSP version check stricter
• http: negotiation and room for alt-svc/https rr to navigate
• http: remove an HTTP method size restriction
• http: version negotiation
• http_chunks: replace a strofft call with curl_str_hex
• https-rr: implementation improvements
• httpsrr: fix port detection
• httpsrr: fix the HTTPS-RR threaded-resolver build combo
• INFRASTRUCTURE.md: add IRC and Matrix details
• INSTALL-CMAKE.md: CMake usage updates
• INSTALL-CMAKE.md: mention ZLIB_USE_STATIC_LIBS
• lib1156: pass longs to curl_easy_setopt()
• lib1560: test set path containing LR or CR
• lib2302: fix crash due to stack overflow on MSVC and clang Windows
• lib696: fix building on Windows in non-bundle mode
• lib: better optimized casecompare() and ncasecompare()
• lib: clear up CURLRES_ASYNCH vs USE_CURL_ASYNC use
• lib: fix two curlx_strtoofft invokes
• lib: rename curlx_strtoofft to Curl_str_numblanks()
• lib: replace while(ISBLANK()) loops with Curl_str_passblanks()
• lib: simplify more white space loops
• lib: strtoofft.h header cleanup
• lib: use Curl_str_* instead of strtok_r()
• lib: use Curl_str_number() for parsing decimal numbers
• libssh2: fix freeing of resources in disconnect
• libssh2: fix memory leak in SSH_SFTP_REALPATH state
• libssh2: fix to ignore known_hosts if SHA256 host public key is set
• libssh2: print user with verbose flag
• libssh2: show crypto backend in the verbose connect log
• libssh: fix freeing of resources in disconnect
• libssh: fix scp large file upload for 32-bit size_t systems
• libtest/first.c: remove the Test: stderr output for unity builds
• libtest/libprereq.c: set CURLOPT_FOLLOWLOCATION with a long
• managen: accept more markdown-quote-markers
• managen: correct the warning for un-escaped '<' and '>'
• mbedtls: re-enable an error check
• memdebug.h: avoid -Wredundant-decls with an extra guard
• memdebug: drop dynamic allocation from curl_dbg_log()
• mprintf: switch three number parsers to use strparse
• mqtt: convert sendleftovers to dynbuf
• msvc: drop support for VS2005 and older
• multi: call protocol handler done() if PROTOCONNECT or later
• multi: event based rework
• multi: kill off remaining internal handles in curl_multi_cleanup
• multi: start the loop over when handles are removed
• multi_ev: fixes regarding connection shutdowns
• ngtcp2: do not iterate over multi handles
• ntlm: merge ntlm.h into ntlm.c
• openssl-quic: do not iterate over multi handles
• openssl: check return value of X509_get0_pubkey
• openssl: drop support for old OpenSSL/LibreSSL versions
• openssl: fix crash on missing cert password
• openssl: fix pkcs11 URI checking for key files.
• openssl: remove bad gotos into other scope
• prox/preproxy.md: document argument within
• pytest: test negotiate with http proxy
• quiche: do not iterate over multi handles
• RELEASE-PROCEDURE.md: explain release candidates
• request: clear sendbuf_hds_len when resetting request bufq
• resolve: fix building without Unix sockets and CURLDEBUG
• runtests: accept CURL_DIRSUFFIX without ending slash
• runtests: add feature-based filtering
• runtests: check and report if diff tool is missing
• runtests: drop logic calling the handle tool (Windows)
• runtests: drop recognizing 'winssl' as Schannel
• runtests: drop ref to unused external function
• runtests: fix bundled test invocation with -g option
• runtests: fix SSH server not starting in cases, re-ignore failing vcpkg CI jobs
• runtests: fix test key format for libssh2 WinCNG (and others)
• runtests: generate certs dynamically, bump to EC-256, tidy up
• runtests: recognize AWS-LC as OpenSSL
• runtests: rewrite genserv.sh in Perl
• runtests: support multi-target cmake, drop workarounds from CI
• runtests: support running tests under wine or qemu (cont.)
• runtests: support running tests under wine or qemu
• runtests: use setfacl on Cygwin/MSYS, if present
• rustls: add ECH support w/ string ECH config
• rustls: cap maximum allowed CRL file size to 8MB
• rustls: support ECH GREASE
• rustls: use client cert and key if available
• schannel: deduplicate Windows Vista detection
• schannel: enable ALPN support under WINE 6.0+
• schannel: enable ALPN with MinGW, fix ALPN for UWP builds
• schannel: guard ALPN init code to ALPN builds
• scripts/managen: fix option 'single'
• scripts/managen: fix parsing of markdown code sections …

curl / Docs / Releases / Changes in 8.12.1 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.12.0 all changes 8.13.0 🠲

Changes in 8.12.1 - February 13 2025

8.12.1 8.12.1 Bugfixes:

• all: remove FIXME and TODO comments
• asyn-thread: fix build with CURL_DISABLE_SOCKETPAIR
• asyn-thread: fix HTTPS RR crash
• asyn-thread: fix the returned bitmask from Curl_resolver_getsock
• asyn-thread: survive a c-ares channel set to NULL
• build: add tool_hugehelp.c into IBMi build
• checksrc.pl: warn on FIXME/TODO comments
• cmake/Find: set <Modulename>_FOUND for compatibility when found via pkg-config
• cmake: add integration tests, run them in CI
• cmake: always reference OpenSSL and ZLIB via imported targets
• cmake: avoid unnecessary -L for implicit link dirs
• cmake: drop LDAP_DEPRECATED=1 macro, to sync with autotools
• cmake: fix HAVE_GETHOSTBYNAME_R_* detections with CURL_WERROR=ON
• cmake: fix to detect HAVE_OPENSSL_SRP in MSVC UWP builds
• cmake: fix/add missing feature detections for Windows/MS-DOS
• cmake: initialize variables where missing
• cmake: lib order fixes for picky linkers (e.g. binutils ld)
• cmake: normalize before matching paths with syspaths
• cmake: respect GNUTLS_CFLAGS when detected via pkg-config
• cmake: respect GNUTLS_LIBRARY_DIRS in libcurl.pc and curl-config
• cmake: save a line with CMAKE_C_IMPLICIT_LINK_DIRECTORIES exclusion
• cmake: tidy up string append and list prepend syntax
• configure/cmake: check for realpath
• configure/cmake: set asyn-rr a feature only if httpsrr is enabled
• content_encoding: #error on too old zlib
• curl_global_sslset.md: Add SSL backend names
• CURLOPT_SSH_KNOWNHOSTS.md: strongly recommend using this
• CURLSHOPT_SHARE.md: adjust for the new SSL session cache
• docs: better explain multi-part byte range behavior
• docs: use valid example domain names
• generate.bat: remove curl_get_line.c from the curlx file list
• header.md: mention Authorization: and Cookie: special treatment
• imap: TLS upgrade fix
• INTERNALS: fix c-ares, as we actually support 1.6.0 or later
• ldap: drop support for legacy Novell LDAP SDK
• lib: include necessary headers for inet_ntop/inet_pton
• lib: silence LibreSSL collision warning on non-MSVC Windows
• libssh2: comparison is always true because rc <= -1
• libssh2: raise lowest supported version to 1.2.8
• libssh: drop support for libssh older than 0.9.0
• libssh: silence -Wconversion with a cast (Windows 32-bit)
• netrc: return code cleanup, fix missing file error
• openssl-quic: ignore ciphers for h3
• openssl: fix out of scope variables in goto
• pop3: TLS upgrade fix
• runtests: fix the disabling of the memory tracking
• runtests: quote commands to support paths with spaces
• scache: add magic checks
• smb: silence -Warray-bounds with gcc 13+
• smtp: TLS upgrade fix
• SPONSORS.md: clarify that we don't promise goods or services
• test1516: avoid failure due to spaces in path
• test2080: simplify, avoid the null byte
• tests: fix test 558, 1330 for MSVC, allow TrackMemory with MSVC in cmake
• tidy-up: make per-file ARRAYSIZE macros global as CURL_ARRAYSIZE
• tool_cfgable: sort struct fields by size, use bitfields for booleans
• tool_getparam: add "TLS required" flag for each such option
• tool_progress: fix percent output of large parallel transfers
• tool_ssls: switch to tool-specific get_line function
• verbose.md: mention how carriage-return might occur in headers
• vquic: make the "disable GSO" use infof, not failf
• vtls: fix multissl-init
• vtsl: eliminate 'data->state.ssl_scache'
• wakeup_write: make sure the eventfd write sends eight bytes
• wolfssl: silence compiler warning (MSVC 2019), simplify existing

Further

The previous release was 8.12.0. The next release was 8.13.0.

curl / Docs / Releases / Changes in 8.12.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.11.1 all changes 8.12.1 🠲

Changes in 8.12.0 - February 5 2025

8.12.0 8.12.0 Changes:

• curl: add byte range support to --variable reading from file
• curl: make --etag-save acknowledge --create-dirs
• getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
• getinfo: provide info which auth was used for HTTP and proxy
• hyper: drop support
• openssl: add support to use keys and certificates from PKCS#11 provider
• QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
• vtls: feature ssls-export for SSL session im-/export Bugfixes:
• altsvc: avoid integer overflow in expire calculation
• altsvc: return error on dot-only name
• android: add CI jobs, buildinfo, cmake docs, disable CURL_USE_PKGCONFIG by default
• asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
• asyn-ares: fix memory leak
• asyn-ares: initial HTTPS resolve support
• asyn-thread: use c-ares to resolve HTTPS RR
• asyn-thread: avoid closing eventfd twice
• autotools: add support for mingw UWP builds
• autotools: silence gcc warnings in libtool code
• binmode: convert to macro and use it from tests
• build: delete -Wsign-conversion related FIXMEs
• build: drop -Winline picky warning
• build: drop tool_hugehelp.c.cvs, tidy up macros, drop buildconf.bat
• build: drop unused feature macros, update exception list
• build: fix -Wtrampolines picky warning for gcc 4.x versions
• build: fix compiling with GCC 4.x versions
• build: fix the tidy targets for autotools
• build: fix unsigned time_t detection for cmake, MS-DOS, AmigaOS
• build: replace configure check with PP condition (Android <21)
• build: stop detecting sched_yield() on Windows
• c-ares: fix/tidy-up macro initializations, avoid a deprecated function
• cd2nroff: do not insist on quoted <> within backticks
• cd2nroff: support "none" as a TLS backend
• cf-https-connect: look into httpsrr alpns when available
• cf-socket: error if address can't be copied
• cfilters: kill connection filter events attach+detach
• checksrc.bat: remove explicit SNPRINTF bypass
• checksrc: ban use of sscanf()
• checksrc: check for return with parens around a value/name
• checksrc: exclude generated bundle files to avoid race condition
• checksrc: fix the return() checker
• checksrc: introduce 'banfunc' to ban specific functions
• cmake/Find: add iphlpapi for c-ares, omit syslibs if dep not found
• cmake/FindLDAP: avoid empty 'Requires' item when omitting pkg-config module
• cmake/FindLDAP: avoid framework locations for libs too (Apple)
• cmake/FindLibpsl: protect against pkg-config "half-detection"
• cmake/FindLibssh: sync header comment with other modules
• cmake/FindMbedTLS: drop lib duplicates early
• cmake: add librtmp Find module
• cmake: add LDAP Find module
• cmake: add native pkg-config detection for remaining Find modules
• cmake: allow CURL_LTO regardless of CURL_BUILD_TYPE, enable in CI
• cmake: clang-cl improvements
• cmake: delete accidental debug message
• cmake: deprecate winbuild, add migration guide from legacy build methods
• cmake: detect mingw-w64 version, pre-fill HAVE_STRTOK_R
• cmake: do not store MINGW64_VERSION in cache
• cmake: drop CURL_USE_PKGCONFIG from curl-config.cmake.in
• cmake: drop fseeko() pre-fill and check for Windows
• cmake: drop duplicate Windows cache value
• cmake: drop redundant FOUND checks (libgsasl, libssh, libuv)
• cmake: drop redundant opening/closing .* from MATCH expressions
• cmake: drop unused HAVE_SYS_XATTR_H detection
• cmake: drop VS2010 "Dialog Hell" workaround added in 2013
• cmake: extend zlib's AUTO option to brotli, zstd and enable if found
• cmake: fix net/in.h detection for MS-DOS
• cmake: improve curl_dumpvars() and move to Utilities.cmake
• cmake: make libpsl required by default
• cmake: make system libraries dl, m, pthread customizable
• cmake: move pkg-config names to Find modules
• cmake: move GSS init before feature detections
• cmake: move mingw UWP workaround from GHA to CMakeLists.txt
• cmake: namespace functions and macros
• cmake: optimize out 4 picky warning option detections with gcc
• cmake: pick a better IPv6 feature flag when assembling the feature list
• cmake: pre-fill HAVE_STDATOMIC_H, HAVE_ATOMIC for mingw-w64
• cmake: pre-fill HAVE_STDINT_H on Windows
• cmake: prefer dash-style MSVC options
• cmake: publish/check supported protocols/features via CURLConfig.cmake
• cmake: replace unset(VAR) with set(VAR "") for init
• cmake: sync OpenSSL QUIC fork detection with autotools
• cmake: use CMAKE_REQUIRED_LINK_DIRECTORIES
• cmake: use STREQUAL to detect Linux
• cmake: warn for OpenSSL versions missing TLS 1.3 support
• cmdline-opts/version.md: describe multissl, mention SSLS-EXPORT
• completion.pl: add completion for paths after @ for fish
• config-mac: drop MACOS_SSL_SUPPORT macro
• config: drop unused code and variables
• configure: do not inline 'dnl' comments
• configure: drop unused detections and macros
• configure: streamline Windows large file feature check
• configure: UWP and Android follow-up fixes
• conncache: count shutdowns against host and max limits
• conncache: result_cb comment removed from function docs
• content_encoding: drop support for zlib before 1.2.0.4
• content_encoding: namespace GZIP flag constants
• content_encoding: put the decomp buffers into the writer structs
• content_encoding: support use of custom libzstd memory functions
• cookie: cap expire times to 400 days
• cookie: fix crash in netscape cookie parsing
• cookie: parse only the exact expire date
• curl-functions.m4: fix indentation in CURL_SIZEOF()
• curl: return error if etag options are used with multiple URLs
• curl_multi_fdset: include the shutdown connections in the set
• curl_multi_waitfds.md: tidy up the example
• curl_multibyte: support Windows paths longer than MAX_PATH
• curl_setup: fix missing ADDRESS_FAMILY type in rare build cases
• curl_sha512_256: rename symbols to the curl namespace
• curl_url_set.md: adjust the added-in to 7.62.0
• curl_ws_recv.md: fix typo
• CURLOPT_CONNECT_ONLY.md: an easy handle with this option set cannot be reused
• CURLOPT_PROXY.md: clarify the credential support in proxy URLs
• CURLOPT_RESOLVE.md: fix wording
• CURLOPT_SEEKFUNCTION.md: used for FTP, HTTP and SFTP (only)
• docs/BUGS.md: remove leading space from a link
• docs/cmdline-opts/_ENVIRONMENT.md: minor language fix
• docs/cmdline-opts/location.md: fix typos for location flag
• docs/HTTP-COOKIES.md: link to more information
• docs/HTTPSRR.md: initial HTTPS RR documentation
• docs/libcurl/opts: clarify the return values
• docs/libcurl: return value overhall
• docs/TLS-SESSIONS: fix typo, the->they
• docs: document the behavior of -- in the curl command line
• docs: use lowercase curl and libcurl
• doh: cleanups and extended HTTPS RR code
• doh: send HTTPS RR requests for all HTTP(S) transfers
• easy: allow connect-only handle reuse with easy_perform
• easy: make curl_easy_perform() return error if connection still there
• easy_lock: use Sleep(1) for thread yield on old Windows
• ECH: update APIs to those agreed with OpenSSL maintainers
• examples/block-ip: drop redundant memory.h include
• examples/block-ip: show how to block IP addresses
• examples/complicated: fix warnings, bump deprecated callback, tidy up
• examples/synctime.c: remove references to dead URLs and functionality
• examples: make them compile with compatibility functions disabled (Windows)
• examples: use return according to code style
• file: drop OPEN_NEEDS_ARG3 option
• file: fix Android compiler warning
• gitignore: add generated unity sources for lib and src
• GnuTLS: fix 'time_appconnect' for early data
• hash: add asserts in hash_element_dtor()
• HTTP/2: strip TE request header
• http2: fix data_pending check
• http2: fix value stored to 'result' is never read
• http: fix build with CURL_DISABLE_COOKIES
• http: ignore invalid Retry-After times
• http_aws_sigv4: Fix invalid compare function handling zero-length pairs
• https-connect: start next immediately on failure
• INFRASTRUCTURE.md: project infra
• INSTALL-CMAKE.md: fix punctuation
• INSTALL.md: add CMake examples for macOS and iOS
• INSTALL.md: document VS2008 and mingw-w64
• INTERNALS.md: sync wolfSSL version requirement with source code
• lib517: extend the getdate test with quotes and leading "junk"
• lib: clarify 'conn->httpversion'
• lib: redirect handling by protocol handler
• lib: remove __EMX__ guards
• lib: replace inline redefine with CURL_INLINE macro
• lib: suppress deprecation warnings in apple builds
• lib: TLS session ticket caching reworked
• libcurl/opts: do not save files in dirs where attackers have access
• Makefile.dist: delete
• Makefile.mk: drop in favor of autotools and cmake (MS-DOS, AmigaOS3)
• mbedtls: fix handling of blocked sends
• mbedtls: PSA can be used independently of TLS 1.3 (avoid runtime errors)
• mime: explicitly rewind subparts at attachment time.
• mprintf: fix integer handling in float precision
• mprintf: terminate snprintf output on windows
• msvc: add missing push/pop for warning pragmas
• msvc: assume _INTEGRAL_MAX_BITS >= 64
• msvc: drop checks for ancient versions
• msvc: fix building with HAVE_INET_NTOP and MSVC <=1900
• msvc: require VS2005 for large file support
• msvc: tidy up _CRT_*_NO_DEPRECATE definitions
• multi: fix curl_multi_waitfds reporting of fd_count
• multi: fix return code for an already-removed easy handle
• multihandle: add an ssl_scache here
• multissl: auto-enable OPENSSL_COEXIST for wolfSSL + OpenSSL
• multissl: make openssl + wolfssl builds work
• netrc: 'default' with no credentials is not a match
• netrc: fix password-only entries
• netrc: restore _netrc fallback logic
• ngtcp2: fix memory leak on connect failure
• ngtcp2: fix two cases of value stored never read
• openssl: define HAVE_KEYLOG_CALLBACK before use
• openssl: drop unused HAVE_SSL_GET_SHUTDOWN macro
• openssl: fix ECH logic
• osslq: use SSL_poll to determine writeability of QUIC streams
• projects/Windows: remove wolfSSL from legacy projects
• projects: fix INSTALL-CMAKE.md references
• pytest: remove 'repeat' parameter
• pytest: use httpd/apache2 directly, no apachectl
• RELEASE-PROCEDURE.md: mention how to publish security advisories
• runtests.pl: fix precedence issue
• scripts/mdlinkcheck: markdown link checker
• sectransp: free certificate on error
• select: avoid a NULL deref in cwfds_add_sock
• smb: fix compiler warning
• src: add CURL_STRICMP() macro, use _stricmp() on Windows
• src: drop support for CURL_TESTDIR debug env
• src: omit hugehelp and ca-embed from libcurltool
• ssl session cache: change cache dimensions
• strparse: string parsing helper functions
• symbols-in-versions: update version for LIBCURL_VERSION and LIBCURL_VERSION_NUM
• system.h: add 64-bit curl_off_t definitions for NonStop
• system.h: drop compilers lacking 64-bit integer type (Windows/MS-DOS)
• system.h: drop duplicate and no-op code
• system.h: fix indentation
• telnet: handle single-byte input option
• test1960: don't close the socket too early
• test483: require cookie support
• tests/http/clients: use proper sleep() call on NonStop
• tests: change the behavior of swsbounce
• tests: stop promoting perl warnings to fatal errors
• TheArtOfHttpScripting.md: rewrite double 'that'
• tidy-up: curl_setup.h, curl_setup_once.h, config-win32ce.h
• tidy-up: drop parenthesis around return expression
• tidy-up: drop parenthesis around return values
• tidy-up: extend CURL_O_BINARY to lib and tests
• TLS: check connection for SSL use, not handler
• tool_formparse.c: make curlx_uztoso a static in here
• tool_formparse: accept digits in --form type= strings
• tool_getparam: ECH param parsing refix
• tool_getparam: fail --hostpubsha256 if libssh2 is not used
• tool_getparam: fix "Ignored Return Value" …

curl / Docs / Releases / Changes in 8.11.1 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.11.0 all changes 8.12.0 🠲

Changes in 8.11.1 - December 11 2024

8.11.1 8.11.1 Bugfixes:

• build: fix ECH to always enable HTTPS RR
• build: fix MSVC UWP builds
• build: omit certain deps from libcurl.pc unless found via pkg-config
• build: use _fseeki64() on Windows, drop detections
• cmake: do not echo most inherited LDFLAGS to config files
• cmake: drop cmake args list from buildinfo.txt
• cmake: include wolfssl/options.h first
• cmake: remove legacy unused IMMEDIATE keyword
• cmake: restore cmake args list in buildinfo.txt
• cmake: set CURL_STATICLIB for static lib when SHARE_LIB_OBJECT=OFF
• cmake: sync GSS config code with other deps
• cmake: typo in comment
• cmake: work around ios.toolchain.cmake breaking feature-detections
• cmakelint: fix to check root CMakeLists.txt
• cmdline/ech.md: formatting cleanups
• configure: add FIXMEs for disabled pkg-config references
• configure: do not echo most inherited LDFLAGS to config files
• configure: replace $# shell syntax
• cookie: treat cookie name case sensitively
• curl-rustls.m4: keep existing CPPFLAGS/LDFLAGS when detected
• curl.h: mark two error codes as obsolete
• curl: --continue-at is mutually exclusive with --no-clobber
• curl: --continue-at is mutually exclusive with --range
• curl: --continue-at is mutually exclusive with --remove-on-error
• curl: --test-duphandle in debug builds runs "duphandled"
• curl: do more command line parsing in sub functions
• curl: rename struct var to fix AIX build
• curl: use realtime in trace timestamps
• curl_multi_socket_all.md: soften the deprecation warning
• CURLOPT_PREREQFUNCTION.md: add result code on failure
• digest: produce a shorter cnonce in Digest headers
• DISTROS: update Alt Linux links
• dmaketgz: use --no-cache when building docker image
• docs: bring back ALTSVC.md and HSTS.md
• docs: document default User-Agent
• docs: suggest --ssl-reqd instead of --ftp-ssl
• duphandle: also init netrc
• ECH: enable support for the AWS-LC backend
• hostip: don't use the resolver for FQDN localhost
• http_negotiate: allow for a one byte larger channel binding buffer
• http_proxy: move dynhds_add_custom here from http.c
• KNOWN_BUGS: setting a disabled option should return CURLE_NOT_BUILT_IN
• krb5: fix socket/sockindex confusion, MSVC compiler warnings
• lib: fixes for wolfSSL OPENSSL_COEXIST
• libssh: use libssh sftp_aio to upload file
• libssh: when using IPv6 numerical address, add brackets
• macos: disable gcc availability workaround as needed
• mbedtls: call psa_crypt_init() in global init
• mime: fix reader stall on small read lengths
• mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
• mprintf: fix the integer overflow checks
• multi: add clarifying comment for wakeup_write()
• multi: fix callback for CURLMOPT_TIMERFUNCTION not being called again when...
• netrc: address several netrc parser flaws
• netrc: support large file, longer lines, longer tokens
• nghttp2: use custom memory functions
• OpenSSL: improvde error message on expired certificate
• openssl: remove three "Useless Assignments"
• openssl: stop using SSL_CTX_ function prefix for our functions
• os400: Fix IBMi builds
• os400: Fix IBMi EBCDIC conversion of arguments
• pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
• rtsp: check EOS in the RTSP receive and return an error code
• schannel: remove TLS 1.3 ciphersuite-list support
• setopt: fix CURLOPT_HTTP_CONTENT_DECODING
• setopt: fix missing options for builds without HTTP & MQTT
• show-headers.md: clarify the headers are saved with the data
• socket: handle binding to "host!"
• socketpair: fix enabling USE_EVENTFD
• strtok: use namespaced strtok_r macro instead of redefining it
• tests: add the ending time stamp in testcurl.pl
• tests: re-enable 2086, and 472, 1299, 1613 for Windows
• TODO: consider OCSP stapling by default
• tool_formparse: remove use of sscanf()
• tool_getparam: parse --localport without using sscanf
• tool_getpass: fix UWP -Wnull-dereference
• tool_getpass: replace getch() call with _getch() on Windows
• tool_urlglob: parse character globbing range without sscanf
• vtls: fix compile warning when ALPN is not available

Further

The previous release was 8.11.0. The next release was 8.12.0.

curl / Docs / Releases / Changes in 8.11.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.10.1 all changes 8.11.1 🠲

Changes in 8.11.0 - November 6 2024

8.11.0 8.11.0 Changes:

• curl: --create-dirs works for --dump-header as well
• gtls: Add P12 format support
• ipfs: add options to disable
• TLS: TLSv1.3 earlydata support for curl
• WebSockets: make support official (non-experimental) Bugfixes:
• alt-svc: honor data->state.httpwant
• altsvc: avoid using local buffer and memcpy
• asyn-ares: remove typecast, fix expire
• autotools: add support for 'unity' builds, enable in CI
• bearssl: avoid strpcy() when generating TLS version log message
• bearssl: improved session handling, test exceptions
• bufq: unwrite fix
• build: add ldap to libcurl.pc Requires:
• build: add pytest targets
• build: clarify CA embed is for curl tool, mark default, improve summary
• build: detect and use _setmode() with Cygwin/MSYS, also use on Windows
• build: disable warning -Wunreachable-code-break
• build: fix clang-cl builds, add CI job
• build: fix cross-compile check for poll with bionic
• build: fix possible -Wformat-overflow in lib557
• build: limit arc4random detection to no-SSL configs
• build: show if CA bundle to embed was found
• build: tidy up and improve versioned-symbols options
• build: tidy up deprecation suppression, enable warnings for clang
• certs: add missing -CAcreateserial option for LibreSSL
• checksrc: add check for spaces around logical AND operators
• checksrc: Added checks for colon operator in ternary expressions
• checksrc: check for spaces around '?', '>' and '<'
• ci: dump curl_config.h to log in all jobs
• CI: run with standard mod_http2
• cmake, Makefile.mk: use -isystem for headers, silence BearSSL issues
• cmake/FindCares: fix version detection for c-ares 1.34.1
• cmake/FindNGTCP2: use library path as hint for finding crypto module
• cmake: add missed variable to comment
• cmake: add native pkg-config detection for mbedTLS, MSH3, Quiche, Rustls, wolfSSL
• cmake: allow building tests in unity mode
• cmake: apply WIN32_LEAN_AND_MEAN to all feature checks
• cmake: avoid setting BUILD_TESTING
• cmake: clear package version after pkg-config detection
• cmake: delete unused NEED_LBER_H, HAVE_LDAP_H
• cmake: detect HAVE_NETINET_IN6_H, HAVE_CLOSESOCKET_CAMEL, HAVE_PROTO_BSDSOCKET_H
• cmake: detect GNU GSS
• cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
• cmake: do not propagate unused HAVE_GSSAPI_GSSAPI_KRB5_H to C
• cmake: document -D and env build options
• cmake: drop obsolete items from TODO and INSTALL-CMAKE
• cmake: drop redundant assignments
• cmake: drop redundant zlib var, rename function (internals)
• cmake: expand CURL_USE_PKGCONFIG to non-cross MINGW
• cmake: fix broken dependency chain for cmdline-opts, tidy-ups
• cmake: fix compile warnings for clang-cl
• cmake: fix missing spacing in log message
• cmake: limit CURL_STATIC_CRT to MSVC
• cmake: make test-ci target skip building dependencies
• cmake: mark as advanced some internal Find* variables
• cmake: re-add generate-curl.1 dependency for src in any case
• cmake: rename LDAP dependency config variables to match Find modules
• cmake: replace check_include_file_concat() for LDAP and GSS detection
• cmake: replace CURL_*_DIR with {PROJECT,CMAKE_CURRENT}_*_DIR
• cmake: require quictls (or fork) when using msh3 on non-Windows
• cmake: separate target for examples, optimize CI, fix fallouts
• cmake: set version for project() and add CPack support
• cmake: stop adding dependency headers to global CMAKE_REQUIRED_INCLUDES
• cmake: sync torture test parallelism with autotools
• cmake: tidy up CURL_DISABLE_FORM_API initialization
• cmake: tidy up and shorten symbol hiding initialization
• cmake: tidy up line order
• cmake: tidy up picky warning initialization
• cmake: tidy-ups and rebase fixups
• cmake: tweaks around debug mode and hidden symbols
• cmake: untangle feature detection interdependencies
• cmake: use list(APPEND) on CURL_INCLUDES
• cmake: use OpenSSL for LDAP detection only if available
• cmake: use the BSD variable
• config: rename the OS define to CURL_OS to reduce collision risk
• configure: add GSS to libcurl.pc Depends:
• configure: catch Apple in more target triplets
• configure: drop duplicate feature checks for poll(), if_nametoindex()
• configure: drop unused bare socket.h detection
• configure: improve help string for some options
• conncache: find bundle again in case it is removed
• conncache: more efficient implementation of cpool_remove_bundle
• cookie: overhaul and cleanup
• curl-rustls.m4: set linker flags to allow rustls build on macos
• curl.h: remove the struct pointer for CURL/CURLSH/CURLM typedefs
• curl: add build options for safe/no CA bundle search (Windows)
• curl: detect ECH support dynamically, not at build time
• curl_addrinfo: support operating systems with only getaddrinfo(3)
• curl_multi_perform.md: fix typo
• curl_trc: fix build with verbose messages disabled
• curl_url_set.md: document HOST handling when URL is parsed
• curl_ws_recv.md: the 'meta' pointer is only returned on success
• curl_ws_recv: return recv 0 and point meta to NULL on all errors
• CURLMOPT_PIPELINING.md: clarify that CURLPIPE_NOTHING is not default
• CURLOPT_APPEND.md: goes for SFTP as well
• CURLOPT_HEADERFUNCTION.md: do not modify the passed in buffer
• DISABLED: disable test 1060 with hyper
• DISTROS: avoid use of very;
• Dockerfile: update Docker digest to d830561
• docs/cmdline-opts: GnuTLS supports PKCS#11 URI in --cert option
• docs: clarify FTP over HTTP proxy functionality somewhat
• docs: fix a typo in some cipher options
• ech: spelling, whitespace, say --ech default config
• ftp: fix 0-length last write on upload from stdin
• ftp: move listen handling to socket filter
• GHA: optimize test prereq steps
• gnutls: use session cache for QUIC
• hsts: avoid the local buffer and memcpy on lookup
• hsts: improve subdomain handling
• hsts: support "implied LWS" properly around max-age
• http2: auto reset stream on server eos
• http_aws_sigv4: avoid local buffer and strcpy
• INSTALL-CMAKE.md: mention focus on shared libraries
• INSTALL-CMAKE: fix punctuation and a typo
• INSTALL.md: fix a typo that slipped in to RISC OS
• json.md: cli-option --json is an alias of --data-binary
• lib, src, tests: added space around ternary expressions
• lib/cw-out: initialize 'flush_all' directly
• lib/src: white space edits to comply better with code style
• lib: avoid assigning 'result' temporarily
• lib: fix disabled-verbose-strings + enable-debug build warnings
• lib: fix unity builds with BearSSL, MSH3, Quiche, OmniOS
• lib: move curl_path.[ch] into vssh/
• lib: msnprintf tidy-ups
• lib: remove Curl_ prefix from static functions
• lib: remove function pointer typecasts for hmac/sha256/md5
• lib: use bool/TRUE/FALSE properly
• libcurl/opts: improve phrasing for connection cap related options
• libssh.c: handle EGAINS during proto-connect correctly
• libssh2: delete duplicate break
• libssh2: put the readdir buffers into struct
• libssh2: use the Curl_* memory functions to avoid memdebug
• libssh2: use the filename buffer when getting the homedir
• libtests: generate the lib1521 atomically
• mbedTLS: fix handling of TLSv1.3 sessions
• mbedtls: handle session as blobs
• mbedtls: remove failf() use from mbedtls_random
• mk-lib1521: fix the long return code check
• mprintf: do not ignore length modifiers of %o, %x, %X
• mprintf: treat %o as unsigned, add tests for %o, %x, %X
• mqtt: fix mqtt.md wording and add clearer explanation
• multi.c: make stronger check for paused transfer before asserting
• multi.c: warn/assert on stall only without timer
• multi: avoid reading whole struct pointer from pointer
• multi: convert Curl_follow to static multi_follow
• multi: make curl_multi_cleanup invalidate magic latter
• multi: make multi_handle_timeout use the connect timeout
• multi: split multi_runsingle into sub functions
• negotiate: conditional check around GSS & SSL specific code
• netrc: cache the netrc file in memory
• ngtcp2: do not loop on recv
• ngtcp2: set max window size to 10x of initial (128KB)
• openssl quic: populate x509 store before handshake
• openssl: convert a memcpy to dynbuf use
• openssl: extend the OpenSSL error messages
• openssl: improve retries on shutdown
• openssl: remove two strcpy() calls
• OS400: don't delete source files when building with debug
• packages/OS400/curlmain: remove the strncpy calls
• processhelp.pm: improve taskkill calls (Windows)
• pytest: fix run against multissl curl
• pytest: improve pytest_07_42a reliability
• pytest: include buildinfo.txt in the output
• pytest: include curl version string and python platform in log
• pytest: show curl features and protocols
• quic: use send/recvmmsg when available
• quic: use the session cache with wolfSSL as well
• request: on shutdown send, proceed normally on timeout
• runtests.md: suggest a value for -j for torture tests
• runtests: add comment for handle64 pathsep requirement
• runtests: drop unused code for old/classic-mingw support
• runtests: pass single backslashes with Windows Perl
• runtests: use deterministic sort for TESTINFO lines
• schannel: fix TLS cert verification by IP SAN
• schannel: ignore error on recv beyond close notify
• schannel: reclassify extra-verbose schannel_recv messages
• select: use poll() if existing, avoid poll() with no sockets
• sendf: add condition to max-filesize check
• server/mqttd: fix two memory leaks
• setopt: avoid superfluous length checks before strcmp()
• setopt: return error for bad input to CURLOPT_RTSP_REQUEST
• setopt_cptr: make overflow check only done when needed
• singleuse: make git grep faster, add Apple nm support
• smb: do not redefine getpid on Windows
• smb: replace use of strcpy() with snprintf()
• socks_gssapi: switch to dynbuf from buffer with strcpy
• source: avoid use of very in comments
• src/lib: remove redundant ternary operators
• src: guard for double declaration of curl_ca_embed in unity builds
• sws: fix unused static function with TCP_NODELAY undefined
• telnet: avoid two strcpy() by pointing to the strings instead
• test1035: convert hostname back to UTF-8 as should be
• test1515: add tracing and more debug info
• test1540: add debug logging
• test190: replace %FTPTIME2 with a fixed value
• test1915: add tracing and connect timeout
• test1915: remove wrong comment
• test2502: add libtest debug tracing
• test504: fix handling on pending connect
• testrun: explicitly set proper IP address for stunnel listen/connect
• tests/http: fix ubuntu GnuTLS CI failures
• tests/scorecard: allow remote server test
• tests/server/util.c: remove use of strncpy
• tests/valgrind.pm: fix warnings with no valgrind report to show
• tests/valgrind.supp: remove a travis suppression, add a Debian
• tests: add and use %PERL variable to refer to the Perl binary
• tests: add codeset-utf8 as a feature
• tests: add file: tests with existing files
• tests: allow pytests to run in out-of-tree builds
• tests: capture stdin to get the vsftpd version number
• tests: change Python code style to pass ruff checks
• tests: check http/2 and http/3 server responsiveness
• tests: delete duplicate macro check
• tests: enable additional ruff Python lint options
• tests: fix %POSIX_PWD on native Windows Perl
• tests: fix callback signatures to please UndefinedBehaviorSanitizer
• tests: Fix FILEFORMAT <filename=""> directive
• tests: fix keyword for test1411
• tests: fix shell quoting on native Windows Perl
• tests: fix some Python typing issues
• tests: fixup checkcmd PATH on non-unixy platforms
• tests: improve mqtt server handling
• tests: introduce %CLIENT6IP-NB
• tests: let openssl generate random cert serials
• tests: libtests and unit tests need explicit #include memdebug …

curl / Docs / Releases / Changes in 8.10.1 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.10.0 all changes 8.11.0 🠲

Changes in 8.10.1 - September 18 2024

8.10.1 8.10.1 Bugfixes:

• autotools: fix --with-ca-embed build rule
• cmake: ensure CURL_USE_OPENSSL/USE_OPENSSL_QUIC are set in sync
• cmake: fix MSH3 to appear on the feature list
• connect: store connection info when really done
• CURLMOPT_TIMERFUNCTION.md: emphasize that only a single timer should run
• FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
• http2: when uploading data from stdin, fix eos forwarding
• http: make max-filesize check not count ignored bodies
• lib: fix AF_INET6 use outside of USE_IPV6
• libcurl-docs: CURLINFO_LOCAL_* work for QUIC as well as TCP
• multi: check that the multi handle is valid in curl_multi_assign
• QUIC: on connect, keep on trying on draining server
• request: correctly reset the eos_sent flag
• runtests: accept 'quictls' as OpenSSL compatible
• rustls: fixed minor logic bug in default cipher selection
• rustls: rustls-ffi 0.14.0 update
• rustls: support strong CSRNG data
• setopt: remove superfluous use of ternary expressions
• singleuse: drop Curl_memrchr() for no-HTTP builds
• test537: cap the rlimit max this test runs
• tests: tweak lock file handling and timers
• tool_cb_wrt: use "curl_response" if no filename in URL
• transfer: fix sendrecv() without interim poll
• vtls: fix Curl_ssl_conn_config_match doc param

Further

The previous release was 8.10.0. The next release was 8.11.0.