# curl changelog

> The command-line tool and library for transferring data with URLs.

- Vendor: curl
- Category: Developer Tools
- Platforms: Desktop
- Official site: https://curl.se
- Tracked by: What's New (https://whatsnew.fyi/product/curl)
- Harvested from: Release index (curl)
- Entries below: 15 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 8.21.0

- Date: 2026-06-24
- Version: 8.21.0
- Original notes: https://curl.se/ch/8.21.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.21.0
- Labels: Platforms: Desktop

- **added** — curl: named globs in output filename for upload glob references
- **added** — HTTP/3: add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC)
- **added** — libssh: add support for SHA256 host public keys
- **changed** — http2: remove stream dependency tracking
- **removed** — lib: drop support for CURLAUTH_DIGEST_IE
- **fixed** — cfilters: fix busy loop on blocked transfers
- **fixed** — chunked: reject invalid bytes in trailer
- **fixed** — cf-socket: set scope_id for IPv6 link-local addresses
- **fixed** — cookie: check __Secure- and __Host- case sensitively when read from file
- **fixed** — cookie: compare path case sensitively
- **fixed** — cookie: reject control octets in file-loaded cookies
- **fixed** — curl_ntlm_core: fix nettle 4+ builds in certain MultiSSL combos
- **fixed** — digest: flush proxy state on proxy or credential change
- **fixed** — doh: cap the maximum TTL to 24 hours
- **fixed** — event: fix wakeup consumption
- **fixed** — ftp: avoid accessing EPSV response one byte past the NULL
- **fixed** — gsasl: fix potential double free
- **fixed** — http-proxy: verify CONNECT response headers
- **fixed** — http: reject spurious CR bytes in headers
- **fixed** — AmigaOS: fix build fallouts, re-add to CI

curl / Docs / Releases / Changes in 8.21.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.20.0 all changes pending release
#### Changes in 8.21.0 - June 24 2026
8.21.0
8.21.0
Changes:
- curl: named globs in output filename for upload glob references
- HTTP/3: add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC)
- http2: remove stream dependency tracking
- lib: drop support for CURLAUTH_DIGEST_IE
- libssh: add support for SHA256 host public keys
- tool_urlglob: add named globs
Bugfixes:
- _ENVIRONMENT.md. Windows does case insensitive env variables
- _URL.md: remove the zone-id mention
- AmigaOS: curl_setup.h avoid explicit_bzero with clib2
- AmigaOS: fix build fallouts, re-add to CI
- asyn-thrdd: add IPv6 guards
- asyn-thrdd: fix result processing without wakeup socketpair
- autotools: mbedtls detection fixes
- BINDINGS: Update Hollywood link
- BUFQ.md: re-sync with source code
- build: enable `-Wlogical-op` picky warning for GCC 4.4+
- build: omit zlib pkg-config reference for Android
- cf-h2-prox: fix peer leak
- cf-h2-proxy: drop interim responses
- cf-https-connect: do not engage on proxy origin
- cf-ip-happy.c: minor comment typo
- cf-ip-happy: update documentation
- cf-socket: make Curl_addr2string static
- cf-socket: set scope_id for IPv6 link-local addresses
- cf-socket: store errno from do_connect in ctx->error
- cfilters: fix busy loop on blocked transfers
- chunked: reject invalid bytes in trailer
- CIPHERS.md: fix the example that uses only TLS 1.3
- cmake/FindGSS: drop "MIT Unknown" version value, related tidy ups
- cmake/FindGSS: drop CMake <3.16 compatibility logic
- cmake/FindGSS: fix comment, adjust custom flavor property name
- cmake/FindGSS: prioritize MIT over GNU in pkg-config detection
- cmake: auto-select static nghttp2/nghttp3/ngtcp2 Config
- cmake: export/forward `NGTCP2_CRYPTO_BACKEND`
- cmake: fix three issues generating lib options in config files
- cmake: fix zstd CMake config name
- cmake: opt in `MSVC_VERSION` 1951 to picky warnings
- cmake: quote `COMPONENTS` string in `curl-config.in.cmake`
- cmake: simplify `LINK_ONLY` imported target extraction
- config2setopts: use default protocol properly
- connect: remove deref of freed pointer in trace call
- content_encoding: fix limit failure message
- content_encoding: fix non-last chunked rejection
- content_encoding: timeout during slow decoding
- cookie: check __Secure- and __Host- case sensitively when read from file
- cookie: compare path case sensitively
- cookie: reject control octets in file-loaded cookies
- cookie: simplify strstore(), remove outdated comment
- cookie: tailmatch the domains for secure override
- cookie: trim trailing dots when checking PSL
- creds: add sasl service name
- creds: create with empty user+pass
- creds: mask OAuth bearer token in trace logs
- creds: remove two unused functions
- curl_easy_pause.md: rephrase the stream cache when pause clause
- curl_easy_setopt.md: change options when no transfer runs
- curl_formdata: fix to pass long where missing, document `CURLFORM_NAMELENGTH`
- curl_multi_assign.md: clarify lifetime
- curl_ntlm_core: fix nettle 4+ builds in certain MultiSSL combos
- curl_ntlm_core: propagate DES `CryptEncrypt()` error
- curl_sha512_256: fix result code on error
- CURLINFO_CONTENT_LENGTH_UPLOAD_T.md: expand
- CURLMOPT_SOCKETFUNCTION.md: this sends *all* file descriptors
- CURLOPT_CHUNK_BGN_FUNCTION: target is there for symlinks only
- CURLOPT_DISALLOW_USERNAME_IN_URL: is for CURLOPT_URL only
- CURLOPT_DOH_URL.md: does not inherit proxy options
- CURLOPT_ECH.md: simplify the description language
- CURLOPT_HAPROXYPROTOCOL.md: only sent for newly setup connections
- CURLOPT_MAXFILESIZE: clarify this also works for on-going transfers
- CURLOPT_PINNEDPUBLICKEY.md: does not apply for other origins
- CURLOPT_PORT.md: use stronger language
- CURLOPT_SHARE: warn about early remove
- CURLOPT_SSH_HOSTKEYFUNCTION.md: for new connections only
- CURLOPT_WRITEFUNCTION.md: menti

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.21.0.html]_

### 8.20.0

- Date: 2026-04-29
- Version: 8.20.0
- Original notes: https://curl.se/ch/8.20.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.20.0
- Labels: Platforms: Desktop

- **added** — Add thread pool and queue to lib
- **added** — Add CURLMNWC_CLEAR_ALL to multi.h
- **added** — Add HTTPS-RR use in HTTP/3
- **changed** — Use thread queue for resolving in async-thrdd
- **changed** — Make NTLM disabled by default
- **changed** — Drop support for CMake 3.17 and older
- **changed** — Drop support for c-ares versions before 1.16.0
- **changed** — Make SMB support opt-in
- **changed** — Extend and update curl_ngtcp2 callbacks for 1.22.0+
- **changed** — Use wolfCrypt DES API with wolfSSL in curl_ntlm_core
- **changed** — Support delegating SHA-512/256 to wolfSSL API
- **fixed** — Cap altsvc list at 5,000 entries
- **fixed** — Skip expired entries read from altsvc file
- **fixed** — Fix HTTPS-lookup in asyn-ares when not on port 443
- **fixed** — Fix query counter handling in async-ares
- **fixed** — Fix cookie rejection when tabs in value
- **fixed** — Fix potential infinite loop in curl_get_line when filename is a directory
- **fixed** — Fix memory-leak when doing a second DoH resolve
- **fixed** — Repair CURLINFO_TLS_SESSION in getinfo
- **removed** — Drop RTMP support
- **removed** — Drop the prio field from the altsvc struct

curl / Docs / Releases / Changes in 8.20.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.19.0 all changes 8.21.0 🠲
#### Changes in 8.20.0 - April 29 2026
8.20.0
8.20.0
Changes:
- async-thrdd: use thread queue for resolving
- build: make NTLM disabled by default
- cmake: drop support for CMake 3.17 and older
- lib: add thread pool and queue
- lib: drop support for < c-ares 1.16.0
- lib: make SMB support opt-in
- multi.h: add CURLMNWC_CLEAR_ALL
- rtmp: drop support
Bugfixes:
- altsvc: cap the list at 5,000 entries
- altsvc: drop the prio field from the struct
- altsvc: skip expired entries read from file
- asyn-ares: connect async
- asyn-ares: drop orphaned variable references
- asyn-ares: fix HTTPS-lookup when not on port 443
- asyn-thrdd: drop redundant `result` check
- asyn-thrdd: fix clang-tidy unused value warning
- async-ares: fix query counter handling
- autotools: limit checksrc target to ignore non-repo test sources
- badwords-all: exit with correct code on errors
- badwords: combine the whitelisting into a single regex
- badwords: detect 'the the' and 'with with'
- badwords: only check comments and strings in source code
- badwords: rework exceptions, fix many of them
- boringssl: fix more coexist cases with Schannel/WinCrypt
- build: adjust/add casts to fix `-Wformat-signedness`
- build: assume `snprintf()` in `mprintf`, drop feature check
- build: compiler warning silencing tidy-ups
- build: drop `openssl` module dependency for BoringSSL from `libcurl.pc`
- build: drop duplicate `pthread.h` includes
- build: drop redundant `USE_QUICHE` guards
- build: enable `-Wimplicit-int-enum-cast` compiler warning, fix issues
- build: fix `-Wformat-signedness` by adjusting printf masks
- build: link `bcrypt.lib` via vcxproj files
- build: skip detecting `pipe2()` for Apple targets
- cf-https-connect: silence `-Wimplicit-int-enum-cast` with HTTPS-RR
- cf-https-connect: silence `-Wimplicit-int-enum-cast` with HTTPS-RR
- cf-ip-happy: limit concurrent attempts
- cf-socket: avoid low risk integer overflow on ancient Solaris
- cfilters: fix Curl_pollset_poll() return code mixup
- clang-tidy: avoid assignments in `if` expressions
- clang-tidy: enable more checks, fix fallouts
- cmake: add CMake Config-based dependency detection
- cmake: add CMake Config-based dependency detection for c-ares, wolfSSL
- cmake: document functions used from Windows system DLLs
- cmake: enable pthreads for BoringSSL/AWS-LC
- cmake: resolve targets recursively when generating `libcurl.pc`
- cmake: rework binutils ld hack to not read `LOCATION` property
- cmake: silence bad library `Threads::Threads` warning
- cmake: use `AIX` built-in variable (with CMake 4.0+)
- config2setopts: make --capath work in proxy disabled builds
- configure: fix `--with-ngtcp2=<path>` option for crypto libs
- configure: fix LibreSSL ngtcp2 1.15.0+ crypto lib selection logic
- configure: prefer dependency-specific variables over `$withval`
- configure: remove superfluous experimental warning for HTTP/3
- configure: silence useless clang warnings in C89 builds
- configure: tidy up comments
- connect: fix typo on error message
- cookie: fix rejection when tabs in value
- curl-wolfssl.m4: fix to use the correct value for pkg-config directory
- curl.h: replace macros with C++-friendly method to enforce 3 args
- curl_ctype.h: fix spelling in a couple of locally used macros
- curl_get_line: error out on read errors
- curl_get_line: fix potential infinite loop when filename is a directory
- curl_ngtcp2: extend and update callbacks for 1.22.0+
- curl_ntlm_core: drop redundant PP condition
- curl_ntlm_core: use wolfCrypt DES API with wolfSSL
- curl_setup.h: drop stray/unused `USE_OPENSSL_QUIC` guard
- curl_sha512_256: support delegating to wolfSSL API
- curl_version_info.md: clarify age details
- CURLOPT_HAPROXY_CLIENT_IP.md: mention assumption on data format
- CURLOPT_RTSP_SESSION_ID.md: clarify reuse "dangers"
- CURLOPT_RTSP_SESSION_ID.md: expand the comment
- CURLO

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.20.0.html]_

### 8.19.0

- Date: 2026-03-11
- Version: 8.19.0
- Original notes: https://curl.se/ch/8.19.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.19.0
- Labels: Platforms: Desktop

- **added** — Add CURL_BUILD_EVERYTHING cmake option
- **added** — Add initial support for MQTTS
- **added** — Add build option to use the native CA store on Windows
- **added** — Support fractions for --limit-rate and --max-filesize
- **changed** — With -J, use the redirect name as a backup in tool_cb_hdr
- **changed** — Bump minimum Windows version to Vista from XP
- **changed** — Drop support for OpenSSL-QUIC in vquic
- **changed** — Return 'identity' if no other content encoding exists
- **fixed** — Only accept 17 byte dates from altsvc files
- **fixed** — Abort with OOM error when Curl_dnscache_mk_entry fails in asyn-ares
- **fixed** — Improve blocking resolve timeout handling in async-ares
- **fixed** — Fix memory leak in digest auth_create_digest_http_message
- **fixed** — Escape double quotes and backslashes in digest realm and nonce
- **fixed** — Handle quotes in the digest path
- **removed** — Stop the bug-bounty program end of Jan 2026

curl / Docs / Releases / Changes in 8.19.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.18.0 all changes 8.20.0 🠲
#### Changes in 8.19.0 - March 11 2026
8.19.0
8.19.0
Changes:
- BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026
- cmake: add `CURL_BUILD_EVERYTHING` option
- mqtt: initial support for MQTTS
- tool: support fractions for --limit-rate and --max-filesize
- tool_cb_hdr: with -J, use the redirect name as a backup
- vquic: drop support for OpenSSL-QUIC
- windows: add build option to use the native CA store
- windows: bump minimum to Vista (from XP)
Bugfixes:
- altsvc: only accept 17 byte dates from files
- asyn-ares: abort with OOM error when Curl_dnscache_mk_entry fails
- async-ares: blocking resolve timeout handling, better
- badwords: move into ./scripts, speed up
- build: add missing `GENERATEDCERTS` files
- build: adjust minimum version for some clang picky warnings
- build: check `MSG_NOSIGNAL` directly, drop detection and interim macro
- build: constify `memchr()`/`strchr()`/etc result variables (cont.)
- build: detect and include `inttypes.h` again
- build: do not include wolfSSL header in `curl_setup.h`
- build: drop duplicate C includes
- build: drop global suppression of `-Wformat-nonliteral`, fix fallouts
- build: drop unused `snprintf()` feature check on Windows
- build: fix `-Wunused-macros` warnings, and related tidy-ups
- build: fix building rare combinations
- build: fully omit verbose strings and code when disabled
- build: globally suppress DJGPP warnings in `FD_SET()`
- build: merge TrackMemory (`CURLDEBUG`) into debug-enabled option
- build: move curl stat struct type to the curlx namespace
- build: opt-in MSVC to C99-style verbose logging logic
- build: require POSIX `strdup()`
- build: tidy up and dedupe `strdup` functions
- cf-socket: ignore SOCK_CLOEXEC etc for socktype equality checks
- cf-socket: use SOCK_CLOEXEC in socket_open when available
- checksrc-all.pl: skip non-repository files
- checksrc: do not apply `BANNEDFUNC` to struct member functions
- checksrc: warn for leading spaces before the preprocessor hash
- clang-tidy: add missing and delete redundant parentheses
- clang-tidy: add more missing parentheses in macro values
- clang-tidy: avoid/silence `bugprone-not-null-terminated-result`
- clang-tidy: check `bugprone-macro-parentheses`, fix fallouts
- clang-tidy: drop redundant conditions reported by `misc-redundant-expression`
- clang-tidy: enable `bugprone-signed-char-misuse`, fix fallouts
- clang-tidy: enable more checks
- clang-tidy: enable scanning headers
- clang-tidy: fix issues found with build-fuzzing
- clang-tidy: silence more minor issues found by v22
- cmake/FindMbedTLS: add workaround for missing static MSVC `mbedcrypto.lib` 4.0.0
- cmake: add `CURL_DROP_UNUSED` option to reduce binary sizes
- cmake: add native clang-tidy support for tests, with concatenated sources
- cmake: always build curlu and curltool test libs in unity mode
- cmake: always define `CURL::win32_winsock` on Windows in `curl-config.cmake`
- cmake: convert `curl_add_clang_tidy_test_target()` macro to function
- cmake: enable binutils ld workaround for all toolchains at build-time
- cmake: fix `LOCATION` property access condition (debug)
- cmake: fix `LOCATION` property read errors in target debug function
- cmake: fix building with `CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON`
- cmake: fix confusing error when a dependency is undetected in `curl-config.cmake`
- cmake: fix logic for openssl/zlib binutils ld workaround
- cmake: fix passing system header directories to clang-tidy for tests
- cmake: fix system include directory position for clang-tidy in tests
- cmake: improve clang-tidy test command-line reproduction
- cmake: minor fixes to test targets after prev
- cmake: normalize uppercase hex winver (for display)
- cmake: omit `curl.rc` from curltool lib
- cmake: reference OpenSSL and ZLIB imported targets only when enabled
- cmake: replace internal option with a new `tt` (test tool

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.19.0.html]_

### 8.18.0

- Date: 2026-01-07
- Version: 8.18.0
- Original notes: https://curl.se/ch/8.18.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.18.0
- Labels: Platforms: Desktop

- **removed** — drop support for VS2008 (Windows)
- **removed** — drop Windows CE / CeGCC support
- **removed** — drop support for GnuTLS < 3.6.5
- **added** — implement CURLOPT_CAINFO_BLOB in GnuTLS
- **changed** — bump minimum OpenSSL version to 3.0.0
- **fixed** — fix ancient evaluation in apple sectrust
- **fixed** — handle Curl_dnscache_mk_entry() OOM error in asyn-ares
- **fixed** — fix Curl_async_getaddrinfo() on systems without getaddrinfo
- **fixed** — fix progress meter in parallel mode
- **fixed** — avoid strcpy in content_encoding
- **fixed** — return proper error on OOM in cookie handling
- **fixed** — refuse headers with CR, LF or null bytes in curl_quiche
- **fixed** — make Curl_sasl_decode_mech compare case insensitively
- **changed** — support folded headers in CONNECT responses in cf-h1-proxy
- **fixed** — fix DES_* symbols for some wolfSSL builds in curl_ntlm_core
- **fixed** — enable Win10 TCP_KEEP* options with old SDKs in cf-socket
- **fixed** — limit use of TCP_KEEP* to Windows 10.0.16299+ at runtime in cf-socket
- **changed** — increase minimum stack size for tool_main in AmigaOS
- **fixed** — fix LargeFile feature display on Windows in autotools
- **changed** — add nettle library detection via pkg-config for GnuTLS in autotools

curl / Docs / Releases / Changes in 8.18.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.17.0 all changes 8.19.0 🠲
#### Changes in 8.18.0 - January 7 2026
8.18.0
8.18.0
Changes:
- build: drop support for VS2008 (Windows)
- build: drop Windows CE / CeGCC support
- gnutls: drop support for GnuTLS < 3.6.5
- gnutls: implement CURLOPT_CAINFO_BLOB
- openssl: bump minimum OpenSSL version to 3.0.0
Bugfixes:
- _PROGRESS.md: add the E unit, mention kibibyte
- alt-svc: more flexibility on same destination
- altsvc: accept ma/persist per alternative entry
- altsvc: make it one malloc instead of three per entry
- AmigaOS: increase minimum stack size for tool_main
- apple sectrust: fix ancient evaluation
- apple-sectrust: always ask when `native_ca_store` is in use
- asyn-ares: handle Curl_dnscache_mk_entry() OOM error
- asyn-ares: remove hostname free on OOM
- asyn-thrdd: fix Curl_async_getaddrinfo() on systems without getaddrinfo
- asyn-thrdd: release rrname if ares_init_options fails
- auth: always treat Curl_auth_ntlm_get() returning NULL as OOM
- autotools: add nettle library detection via pkg-config (for GnuTLS)
- autotools: drop autoconf <2.59 compatibility code (zz60-xc-ovr)
- autotools: fix LargeFile feature display on Windows (after prev patch)
- autotools: tidy-up `if` expressions
- badwords: add mistyped 'first', fix fallouts
- badwords: catch and fix threading-related words
- badwords: fix issues found in scripts and other files
- badwords: fix issues found in tests
- build: add build-level `CURL_DISABLE_TYPECHECK` options
- build: exclude clang prereleases from compiler warning options
- build: replace `-pedantic` with `-Wpedantic` when supported
- build: set `-Wno-format-signedness`
- build: tidy-up MSVC CRT warning suppression macros
- ccsidcurl: make curl_mime_data_ccsid() use the converted size
- cf-h1-proxy: support folded headers in CONNECT responses
- cf-https-connect: allocate ctx at first in cf_hc_create()
- cf-socket: drop feature check for `IPV6_V6ONLY` on Windows
- cf-socket: enable Win10 `TCP_KEEP*` options with old SDKs
- cf-socket: limit use of `TCP_KEEP*` to Windows 10.0.16299+ at runtime
- cf-socket: return OOM error if socket() fails due to OOM
- cf-socket: trace ignored errors
- cfilters: make conn_forget_socket a private libssh function
- checksrc.pl: detect assign followed by more than one space
- cmake: adjust defaults for target platforms not supporting shared libs
- cmake: define dependencies as `IMPORTED` interface targets
- cmake: delete unused file `CMake/CMakeConfigurableFile.in`
- cmake: disable `CURL_CA_PATH` auto-detection if `USE_APPLE_SECTRUST=ON`
- cmake: fix `ws2_32` reference in `curl-config.cmake`
- cmake: honor `CURL_DISABLE_INSTALL` and `CURL_ENABLE_EXPORT_TARGET`
- cmake: replace deprecated `OPENSSL_FOUND` with `OpenSSL_FOUND`
- cmake: replace deprecated `PERL_FOUND` with `Perl_FOUND`
- cmake: save and restore `CMAKE_MODULE_PATH` in `curl-config.cmake`
- cmake: set found status to OFF when not found (for compression deps)
- code: minor indent fixes before closing braces
- CODE_STYLE.md: sync banned function list with checksrc.pl
- compressed.md: might generate a huge amount of bytes
- config-win32.h: delete obsolete, non-Windows comments
- config-win32.h: drop unused/obsolete `CURL_HAS_OPENLDAP_LDAPSDK`
- config2setopts: add space in cookie header with multiple -b
- config2setopts: bail out if curl_url_get() returns OOM
- config2setopts: exit if curl_url_set() fails on OOM
- configure: delete unused variable
- conncache: silence `-Wnull-dereference` on gcc 14 RISC-V 64
- conncontrol: reuse handling
- connect: reshuffle Curl_timeleft_ms to avoid 'redundant condition'
- connection: attached transfer count
- content_encoding: avoid strcpy
- cookie. return proper error on OOM
- cookie: allocate the main struct once cookie is fine
- cookie: flush better
- cookie: only keep and use the canonical cleaned up path
- cookie: propagate errors better, cleanup the internal AP

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.18.0.html]_

### 8.17.0

- Date: 2025-11-05
- Version: 8.17.0
- Original notes: https://curl.se/ch/8.17.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.17.0
- Labels: Platforms: Desktop

- **removed** — Drop Heimdal support
- **removed** — Drop the winbuild build system
- **removed** — Drop support for Kerberos FTP
- **changed** — Increase libssh2 minimum requirement to 1.9.0
- **added** — Add notifications API to multi interface
- **changed** — Expand progress display to use 6 characters per size
- **added** — Support Apple SecTrust configurations for SSL
- **added** — Add --knownhosts option
- **removed** — Drop support for wolfSSH
- **added** — Make %header{} able to output all occurrences of a header in write-out
- **fixed** — Fix leak in ares tracing
- **fixed** — Use the duped hostname pointer for all calls in asyn-ares
- **fixed** — Clear timeout when done in asyn-thrdd resolver
- **fixed** — When resolving failed, persist error in c-ares
- **fixed** — Accept zero length argument to base64_encode
- **fixed** — Re-enable large read-ahead with aws-lc v1.61.0
- **fixed** — Set FD_CLOEXEC on all sockets opened in cf-socket
- **fixed** — Fix hostname move on connection reuse
- **fixed** — Prevent integer overflow in maxconnects calculation
- **fixed** — Make default CURLOPT_MAXLIFETIME_CONN 24 hours

curl / Docs / Releases / Changes in 8.17.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.16.0 all changes 8.18.0 🠲
#### Changes in 8.17.0 - November 5 2025
8.17.0
8.17.0
Changes:
- build: drop Heimdal support
- build: drop the winbuild build system
- krb5: drop support for Kerberos FTP
- libssh2: up the minimum requirement to 1.9.0
- multi: add notifications API
- progress: expand to use 6 characters per size
- ssl: support Apple SecTrust configurations
- tool_getparam: add --knownhosts
- vssh: drop support for wolfSSH
- wcurl: import v2025.11.04
- write-out: make %header{} able to output *all* occurrences of a header
Bugfixes:
- ares: fix leak in tracing
- asyn-ares: remove wrong comment about the callback argument
- asyn-ares: use the duped hostname pointer for all calls
- asyn-thrdd resolver: clear timeout when done
- asyn-thrdd: drop pthread_cancel
- autotools: add support for libgsasl auto-detection via pkg-config
- autotools: capitalize Rustls in the log output
- autotools: drop detection of ancient OpenSSL libs RSAglue and rsaref
- autotools: fix duplicate UNIX and BSD flags in buildinfo.txt
- autotools: fix silly mistake in clang detection for buildinfo.txt
- autotools: make --enable-code-coverage support llvm/clang
- autotools: merge `if`s in GnuTLS/OpenSSL feature detection
- aws-lc: re-enable large read-ahead with v1.61.0 again
- base64: accept zero length argument to base64_encode
- build: address some -Weverything warnings, update picky warnings
- build: avoid overriding system open and stat symbols
- build: avoid overriding system symbols for fopen functions
- build: avoid overriding system symbols for socket functions
- build: show llvm/clang in platform flags and buildinfo.txt
- c-ares: when resolving failed, persist error
- cf-h2-proxy: break loop on edge case
- cf-ip-happy: mention unix domain path, not port number
- cf-socket: always check Curl_cf_socket_peek() return code
- cf-socket: check params and remove accept procondition
- cf-socket: make set_local_ip void, and remove failf()
- cf-socket: set FD_CLOEXEC on all sockets opened
- cf-socket: tweak a memcpy() to read better
- cf-socket: use the right byte order for ports in bindlocal
- cfilter: unlink and discard
- cfilters: check return code from Curl_pollset_set_out_only()
- checksrc: allow disabling warnings on FIXME/TODO comments
- checksrc: catch banned functions when preceded by (
- checksrc: fix possible endless loop when detecting BANNEDFUNC
- checksrc: fix possible endless loops in the banned function logic
- checksrc: fix to handle ) predecing a banned function
- checksrc: reduce directory-specific exceptions
- CI.md: refresh
- cmake/FindGSS: dedupe pkg-config module strings
- cmake/FindGSS: drop wrong header check for GNU GSS
- cmake/FindGSS: fix pkg-config fallback logic for CMake <3.16
- cmake/FindGSS: simplify/de-dupe lib setup
- cmake/FindGSS: whitespace/formatting
- cmake: add and use local FindGnuTLS module
- cmake: add CURL_CODE_COVERAGE option
- cmake: build the "all" examples source list dynamically
- cmake: clang detection tidy-ups
- cmake: drop exclamation in comment looking like a name
- cmake: fix `HAVE_GNUTLS_SRP` detection after adding local FindGnuTLS module
- cmake: fix building docs when the base directory contains .3
- cmake: fix Linux pre-fill `HAVE_POSIX_STRERROR_R` (when `_CURL_PREFILL=ON`)
- cmake: fix Linux pre-fills for non-glibc (when `_CURL_PREFILL=ON`)
- cmake: minor Heimdal flavour detection fix
- cmake: pre-fill three more type sizes on Windows
- cmake: say 'absolute path' in option descriptions and docs
- cmake: support building some complicated examples, build them in CI
- cmake: use modern alternatives for get_filename_component()
- cmake: use more COMPILER_OPTIONS, LINK_OPTIONS / LINK_FLAGS
- cmdline-docs: extended, clarified, refreshed
- cmdline-opts/_PROGRESS.md: explain the suffixes
- configure: add "-mt" for pthread support on HP-UX
- conn: fix hostname move on connection reuse
- co

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.17.0.html]_

### 8.16.0

- Date: 2025-09-10
- Version: 8.16.0
- Original notes: https://curl.se/ch/8.16.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.16.0
- Labels: Platforms: Desktop

- **changed** — Bump minimum required mingw-w64 to v3.0 from v1.0
- **added** — Add --follow option
- **added** — Add --out-null option
- **added** — Add --parallel-max-host to limit concurrent connections per host
- **changed** — Make --retry-delay and --retry-max-time accept decimal seconds
- **added** — Cache negative name resolves
- **changed** — Keep IP happy eyeballing attempts running
- **changed** — Bump mbedtls minimum version required to 3.2.0
- **added** — Add curl_multi_get_offt
- **added** — Add CURLMOPT_NETWORK_CHANGED to signal network changed
- **changed** — Use the NETRC environment variable if set
- **added** — Allow suffix behind a mail address for RFC 3461 in SMTP
- **changed** — Make default TLS version be minimum 1.2
- **added** — Add support for --longopt=value syntax
- **removed** — Drop msh3 from vquic
- **added** — Support CURLOPT_READFUNCTION in websocket
- **added** — Add %time{} to writeout
- **fixed** — Fix segfault in tool_read_cb
- **fixed** — Remove expired cookies before listing
- **fixed** — Fix --disable-verbose build

curl / Docs / Releases / Changes in 8.16.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.15.0 all changes 8.17.0 🠲
#### Changes in 8.16.0 - September 10 2025
8.16.0
8.16.0
Changes:
- build: bump minimum required mingw-w64 to v3.0 (from v1.0)
- curl: add --follow
- curl: add --out-null
- curl: add --parallel-max-host to limit concurrent connections per host
- curl: make --retry-delay and --retry-max-time accept decimal seconds
- hostip: cache negative name resolves
- ip happy eyeballing: keep attempts running
- mbedtls: bump minimum version required to 3.2.0
- multi: add curl_multi_get_offt
- multi: add CURLMOPT_NETWORK_CHANGED to signal network changed
- netrc: use the NETRC environment variable (first) if set
- smtp: allow suffix behind a mail address for RFC 3461
- tls: make default TLS version be minimum 1.2
- tool_getparam: add support for `--longopt=value`
- vquic: drop msh3
- websocket: support CURLOPT_READFUNCTION
- writeout: add %time{}
Bugfixes:
- _PROTOCOLS.md: mention file:// is only for absolute paths
- acinclude: --with-ca-fallback only works with OpenSSL
- alpn: query filter
- ares: destroy channel on shutdown
- ares: use `ares_strerror()` to retrieve error messages
- asyn-thrdd: fix --disable-socketpair builds
- asyn-thrdd: fix Curl_async_pollset without socketpair
- asyn-thrdd: fix no `HAVE_GETADDRINFO` builds
- asyn-thrdd: manage DEFERRED and locks better
- autotools: make curl-config executable
- aws-lc: do not use large buffer
- BINDINGS.md: add LibQurl
- bufq: add integer overflow checks before chunk allocations
- bufq: removed "Useless Assignment"
- bufq: simplify condition
- build: allow libtests/clients to use libcurl dependencies directly
- build: disable `TCP_NODELAY` for emscripten
- build: enable _GNU_SOURCE on GNU/Hurd
- build: extend GNU C guards to clang where applicable, fix fallouts
- build: fix build errors/warnings in rare configurations
- build: fix disable-verbose
- build: fix mingw-w64 version guard for mingw32ce
- build: if no perl, fix to use the pre-built hugehelp, if present
- build: link to Apple frameworks required by static wolfSSL
- build: support LibreSSL native crypto lib with ngtcp2 1.15.0+
- build: tidy up compiler definition for tests
- cf-https-connect: delete unused declaration
- clang-tidy: disable `clang-analyzer-security.ArrayBound`
- cmake: `CURL_CA_FALLBACK` only works with OpenSSL
- cmake: capitalize 'Rustls' in the config summary
- cmake: defer building `unitprotos.h` till a test target needs it
- cmake: define `WIN32_LEAN_AND_MEAN` for examples
- cmake: drop redundant unity mode for `curlinfo`
- cmake: enable `-Wall` for MSVC 1944
- cmake: fix `ENABLE_UNIX_SOCKETS=OFF` with pre-fill enabled on unix
- cmake: fix setting LTO properties on the wrong targets
- cmake: fix to disable Schannel and SSPI for non-Windows targets
- cmake: fix to restrict `SystemConfiguration` to macOS
- cmake: honor `CMAKE_C_FLAGS` in test 1119 and 1167
- cmake: improve error message for invalid HTTP/3 MultiSSL configs
- cmake: keep websockets disabled if HTTP is disabled
- cmake: make `runtests` targets build the curl tool
- cmake: make the ExternalProject test work
- cmake: omit linking duplicate/unnecessary libs to tests & examples
- cmake: re-add simple test target, and name it `tests`
- cmake: set `CURL_DIRSUFFIX` automatically in multi-config builds
- CODE_STYLE: sync with recent `checksrc.pl` updates
- config-win32.h: do not use winsock2 `inet_ntop()`/`inet_pton()`
- configure: if no perl, disable unity and shell completion, related tidy ups
- configure: tidy up internal names in ngtcp2 ossl detection logic
- connectdata: remove primary+secondary ip_quadruple
- connection: terminate after goaway
- contrithanks: fix for BSD `sed` tool
- cookie: don't treat the leading slash as trailing
- cookie: remove expired cookies before listing
- curl-config: remove X prefix use
- curl/system.h: fix for GCC 3.3.x and older
- curl: make the URL indexes 64-bit
- curl: tool_read_

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.16.0.html]_

### 8.15.0

- Date: 2025-07-16
- Version: 8.15.0
- Original notes: https://curl.se/ch/8.15.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.15.0
- Labels: Platforms: Desktop

- **removed** — Remove support for Secure Transport and BearSSL TLS backends
- **fixed** — Accept 'clear' in altsvc without semicolon
- **fixed** — Free the previous name before strdup'ing the new in asyn-thrdd
- **fixed** — Detect and link brotlicommon library for brotli in autotools
- **changed** — Change bufq read/write signatures
- **removed** — Remove the unused Curl_bufq_unwrite function
- **changed** — Assume sys/socket.h and sys/time.h on non-Windows
- **changed** — Make CURL_IPRESOLVE_* symbols defined as longs
- **changed** — Make CURLSSLOPT_* symbols defined as longs
- **removed** — Remove the RESERVED error codes from curl.h
- **changed** — Implement non-blocking STDIN read on Windows
- **fixed** — Make sure lines end with newline in curl_get_line
- **fixed** — Make SFTP handle a path like /~ properly
- **added** — Provide the 'digest' feature in curlinfo
- **fixed** — Fix build with disabled digest auth
- **fixed** — Fix prequotes for a directory in URL in ftp
- **fixed** — Fix file handle leaks in h2_serverpush reported by clang-tidy
- **fixed** — Fix query of concurrent streams in h3
- **fixed** — Report handshake with version and cipher as for TCP connections in http/3
- **fixed** — Do not delay RST send on aborted transfer in http2
- **fixed** — Protect against null deref in http_ntlm

curl / Docs / Releases / Changes in 8.15.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.14.1 all changes 8.16.0 🠲
#### Changes in 8.15.0 - July 16 2025
8.15.0
8.15.0
Changes:
- TLS: remove support for Secure Transport and BearSSL
Bugfixes:
- altsvc: accept 'clear' without semicolon as well
- asyn-ares: remove redundant NULL check
- asyn-thrdd: free the previous name before strdup'ing the new
- autotools: detect and link `brotlicommon` library for brotli
- autotools: drop `$top_builddir/src` from src header path
- autotools: drop headers from src mk-unity rules (fixup)
- autotools: drop no longer necessary `--srcdir` unity options
- autotools: drop redundant `Makefile.inc` from `EXTRA_DIST` in src
- autotools: simplify configuration in tests, examples
- bufq: change read/write signatures
- bufq: remove the unused Curl_bufq_unwrite function
- build: assume `sys/socket.h`, `sys/time.h` on non-Windows (as in `curl/curl.h`)
- build: drop `HAVE_SYS_SOCKET_H` and `HAVE_SYS_TIME_H` macros
- build: drop explicit curlx from hdr paths, refer headers with `curlx/` prefix
- build: drop unused variables in tests
- build: fix libcurltool with cmake and tunits, related tidy-ups
- build: split `.c` and `.h` file lists in tests
- build: stop checking for `sys/stat.h`
- build: stubgss tidy-ups (in tests)
- build: sync build scripts between client/libtest
- build: tidy up `Makefile.inc` use in lib and src
- build: tidy up header paths, use srcdir where possible
- cf-socket: make socket data_pending a nop
- checksrc-all: rewrite in Perl, remove `checksrc.bat`
- checksrc: reduce exceptions, apply again to curlx
- cmake/FindGSS: fix processing C header path options
- cmake/FindGSS: initialize result variables
- cmake: `curl_add_clang_tidy_test_target` tidy-ups
- cmake: build `stubgss` library for libtests to match autotools
- cmake: check USE_WINDOWS_SSPI when adding secur32 to CURL_LIBS
- cmake: configure c-ares header directory in project root (was: lib)
- cmake: document OpenSSL and ngtcp2 crypto lib custom variables
- cmake: drop never propagated C macros
- cmake: drop passing redundant `CURL_STATICLIB` in examples and clients
- cmake: drop redundant macro from test clients
- cmake: drop reference to future variable
- cmake: enable soversion by default for OpenHarmony OS
- cmake: fix `curl_add_clang_tidy_test_target` when no `-D` option
- cmake: fix generator expression in docs/examples
- cmake: gather options recursively in `curl_add_clang_tidy_test_target`
- cmake: make docs depend on support files
- cmake: move `OUTPUT` argument in the `add_custom_command()` line
- cmake: omit clang-tidy on internal libs curlu and curltool
- cmake: replace `cmakelint` with `cmake-lint` from `cmakelang`, fix issues
- cmake: replace the way clang-tidy verifies tests, fix issues found
- cmake: simplify handling generated `lib1521.c` in libtests
- cmake: sync `target_link_libraries()` order in tests more
- cmake: sync tests scripts by using the variable `BUNDLE`
- cmake: sync tests scripts with each other and autotools (more)
- cmake: use `target_link_options()` when available
- config-win32: fix default targets, shorten macro logic
- configure: order LDAP after the SSL libraries
- connect: drop unused struct member
- connection: clarify `transport`
- connection: eliminate member `remote_addr`
- curl-config: fix whitespace in usage text
- curl.h: make CURL_IPRESOLVE_* symbols defined as longs
- curl.h: make CURLSSLOPT_* symbols defined as longs
- curl.h: remove the "RESERVED" error codes
- curl: implement non-blocking STDIN read on Windows
- curl: improve non-blocking STDIN performance
- curl: remove the global argument from many functions
- curl: unify pointer names to global config
- curl_get_line: make sure lines end with newline
- curl_memory.h: fix to undefine `accept4`
- curl_path: make SFTP handle a path like /~ properly.
- curlinfo: provide the 'digest' feature
- CURLSHOPT_SHARE.md: mention multi-threading requires callbacks
- DE

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.15.0.html]_

### 8.14.1

- Date: 2025-06-04
- Version: 8.14.1
- Original notes: https://curl.se/ch/8.14.1.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.14.1
- Labels: Platforms: Desktop

- **fixed** — Fix cleanup when RR fails due to OOM in async-thrdd
- **fixed** — Recognize more Linux targets when setting -D_GNU_SOURCE in autotools
- **changed** — Mention the medium bounty amount in 2025 in BUG-BOUNTY.md
- **fixed** — Fix missed version number for multi-pkg-config detections in cmake
- **changed** — Mention HTTP resumed uploads to be shaky in cmdline-docs
- **fixed** — Make -N handled correctly in curl
- **fixed** — Fix upload from '.' in curl
- **fixed** — Exclude dllmain from Cygwin builds
- **removed** — Remove mention of hyper from docs/tests
- **fixed** — Fix typos in docs
- **fixed** — Fix teardown of DATA connection in done in ftp
- **fixed** — Fail early when rewind of input failed when following redirects in http
- **changed** — Update some copyright links to curl.se in license
- **fixed** — Fix getaddrinfo/freeaddrinfo checks in memanalyze.pl
- **fixed** — Fix spelling in misc
- **fixed** — Fix add_handle resizing in multi
- **fixed** — Handle BIO_CTRL_EOF correctly in tls BIOs
- **fixed** — Make --no-anyauth not be accepted in tool_getparam
- **fixed** — Fix sending of early data in wolfssl
- **fixed** — Handle blocked sends better in ws

curl / Docs / Releases / Changes in 8.14.1
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.14.0 all changes 8.15.0 🠲
#### Changes in 8.14.1 - June 4 2025
8.14.1
8.14.1
Changes:
Bugfixes:
- asyn-thrdd: fix cleanup when RR fails due to OOM
- autotools: recognize more Linux targets when setting `-D_GNU_SOURCE`
- BUG-BOUNTY.md. mention the medium bounty amount in 2025
- cmake: fix missed version number for multi-pkg-config detections
- cmdline-docs: mention HTTP resumed uploads to be shaky
- curl: make -N handled correctly
- curl: upload from '.' fix
- dllmain: exclude from Cygwin builds
- docs/tests: remove mention of hyper
- docs: fix typos
- ftp: fix teardown of DATA connection in done
- http: fail early when rewind of input failed when following redirects
- license: update some copyright links to curl.se
- memanalyze.pl: fix getaddrinfo/freeaddrinfo checks
- misc: fix spelling
- misc: we write *an* IPv6 address
- multi: fix add_handle resizing
- spelling: 'a' vs 'an'
- spelling: call it null-terminate consistently
- test1510: fix expectation
- tests: await portfile to be complete
- tests: fix checks for https-mtls proto
- tests: improve server start reliability
- tests: move test docs into /docs
- tests: re-enable 1510, document heimdal memleak
- tests: test mtls also w/ clientAuth EKU only
- tests: test mtls with --insecure
- tls BIOs: handle BIO_CTRL_EOF correctly
- tool_getparam: make --no-anyauth not be accepted
- tool_getparam: refactored, simplified
- tool_getparam: remove two nextarg NULL checks
- VULN-DISCLOSURE-POLICY.md: the distros list wants <= 7 days embargo
- wolfssl: fix sending of early data
- ws: handle blocked sends better
- ws: tests and fixes
##### Further
The previous release was 8.14.0. The next release was 8.15.0.

### 8.14.0

- Date: 2025-05-28
- Version: 8.14.0
- Original notes: https://curl.se/ch/8.14.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.14.0
- Labels: Platforms: Desktop

- **added** — MQTT to send ping at upkeep interval
- **added** — Schannel to handle PKCS12 client certificates containing CA certificates
- **added** — CURLOPT_SSL_SIGNATURE_ALGORITHMS option and --sigalgs command-line flag for TLS
- **added** — NGTCP2 with OpenSSL support in vquic
- **added** — Websocket option to disable auto-pong reply
- **added** — CURLOPT_PROTOCOLS to accept a long argument in DoH
- **fixed** — Async-threaded resolver using reference counter
- **fixed** — DNS resolver improvements for threaded and DoH configurations
- **fixed** — FTP accept connect in cf-socket
- **fixed** — HTTP/2 stream window size after unpausing
- **fixed** — Race condition in FTP upload handling
- **fixed** — Memory leak when -h is used in config file
- **fixed** — Transfer-Encoding parser improvements
- **fixed** — HTTP/2 handling of TE request header using trailers
- **changed** — Headers to enforce a maximum number of response headers to accept
- **changed** — AWS SigV4 to improve URL encoding and canonicalization
- **changed** — Build system improvements for cmake including detection of wolfSSL and ngtcp2 features
- **removed** — Support for VS2008 as noted in DEPRECATE.md
- **removed** — Windows CE support as noted in DEPRECATE.md

curl / Docs / Releases / Changes in 8.14.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.13.0 all changes 8.14.1 🠲
#### Changes in 8.14.0 - May 28 2025
8.14.0
8.14.0
Changes:
- mqtt: send ping at upkeep interval
- schannel: handle pkcs12 client certificates containing CA certificates
- TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
- vquic: ngtcp2 + openssl support
- wcurl: import v2025.04.20 script + docs
- websocket: add option to disable auto-pong reply
Bugfixes:
- _SEEALSO.md: remove spaces around command and man page section
- asyn-thrdd: fix detach from running thread
- asyn-thrdd: explain how this is okay with a comment
- asyn resolver code improvements
- async-threaded resolver: use ref counter
- async: DoH improvements
- autotools: detect `wolfSSL_set_quic_use_legacy_code` like cmake does
- autotools: install shell completion files on cross build
- aws-sigv4: allow a blank string
- build: check required rustls-ffi version
- build: enable gcc-12/13+, clang-10+ picky warnings
- build: enable gcc-15 picky warnings
- certs: drop unused `default_bits` from `.prm` files
- cf-https-connect: use the passed in dns struct pointer
- cf-socket: fix FTP accept connect
- cfilters: remove assert
- cmake/FindNGTCP2: simplify multi-pkg-config detection
- cmake: append picky warnings to `CMAKE_REQUIRED_FLAGS` as string
- cmake: avoid 'target is imported but not globally visible' when consuming libcurl with old cmake
- cmake: do not install `mk-ca-bundle` script and man page
- cmake: enable `-Wall` for MSVC when `PICKY_COMPILER=ON`
- cmake: extend integration tests
- cmake: fix `fish` install directory detection via `pkg-config`
- cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
- cmake: fix option() and mark_as_advanced() mixed order
- cmake: fix shell completion install when only one flavor is enabled
- cmake: honor individual picky option overrides found in `CMAKE_C_FLAGS`
- cmake: install shell completions for cross-builds
- cmake: link `crypt32` for OpenSSL feature detection
- cmake: merge `CURL_WERROR` logic into `PickyWarnings.cmake`
- cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
- cmake: quotes, whitespace, use `VERSION_GREATER_EQUAL`
- cmake: revert `CURL_LTO` behavior for multi-config generators
- cmake: set `BUILDING_LIBCURL` directly for unit test targets
- cmake: stop deleting `-W<n>` from `CMAKE_C_FLAGS` (MSVC)
- cmake: tidy up and document feature detections in dependencies
- cmake: use `CMAKE_COMPILE_WARNING_AS_ERROR` if available
- cmake: use `INCLUDE_DIRECTORIES` prop to specify local header dirs
- cmake: use `LIB_NAME` in `curl-config.cmake.in`
- cmake: use absolute paths for completion targets
- cmake: use the `LINK_OPTIONS` property with CMake 3.13+
- configure: catch asking for double resolver without https-rr
- configure: fix --disable-rt
- configure: restore link checks
- configure: suppress command not found for brew
- conncache: make Curl_cpool_init return void
- connect: shutdown timer fix
- content_encoding: Transfer-Encoding parser improvements
- CONTRIBUTE: add project guidelines for AI use
- contrithanks.sh: drop set -e
- cpool/cshutdown: force close connections under pressure
- curl: fix memory leak when -h is used in config file
- curl: only warn once for --manual in manual-disabled build
- curl_get_line: handle lines ending on the buffer boundary
- curl_krb5: only use functions if FTP is still enabled
- curl_multibyte: fixup low-level calls, include in unity builds
- curl_osslq: remove a leftover debug fprintf() call
- curl_version_info.md: clarify ssl_version for MultiSSL
- CURLMOPT_TIMERFUNCTION.md: correct the example
- CURLOPT_ERRORBUFFER.md: buffer is read only after curl takes ownership
- CURLOPT_FOLLOWLOCATION.md: switch to GET => no body
- CURLOPT_READFUNCTION.md: mention the seek callback
- CURLOPT_XFERINFOFUNCTION.md: fix the callback return type in example
- curlx: move the docs to docs/internals/
- DEPRECATE.md: drop

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.14.0.html]_

### 8.13.0

- Date: 2025-04-02
- Version: 8.13.0
- Original notes: https://curl.se/ch/8.13.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.13.0
- Labels: Platforms: Desktop

- **added** — Add write-out variable 'tls_earlydata'
- **added** — Make --url support a file with URLs
- **added** — Add CURLOPT_UPLOAD_FLAGS and --upload-flags for IMAP
- **added** — Add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY follow constants
- **added** — Add support for TLSv1.3 early data in OpenSSL and quictls
- **added** — Add support for CERTINFO in rustls
- **added** — Add support for SSLKEYLOGFILE in rustls
- **added** — Support ECH with DoH lookup for config in rustls
- **added** — Support native platform verifier in rustls
- **added** — Add a '64dec' function that can base64 decode a string
- **added** — Add TLS early data support for wolfssl
- **changed** — Set priority via --ciphers for gnutls
- **fixed** — Add curl macro to avoid redefining foreign symbols in addrinfo
- **fixed** — Avoid separate 'struct resdata' allocation in asyn-thread
- **fixed** — Avoid separate curl_mutex_t allocation in asyn-thread
- **fixed** — Do not allocate thread_data separately in asyn-thread
- **fixed** — Remove 'status' from struct Curl_async
- **fixed** — Fix dllmain.c in unity builds with autotools
- **fixed** — Fix connection reuse when SSL is optional

curl / Docs / Releases / Changes in 8.13.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.12.1 all changes 8.14.0 🠲
#### Changes in 8.13.0 - April 2 2025
8.13.0
8.13.0
Changes:
- curl: add write-out variable 'tls_earlydata'
- curl: make --url support a file with URLs
- gnutls: set priority via --ciphers
- IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
- lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
- OpenSSL/quictls: add support for TLSv1.3 early data
- rustls: add support for CERTINFO
- rustls: add support for SSLKEYLOGFILE
- rustls: support ECH w/ DoH lookup for config
- rustls: support native platform verifier
- var: add a '64dec' function that can base64 decode a string
- wolfssl: tls early data support
Bugfixes:
- addrinfo: add curl macro to avoid redefining foreign symbols
- asyn-thread: avoid the separate 'struct resdata' alloc
- asyn-thread: avoid the separate curl_mutex_t alloc
- asyn-thread: do not allocate thread_data separately
- asyn-thread: remove 'status' from struct Curl_async
- autotools: fix `dllmain.c` in unity builds
- autotools: fix `libtest` bundle to depend on `FIRSTFILES`
- autotools: use `CURLDEBUG` to exclude TrackMemory code from unity
- aws_sigv4: cannot be used for proxy
- aws_sigv4: merge repeated headers in canonical request
- aws_sigv4: use strparse more for parsing
- base64: drop `BUILDING_CURL` macro, always include in tests/server
- build: add Windows CE / CeGCC support, with CI jobs
- build: cmake multi-pkg-config detection improvements (brotli, ldap, mbedtls)
- build: do not apply curl debug macros to `tests/server` by default
- build: drop unused `getpart` tool
- build: enable -Wjump-misses-init for GCC 4.5+
- build: enable `-Wcast-qual`, fix or silence compiler warnings
- build: fix compiler warnings in feature detections
- build: replace Curl_ prefix with curlx_ for functions used in servers
- build: set `-O3` and tune WinCE in CI, fix `getpart`, `vtls_scache` fallouts
- build: set `HAVE_STDINT_H` if `stdint.h` is available
- build: set `HAVE_WRITABLE_ARGV` for Apple cross-builds
- build: silence bogus `-Wconversion` warnings with gcc 5.1-5.4
- build: silence mingw32ce C99 format warnings, simplify CI
- build: tidy-ups around `inet_pton`
- c-ares httpsrr: fix ifdef
- c-ares: error out for unsupported versions, drop unused macros
- ca-native.md: sync with CURLSSLOPT_NATIVE_CA
- cf-socket: deduplicate Windows Vista detection
- cf-socket: remove empty switch
- client writer: handle pause before decoding
- cmake: `CURL_LIBDIRS` improvements (upstreamed from vcpkg)
- cmake: `SHARE_LIB_OBJECT=ON` requires CMake 3.12 or newer
- cmake: add custom command scripts as dependencies where missing
- cmake: add pre-fill for Unix, enable in GHA/macos, verify pre-fills
- cmake: add shell completion support
- cmake: allow `CURL_STATIC_CRT` with shared libcurl and no curl exe
- cmake: allow `CURL_STATIC_CRT` with UCRT VS2015+ builds
- cmake: allow empty `IMPORT_LIB_SUFFIX`, add suffix collision detection
- cmake: avoid `-Wnonnull` warning in `HAVE_FSETXATTR_5` detection
- cmake: disable HTTPS-proxy as a feature if proxy is disabled
- cmake: drop `CURL_DISABLE_TESTS` option
- cmake: drop `HAVE_C_FLAG_Wno_long_double` logic for ancient Apple gcc
- cmake: drop `HAVE_IN_ADDR_T` from pre-fill too
- cmake: drop two stray TLS feature checks for wolfSSL
- cmake: exclude `-MP` for `clang-cl` again
- cmake: fix `HAVE_ATOMIC`/`HAVE_STDATOMIC` pre-fill for clang-cl
- cmake: fix clang-tidy builds to verify tests, fix fallouts
- cmake: fix detection pre-fills for iOS
- cmake: fix ECH detection in custom-patched OpenSSL
- cmake: fix typo in ECH config error msg
- cmake: hide empty `MINGW64_VERSION` output for mingw32ce
- cmake: improve httpd detection for pytest
- cmake: mention 'insecure' in the debug build warning
- cmake: misc tidy-ups
- cmake: pre-fill known type sizes for Windows OSes
- cmake: replace CMAKE_COMPILER_IS_GNUCC with CMAKE_C_COMPILER_ID
- cmake: replace exec_program()

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.13.0.html]_

### 8.12.1

- Date: 2025-02-13
- Version: 8.12.1
- Original notes: https://curl.se/ch/8.12.1.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.12.1
- Labels: Platforms: Desktop

- **fixed** — Fix build with CURL_DISABLE_SOCKETPAIR
- **fixed** — Fix HTTPS RR crash in asyn-thread
- **fixed** — Fix the returned bitmask from Curl_resolver_getsock in asyn-thread
- **fixed** — Make asyn-thread survive a c-ares channel set to NULL
- **fixed** — Add tool_hugehelp.c into IBMi build
- **fixed** — Set <Modulename>_FOUND for compatibility when found via pkg-config in cmake
- **fixed** — Fix HAVE_GETHOSTBYNAME_R_* detections with CURL_WERROR=ON in cmake
- **fixed** — Fix to detect HAVE_OPENSSL_SRP in MSVC UWP builds with cmake
- **fixed** — Fix and add missing feature detections for Windows/MS-DOS in cmake
- **fixed** — Normalize before matching paths with syspaths in cmake
- **fixed** — Check for realpath in configure and cmake
- **fixed** — Set asyn-rr a feature only if httpsrr is enabled in configure and cmake
- **fixed** — Fix TLS upgrade in imap
- **fixed** — Fix netrc return code cleanup and missing file error
- **fixed** — Fix out of scope variables in goto in openssl-quic
- **fixed** — Fix TLS upgrade in pop3
- **fixed** — Fix the disabling of memory tracking in runtests
- **fixed** — Fix TLS upgrade in smtp
- **fixed** — Fix percent output of large parallel transfers in tool_progress
- **removed** — Drop support for legacy Novell LDAP SDK

curl / Docs / Releases / Changes in 8.12.1
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.12.0 all changes 8.13.0 🠲
#### Changes in 8.12.1 - February 13 2025
8.12.1
8.12.1
Bugfixes:
- all: remove FIXME and TODO comments
- asyn-thread: fix build with `CURL_DISABLE_SOCKETPAIR`
- asyn-thread: fix HTTPS RR crash
- asyn-thread: fix the returned bitmask from Curl_resolver_getsock
- asyn-thread: survive a c-ares channel set to NULL
- build: add tool_hugehelp.c into IBMi build
- checksrc.pl: warn on FIXME/TODO comments
- cmake/Find: set `<Modulename>_FOUND` for compatibility when found via `pkg-config`
- cmake: add integration tests, run them in CI
- cmake: always reference OpenSSL and ZLIB via imported targets
- cmake: avoid unnecessary `-L` for implicit link dirs
- cmake: drop `LDAP_DEPRECATED=1` macro, to sync with autotools
- cmake: fix `HAVE_GETHOSTBYNAME_R_*` detections with `CURL_WERROR=ON`
- cmake: fix to detect `HAVE_OPENSSL_SRP` in MSVC UWP builds
- cmake: fix/add missing feature detections for Windows/MS-DOS
- cmake: initialize variables where missing
- cmake: lib order fixes for picky linkers (e.g. binutils `ld`)
- cmake: normalize before matching paths with syspaths
- cmake: respect `GNUTLS_CFLAGS` when detected via `pkg-config`
- cmake: respect `GNUTLS_LIBRARY_DIRS` in `libcurl.pc` and `curl-config`
- cmake: save a line with `CMAKE_C_IMPLICIT_LINK_DIRECTORIES` exclusion
- cmake: tidy up string append and list prepend syntax
- configure/cmake: check for realpath
- configure/cmake: set asyn-rr a feature only if httpsrr is enabled
- content_encoding: #error on too old zlib
- curl_global_sslset.md: Add SSL backend names
- CURLOPT_SSH_KNOWNHOSTS.md: strongly recommend using this
- CURLSHOPT_SHARE.md: adjust for the new SSL session cache
- docs: better explain multi-part byte range behavior
- docs: use valid example domain names
- generate.bat: remove curl_get_line.c from the curlx file list
- header.md: mention `Authorization:` and `Cookie:` special treatment
- imap: TLS upgrade fix
- INTERNALS: fix c-ares, as we actually support 1.6.0 or later
- ldap: drop support for legacy Novell LDAP SDK
- lib: include necessary headers for `inet_ntop`/`inet_pton`
- lib: silence LibreSSL collision warning on non-MSVC Windows
- libssh2: comparison is always true because rc <= -1
- libssh2: raise lowest supported version to 1.2.8
- libssh: drop support for libssh older than 0.9.0
- libssh: silence `-Wconversion` with a cast (Windows 32-bit)
- netrc: return code cleanup, fix missing file error
- openssl-quic: ignore ciphers for h3
- openssl: fix out of scope variables in goto
- pop3: TLS upgrade fix
- runtests: fix the disabling of the memory tracking
- runtests: quote commands to support paths with spaces
- scache: add magic checks
- smb: silence `-Warray-bounds` with gcc 13+
- smtp: TLS upgrade fix
- SPONSORS.md: clarify that we don't promise goods or services
- test1516: avoid failure due to spaces in path
- test2080: simplify, avoid the null byte
- tests: fix test 558, 1330 for MSVC, allow TrackMemory with MSVC in cmake
- tidy-up: make per-file `ARRAYSIZE` macros global as `CURL_ARRAYSIZE`
- tool_cfgable: sort struct fields by size, use bitfields for booleans
- tool_getparam: add "TLS required" flag for each such option
- tool_progress: fix percent output of large parallel transfers
- tool_ssls: switch to tool-specific get_line function
- verbose.md: mention how carriage-return might occur in headers
- vquic: make the "disable GSO" use infof, not failf
- vtls: fix multissl-init
- vtsl: eliminate 'data->state.ssl_scache'
- wakeup_write: make sure the eventfd write sends eight bytes
- wolfssl: silence compiler warning (MSVC 2019), simplify existing
##### Further
The previous release was 8.12.0. The next release was 8.13.0.

### 8.12.0

- Date: 2025-02-05
- Version: 8.12.0
- Original notes: https://curl.se/ch/8.12.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.12.0
- Labels: Platforms: Desktop

- **added** — Add byte range support to --variable reading from file
- **added** — Make --etag-save acknowledge --create-dirs
- **added** — Provide info which auth was used for HTTP and proxy
- **added** — Add support to use keys and certificates from PKCS#11 provider in openssl
- **added** — Add 0RTT for gnutls via CURLSSLOPT_EARLYDATA
- **added** — Add feature ssls-export for SSL session im-/export
- **fixed** — Fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
- **fixed** — Avoid integer overflow in altsvc expire calculation
- **fixed** — Return error on dot-only name in altsvc
- **fixed** — Fix memory leak in asyn-ares
- **fixed** — Add initial HTTPS resolve support in asyn-ares
- **fixed** — Acknowledge CURLOPT_DNS_SERVERS set to NULL in asyn-ares
- **fixed** — Avoid closing eventfd twice in asyn-thread
- **fixed** — Fix crash in netscape cookie parsing
- **fixed** — Support use of custom libzstd memory functions in content_encoding
- **fixed** — Support Windows paths longer than MAX_PATH in curl_multibyte
- **changed** — Cap cookie expire times to 400 days
- **changed** — Drop support for zlib before 1.2.0.4
- **changed** — Put the decomp buffers into the writer structs in content_encoding
- **removed** — Drop hyper support

curl / Docs / Releases / Changes in 8.12.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.11.1 all changes 8.12.1 🠲
#### Changes in 8.12.0 - February 5 2025
8.12.0
8.12.0
Changes:
- curl: add byte range support to --variable reading from file
- curl: make --etag-save acknowledge --create-dirs
- getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
- getinfo: provide info which auth was used for HTTP and proxy
- hyper: drop support
- openssl: add support to use keys and certificates from PKCS#11 provider
- QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
- vtls: feature ssls-export for SSL session im-/export
Bugfixes:
- altsvc: avoid integer overflow in expire calculation
- altsvc: return error on dot-only name
- android: add CI jobs, buildinfo, cmake docs, disable `CURL_USE_PKGCONFIG` by default
- asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
- asyn-ares: fix memory leak
- asyn-ares: initial HTTPS resolve support
- asyn-thread: use c-ares to resolve HTTPS RR
- asyn-thread: avoid closing eventfd twice
- autotools: add support for mingw UWP builds
- autotools: silence gcc warnings in libtool code
- binmode: convert to macro and use it from tests
- build: delete `-Wsign-conversion` related FIXMEs
- build: drop `-Winline` picky warning
- build: drop `tool_hugehelp.c.cvs`, tidy up macros, drop `buildconf.bat`
- build: drop unused feature macros, update exception list
- build: fix `-Wtrampolines` picky warning for gcc 4.x versions
- build: fix compiling with GCC 4.x versions
- build: fix the tidy targets for autotools
- build: fix unsigned `time_t` detection for cmake, MS-DOS, AmigaOS
- build: replace configure check with PP condition (Android <21)
- build: stop detecting `sched_yield()` on Windows
- c-ares: fix/tidy-up macro initializations, avoid a deprecated function
- cd2nroff: do not insist on quoted <> within backticks
- cd2nroff: support "none" as a TLS backend
- cf-https-connect: look into httpsrr alpns when available
- cf-socket: error if address can't be copied
- cfilters: kill connection filter events attach+detach
- checksrc.bat: remove explicit SNPRINTF bypass
- checksrc: ban use of sscanf()
- checksrc: check for return with parens around a value/name
- checksrc: exclude generated bundle files to avoid race condition
- checksrc: fix the return() checker
- checksrc: introduce 'banfunc' to ban specific functions
- cmake/Find: add `iphlpapi` for c-ares, omit syslibs if dep not found
- cmake/FindLDAP: avoid empty 'Requires' item when omitting `pkg-config` module
- cmake/FindLDAP: avoid framework locations for libs too (Apple)
- cmake/FindLibpsl: protect against `pkg-config` "half-detection"
- cmake/FindLibssh: sync header comment with other modules
- cmake/FindMbedTLS: drop lib duplicates early
- cmake: add `librtmp` Find module
- cmake: add LDAP Find module
- cmake: add native `pkg-config` detection for remaining Find modules
- cmake: allow `CURL_LTO` regardless of `CURL_BUILD_TYPE`, enable in CI
- cmake: clang-cl improvements
- cmake: delete accidental debug message
- cmake: deprecate winbuild, add migration guide from legacy build methods
- cmake: detect mingw-w64 version, pre-fill `HAVE_STRTOK_R`
- cmake: do not store `MINGW64_VERSION` in cache
- cmake: drop `CURL_USE_PKGCONFIG` from `curl-config.cmake.in`
- cmake: drop `fseeko()` pre-fill and check for Windows
- cmake: drop duplicate Windows cache value
- cmake: drop redundant FOUND checks (libgsasl, libssh, libuv)
- cmake: drop redundant opening/closing `.*` from `MATCH` expressions
- cmake: drop unused `HAVE_SYS_XATTR_H` detection
- cmake: drop VS2010 "Dialog Hell" workaround added in 2013
- cmake: extend zlib's `AUTO` option to brotli, zstd and enable if found
- cmake: fix `net/in.h` detection for MS-DOS
- cmake: improve `curl_dumpvars()` and move to `Utilities.cmake`
- cmake: make libpsl required by default
- cmake: make system libraries `dl`, `m`, `pthread` customizable
- cmake: move `pkg-config` names to Find modules
- cmake:

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.12.0.html]_

### 8.11.1

- Date: 2024-12-11
- Version: 8.11.1
- Original notes: https://curl.se/ch/8.11.1.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.11.1
- Labels: Platforms: Desktop

- **fixed** — build: fix ECH to always enable HTTPS RR
- **fixed** — build: fix MSVC UWP builds
- **fixed** — build: omit certain deps from libcurl.pc unless found via pkg-config
- **changed** — build: use _fseeki64() on Windows, drop detections
- **fixed** — cmake: do not echo most inherited LDFLAGS to config files
- **changed** — cmake: include wolfssl/options.h first
- **fixed** — cmake: set CURL_STATICLIB for static lib when SHARE_LIB_OBJECT=OFF
- **fixed** — cmake: work around ios.toolchain.cmake breaking feature-detections
- **fixed** — cookie: treat cookie name case sensitively
- **fixed** — curl: --continue-at is mutually exclusive with --no-clobber
- **fixed** — curl: --continue-at is mutually exclusive with --range
- **fixed** — curl: --continue-at is mutually exclusive with --remove-on-error
- **fixed** — curl: rename struct var to fix AIX build
- **fixed** — digest: produce a shorter cnonce in Digest headers
- **fixed** — duphandle: also init netrc
- **added** — ECH: enable support for the AWS-LC backend
- **fixed** — hostip: don't use the resolver for FQDN localhost
- **fixed** — http_negotiate: allow for a one byte larger channel binding buffer
- **fixed** — libssh: use libssh sftp_aio to upload file
- **fixed** — libssh: when using IPv6 numerical address, add brackets

curl / Docs / Releases / Changes in 8.11.1
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.11.0 all changes 8.12.0 🠲
#### Changes in 8.11.1 - December 11 2024
8.11.1
8.11.1
Bugfixes:
- build: fix ECH to always enable HTTPS RR
- build: fix MSVC UWP builds
- build: omit certain deps from `libcurl.pc` unless found via `pkg-config`
- build: use `_fseeki64()` on Windows, drop detections
- cmake: do not echo most inherited `LDFLAGS` to config files
- cmake: drop cmake args list from `buildinfo.txt`
- cmake: include `wolfssl/options.h` first
- cmake: remove legacy unused IMMEDIATE keyword
- cmake: restore cmake args list in `buildinfo.txt`
- cmake: set `CURL_STATICLIB` for static lib when `SHARE_LIB_OBJECT=OFF`
- cmake: sync GSS config code with other deps
- cmake: typo in comment
- cmake: work around `ios.toolchain.cmake` breaking feature-detections
- cmakelint: fix to check root `CMakeLists.txt`
- cmdline/ech.md: formatting cleanups
- configure: add FIXMEs for disabled pkg-config references
- configure: do not echo most inherited `LDFLAGS` to config files
- configure: replace `$#` shell syntax
- cookie: treat cookie name case sensitively
- curl-rustls.m4: keep existing `CPPFLAGS`/`LDFLAGS` when detected
- curl.h: mark two error codes as obsolete
- curl: --continue-at is mutually exclusive with --no-clobber
- curl: --continue-at is mutually exclusive with --range
- curl: --continue-at is mutually exclusive with --remove-on-error
- curl: --test-duphandle in debug builds runs "duphandled"
- curl: do more command line parsing in sub functions
- curl: rename struct var to fix AIX build
- curl: use realtime in trace timestamps
- curl_multi_socket_all.md: soften the deprecation warning
- CURLOPT_PREREQFUNCTION.md: add result code on failure
- digest: produce a shorter cnonce in Digest headers
- DISTROS: update Alt Linux links
- dmaketgz: use --no-cache when building docker image
- docs: bring back ALTSVC.md and HSTS.md
- docs: document default `User-Agent`
- docs: suggest --ssl-reqd instead of --ftp-ssl
- duphandle: also init netrc
- ECH: enable support for the AWS-LC backend
- hostip: don't use the resolver for FQDN localhost
- http_negotiate: allow for a one byte larger channel binding buffer
- http_proxy: move dynhds_add_custom here from http.c
- KNOWN_BUGS: setting a disabled option should return CURLE_NOT_BUILT_IN
- krb5: fix socket/sockindex confusion, MSVC compiler warnings
- lib: fixes for wolfSSL OPENSSL_COEXIST
- libssh: use libssh sftp_aio to upload file
- libssh: when using IPv6 numerical address, add brackets
- macos: disable gcc `availability` workaround as needed
- mbedtls: call psa_crypt_init() in global init
- mime: fix reader stall on small read lengths
- mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
- mprintf: fix the integer overflow checks
- multi: add clarifying comment for wakeup_write()
- multi: fix callback for `CURLMOPT_TIMERFUNCTION` not being called again when...
- netrc: address several netrc parser flaws
- netrc: support large file, longer lines, longer tokens
- nghttp2: use custom memory functions
- OpenSSL: improvde error message on expired certificate
- openssl: remove three "Useless Assignments"
- openssl: stop using SSL_CTX_ function prefix for our functions
- os400: Fix IBMi builds
- os400: Fix IBMi EBCDIC conversion of arguments
- pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
- rtsp: check EOS in the RTSP receive and return an error code
- schannel: remove TLS 1.3 ciphersuite-list support
- setopt: fix CURLOPT_HTTP_CONTENT_DECODING
- setopt: fix missing options for builds without HTTP & MQTT
- show-headers.md: clarify the headers are saved with the data
- socket: handle binding to "host!<ip>"
- socketpair: fix enabling `USE_EVENTFD`
- strtok: use namespaced `strtok_r` macro instead of redefining it
- tests: add the ending time stamp in testcurl.pl
- tests: re-enable 2086, and 472, 1299, 1613 for Windows
- TODO: consider OCSP stapling by default
- tool_

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.11.1.html]_

### 8.11.0

- Date: 2024-11-06
- Version: 8.11.0
- Original notes: https://curl.se/ch/8.11.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.11.0
- Labels: Platforms: Desktop

- **added** — curl: --create-dirs works for --dump-header as well
- **added** — gtls: Add P12 format support
- **added** — ipfs: add options to disable
- **added** — TLS: TLSv1.3 earlydata support for curl
- **changed** — WebSockets: make support official (non-experimental)
- **fixed** — alt-svc: honor data->state.httpwant
- **fixed** — altsvc: avoid using local buffer and memcpy
- **fixed** — asyn-ares: remove typecast, fix expire
- **fixed** — bearssl: avoid strpcy() when generating TLS version log message
- **fixed** — bearssl: improved session handling, test exceptions
- **fixed** — bufq: unwrite fix
- **fixed** — build: add ldap to libcurl.pc Requires
- **fixed** — build: add pytest targets
- **fixed** — build: detect and use _setmode() with Cygwin/MSYS, also use on Windows
- **fixed** — build: disable warning -Wunreachable-code-break
- **fixed** — build: fix clang-cl builds, add CI job
- **fixed** — build: fix cross-compile check for poll with bionic
- **fixed** — build: fix possible -Wformat-overflow in lib557
- **fixed** — build: limit arc4random detection to no-SSL configs
- **fixed** — ftp: fix 0-length last write on upload from stdin

curl / Docs / Releases / Changes in 8.11.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.10.1 all changes 8.11.1 🠲
#### Changes in 8.11.0 - November 6 2024
8.11.0
8.11.0
Changes:
- curl: --create-dirs works for --dump-header as well
- gtls: Add P12 format support
- ipfs: add options to disable
- TLS: TLSv1.3 earlydata support for curl
- WebSockets: make support official (non-experimental)
Bugfixes:
- alt-svc: honor data->state.httpwant
- altsvc: avoid using local buffer and memcpy
- asyn-ares: remove typecast, fix expire
- autotools: add support for 'unity' builds, enable in CI
- bearssl: avoid strpcy() when generating TLS version log message
- bearssl: improved session handling, test exceptions
- bufq: unwrite fix
- build: add `ldap` to `libcurl.pc` `Requires:`
- build: add pytest targets
- build: clarify CA embed is for curl tool, mark default, improve summary
- build: detect and use `_setmode()` with Cygwin/MSYS, also use on Windows
- build: disable warning `-Wunreachable-code-break`
- build: fix clang-cl builds, add CI job
- build: fix cross-compile check for poll with bionic
- build: fix possible `-Wformat-overflow` in lib557
- build: limit arc4random detection to no-SSL configs
- build: show if CA bundle to embed was found
- build: tidy up and improve versioned-symbols options
- build: tidy up deprecation suppression, enable warnings for clang
- certs: add missing `-CAcreateserial` option for LibreSSL
- checksrc: add check for spaces around logical AND operators
- checksrc: Added checks for colon operator in ternary expressions
- checksrc: check for spaces around '?', '>' and '<'
- ci: dump `curl_config.h` to log in all jobs
- CI: run with standard mod_http2
- cmake, Makefile.mk: use -isystem for headers, silence BearSSL issues
- cmake/FindCares: fix version detection for c-ares 1.34.1
- cmake/FindNGTCP2: use library path as hint for finding crypto module
- cmake: add missed variable to comment
- cmake: add native `pkg-config` detection for mbedTLS, MSH3, Quiche, Rustls, wolfSSL
- cmake: allow building tests in unity mode
- cmake: apply `WIN32_LEAN_AND_MEAN` to all feature checks
- cmake: avoid setting `BUILD_TESTING`
- cmake: clear package version after `pkg-config` detection
- cmake: delete unused NEED_LBER_H, HAVE_LDAP_H
- cmake: detect `HAVE_NETINET_IN6_H`, `HAVE_CLOSESOCKET_CAMEL`, `HAVE_PROTO_BSDSOCKET_H`
- cmake: detect GNU GSS
- cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
- cmake: do not propagate unused `HAVE_GSSAPI_GSSAPI_KRB5_H` to C
- cmake: document `-D` and env build options
- cmake: drop obsolete items from `TODO` and `INSTALL-CMAKE`
- cmake: drop redundant assignments
- cmake: drop redundant zlib var, rename function (internals)
- cmake: expand CURL_USE_PKGCONFIG to non-cross MINGW
- cmake: fix broken dependency chain for cmdline-opts, tidy-ups
- cmake: fix compile warnings for clang-cl
- cmake: fix missing spacing in log message
- cmake: limit `CURL_STATIC_CRT` to MSVC
- cmake: make `test-ci` target skip building dependencies
- cmake: mark as advanced some internal Find* variables
- cmake: re-add `generate-curl.1` dependency for `src` in any case
- cmake: rename LDAP dependency config variables to match Find modules
- cmake: replace `check_include_file_concat()` for LDAP and GSS detection
- cmake: replace `CURL_*_DIR` with `{PROJECT,CMAKE_CURRENT}_*_DIR`
- cmake: require quictls (or fork) when using msh3 on non-Windows
- cmake: separate target for examples, optimize CI, fix fallouts
- cmake: set version for `project()` and add CPack support
- cmake: stop adding dependency headers to global `CMAKE_REQUIRED_INCLUDES`
- cmake: sync torture test parallelism with autotools
- cmake: tidy up `CURL_DISABLE_FORM_API` initialization
- cmake: tidy up and shorten symbol hiding initialization
- cmake: tidy up line order
- cmake: tidy up picky warning initialization
- cmake: tidy-ups and rebase fixups
- cmake: tweaks around debug mode and hidden symbols
- cmake: unta

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.11.0.html]_

### 8.10.1

- Date: 2024-09-18
- Version: 8.10.1
- Original notes: https://curl.se/ch/8.10.1.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.10.1
- Labels: Platforms: Desktop

- **fixed** — autotools: fix --with-ca-embed build rule
- **fixed** — cmake: ensure CURL_USE_OPENSSL/USE_OPENSSL_QUIC are set in sync
- **fixed** — cmake: fix MSH3 to appear on the feature list
- **fixed** — connect: store connection info when really done
- **fixed** — FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
- **fixed** — http2: when uploading data from stdin, fix eos forwarding
- **fixed** — http: make max-filesize check not count ignored bodies
- **fixed** — lib: fix AF_INET6 use outside of USE_IPV6
- **fixed** — multi: check that the multi handle is valid in curl_multi_assign
- **fixed** — QUIC: on connect, keep on trying on draining server
- **fixed** — request: correctly reset the eos_sent flag
- **fixed** — runtests: accept 'quictls' as OpenSSL compatible
- **fixed** — rustls: fixed minor logic bug in default cipher selection
- **changed** — rustls: rustls-ffi 0.14.0 update
- **fixed** — rustls: support strong CSRNG data
- **fixed** — setopt: remove superfluous use of ternary expressions
- **fixed** — singleuse: drop Curl_memrchr() for no-HTTP builds
- **fixed** — test537: cap the rlimit max this test runs
- **fixed** — tests: tweak lock file handling and timers
- **fixed** — tool_cb_wrt: use "curl_response" if no filename in URL

curl / Docs / Releases / Changes in 8.10.1
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.10.0 all changes 8.11.0 🠲
#### Changes in 8.10.1 - September 18 2024
8.10.1
8.10.1
Bugfixes:
- autotools: fix `--with-ca-embed` build rule
- cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync
- cmake: fix MSH3 to appear on the feature list
- connect: store connection info when really done
- CURLMOPT_TIMERFUNCTION.md: emphasize that only a single timer should run
- FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
- http2: when uploading data from stdin, fix eos forwarding
- http: make max-filesize check not count ignored bodies
- lib: fix AF_INET6 use outside of USE_IPV6
- libcurl-docs: CURLINFO_LOCAL_* work for QUIC as well as TCP
- multi: check that the multi handle is valid in curl_multi_assign
- QUIC: on connect, keep on trying on draining server
- request: correctly reset the eos_sent flag
- runtests: accept 'quictls' as OpenSSL compatible
- rustls: fixed minor logic bug in default cipher selection
- rustls: rustls-ffi 0.14.0 update
- rustls: support strong CSRNG data
- setopt: remove superfluous use of ternary expressions
- singleuse: drop `Curl_memrchr()` for no-HTTP builds
- test537: cap the rlimit max this test runs
- tests: tweak lock file handling and timers
- tool_cb_wrt: use "curl_response" if no filename in URL
- transfer: fix sendrecv() without interim poll
- vtls: fix `Curl_ssl_conn_config_match` doc param
##### Further
The previous release was 8.10.0. The next release was 8.11.0.