curl 8.12.0

curl / Docs / Releases / Changes in 8.12.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.11.1 all changes 8.12.1 🠲

Changes in 8.12.0 - February 5 2025

8.12.0 8.12.0 Changes:

• curl: add byte range support to --variable reading from file
• curl: make --etag-save acknowledge --create-dirs
• getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
• getinfo: provide info which auth was used for HTTP and proxy
• hyper: drop support
• openssl: add support to use keys and certificates from PKCS#11 provider
• QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
• vtls: feature ssls-export for SSL session im-/export Bugfixes:
• altsvc: avoid integer overflow in expire calculation
• altsvc: return error on dot-only name
• android: add CI jobs, buildinfo, cmake docs, disable CURL_USE_PKGCONFIG by default
• asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
• asyn-ares: fix memory leak
• asyn-ares: initial HTTPS resolve support
• asyn-thread: use c-ares to resolve HTTPS RR
• asyn-thread: avoid closing eventfd twice
• autotools: add support for mingw UWP builds
• autotools: silence gcc warnings in libtool code
• binmode: convert to macro and use it from tests
• build: delete -Wsign-conversion related FIXMEs
• build: drop -Winline picky warning
• build: drop tool_hugehelp.c.cvs, tidy up macros, drop buildconf.bat
• build: drop unused feature macros, update exception list
• build: fix -Wtrampolines picky warning for gcc 4.x versions
• build: fix compiling with GCC 4.x versions
• build: fix the tidy targets for autotools
• build: fix unsigned time_t detection for cmake, MS-DOS, AmigaOS
• build: replace configure check with PP condition (Android <21)
• build: stop detecting sched_yield() on Windows
• c-ares: fix/tidy-up macro initializations, avoid a deprecated function
• cd2nroff: do not insist on quoted <> within backticks
• cd2nroff: support "none" as a TLS backend
• cf-https-connect: look into httpsrr alpns when available
• cf-socket: error if address can't be copied
• cfilters: kill connection filter events attach+detach
• checksrc.bat: remove explicit SNPRINTF bypass
• checksrc: ban use of sscanf()
• checksrc: check for return with parens around a value/name
• checksrc: exclude generated bundle files to avoid race condition
• checksrc: fix the return() checker
• checksrc: introduce 'banfunc' to ban specific functions
• cmake/Find: add iphlpapi for c-ares, omit syslibs if dep not found
• cmake/FindLDAP: avoid empty 'Requires' item when omitting pkg-config module
• cmake/FindLDAP: avoid framework locations for libs too (Apple)
• cmake/FindLibpsl: protect against pkg-config "half-detection"
• cmake/FindLibssh: sync header comment with other modules
• cmake/FindMbedTLS: drop lib duplicates early
• cmake: add librtmp Find module
• cmake: add LDAP Find module
• cmake: add native pkg-config detection for remaining Find modules
• cmake: allow CURL_LTO regardless of CURL_BUILD_TYPE, enable in CI
• cmake: clang-cl improvements
• cmake: delete accidental debug message
• cmake: deprecate winbuild, add migration guide from legacy build methods
• cmake: detect mingw-w64 version, pre-fill HAVE_STRTOK_R
• cmake: do not store MINGW64_VERSION in cache
• cmake: drop CURL_USE_PKGCONFIG from curl-config.cmake.in
• cmake: drop fseeko() pre-fill and check for Windows
• cmake: drop duplicate Windows cache value
• cmake: drop redundant FOUND checks (libgsasl, libssh, libuv)
• cmake: drop redundant opening/closing .* from MATCH expressions
• cmake: drop unused HAVE_SYS_XATTR_H detection
• cmake: drop VS2010 "Dialog Hell" workaround added in 2013
• cmake: extend zlib's AUTO option to brotli, zstd and enable if found
• cmake: fix net/in.h detection for MS-DOS
• cmake: improve curl_dumpvars() and move to Utilities.cmake
• cmake: make libpsl required by default
• cmake: make system libraries dl, m, pthread customizable
• cmake: move pkg-config names to Find modules
• cmake: move GSS init before feature detections
• cmake: move mingw UWP workaround from GHA to CMakeLists.txt
• cmake: namespace functions and macros
• cmake: optimize out 4 picky warning option detections with gcc
• cmake: pick a better IPv6 feature flag when assembling the feature list
• cmake: pre-fill HAVE_STDATOMIC_H, HAVE_ATOMIC for mingw-w64
• cmake: pre-fill HAVE_STDINT_H on Windows
• cmake: prefer dash-style MSVC options
• cmake: publish/check supported protocols/features via CURLConfig.cmake
• cmake: replace unset(VAR) with set(VAR "") for init
• cmake: sync OpenSSL QUIC fork detection with autotools
• cmake: use CMAKE_REQUIRED_LINK_DIRECTORIES
• cmake: use STREQUAL to detect Linux
• cmake: warn for OpenSSL versions missing TLS 1.3 support
• cmdline-opts/version.md: describe multissl, mention SSLS-EXPORT
• completion.pl: add completion for paths after @ for fish
• config-mac: drop MACOS_SSL_SUPPORT macro
• config: drop unused code and variables
• configure: do not inline 'dnl' comments
• configure: drop unused detections and macros
• configure: streamline Windows large file feature check
• configure: UWP and Android follow-up fixes
• conncache: count shutdowns against host and max limits
• conncache: result_cb comment removed from function docs
• content_encoding: drop support for zlib before 1.2.0.4
• content_encoding: namespace GZIP flag constants
• content_encoding: put the decomp buffers into the writer structs
• content_encoding: support use of custom libzstd memory functions
• cookie: cap expire times to 400 days
• cookie: fix crash in netscape cookie parsing
• cookie: parse only the exact expire date
• curl-functions.m4: fix indentation in CURL_SIZEOF()
• curl: return error if etag options are used with multiple URLs
• curl_multi_fdset: include the shutdown connections in the set
• curl_multi_waitfds.md: tidy up the example
• curl_multibyte: support Windows paths longer than MAX_PATH
• curl_setup: fix missing ADDRESS_FAMILY type in rare build cases
• curl_sha512_256: rename symbols to the curl namespace
• curl_url_set.md: adjust the added-in to 7.62.0
• curl_ws_recv.md: fix typo
• CURLOPT_CONNECT_ONLY.md: an easy handle with this option set cannot be reused
• CURLOPT_PROXY.md: clarify the credential support in proxy URLs
• CURLOPT_RESOLVE.md: fix wording
• CURLOPT_SEEKFUNCTION.md: used for FTP, HTTP and SFTP (only)
• docs/BUGS.md: remove leading space from a link
• docs/cmdline-opts/_ENVIRONMENT.md: minor language fix
• docs/cmdline-opts/location.md: fix typos for location flag
• docs/HTTP-COOKIES.md: link to more information
• docs/HTTPSRR.md: initial HTTPS RR documentation
• docs/libcurl/opts: clarify the return values
• docs/libcurl: return value overhall
• docs/TLS-SESSIONS: fix typo, the->they
• docs: document the behavior of -- in the curl command line
• docs: use lowercase curl and libcurl
• doh: cleanups and extended HTTPS RR code
• doh: send HTTPS RR requests for all HTTP(S) transfers
• easy: allow connect-only handle reuse with easy_perform
• easy: make curl_easy_perform() return error if connection still there
• easy_lock: use Sleep(1) for thread yield on old Windows
• ECH: update APIs to those agreed with OpenSSL maintainers
• examples/block-ip: drop redundant memory.h include
• examples/block-ip: show how to block IP addresses
• examples/complicated: fix warnings, bump deprecated callback, tidy up
• examples/synctime.c: remove references to dead URLs and functionality
• examples: make them compile with compatibility functions disabled (Windows)
• examples: use return according to code style
• file: drop OPEN_NEEDS_ARG3 option
• file: fix Android compiler warning
• gitignore: add generated unity sources for lib and src
• GnuTLS: fix 'time_appconnect' for early data
• hash: add asserts in hash_element_dtor()
• HTTP/2: strip TE request header
• http2: fix data_pending check
• http2: fix value stored to 'result' is never read
• http: fix build with CURL_DISABLE_COOKIES
• http: ignore invalid Retry-After times
• http_aws_sigv4: Fix invalid compare function handling zero-length pairs
• https-connect: start next immediately on failure
• INFRASTRUCTURE.md: project infra
• INSTALL-CMAKE.md: fix punctuation
• INSTALL.md: add CMake examples for macOS and iOS
• INSTALL.md: document VS2008 and mingw-w64
• INTERNALS.md: sync wolfSSL version requirement with source code
• lib517: extend the getdate test with quotes and leading "junk"
• lib: clarify 'conn->httpversion'
• lib: redirect handling by protocol handler
• lib: remove __EMX__ guards
• lib: replace inline redefine with CURL_INLINE macro
• lib: suppress deprecation warnings in apple builds
• lib: TLS session ticket caching reworked
• libcurl/opts: do not save files in dirs where attackers have access
• Makefile.dist: delete
• Makefile.mk: drop in favor of autotools and cmake (MS-DOS, AmigaOS3)
• mbedtls: fix handling of blocked sends
• mbedtls: PSA can be used independently of TLS 1.3 (avoid runtime errors)
• mime: explicitly rewind subparts at attachment time.
• mprintf: fix integer handling in float precision
• mprintf: terminate snprintf output on windows
• msvc: add missing push/pop for warning pragmas
• msvc: assume _INTEGRAL_MAX_BITS >= 64
• msvc: drop checks for ancient versions
• msvc: fix building with HAVE_INET_NTOP and MSVC <=1900
• msvc: require VS2005 for large file support
• msvc: tidy up _CRT_*_NO_DEPRECATE definitions
• multi: fix curl_multi_waitfds reporting of fd_count
• multi: fix return code for an already-removed easy handle
• multihandle: add an ssl_scache here
• multissl: auto-enable OPENSSL_COEXIST for wolfSSL + OpenSSL
• multissl: make openssl + wolfssl builds work
• netrc: 'default' with no credentials is not a match
• netrc: fix password-only entries
• netrc: restore _netrc fallback logic
• ngtcp2: fix memory leak on connect failure
• ngtcp2: fix two cases of value stored never read
• openssl: define HAVE_KEYLOG_CALLBACK before use
• openssl: drop unused HAVE_SSL_GET_SHUTDOWN macro
• openssl: fix ECH logic
• osslq: use SSL_poll to determine writeability of QUIC streams
• projects/Windows: remove wolfSSL from legacy projects
• projects: fix INSTALL-CMAKE.md references
• pytest: remove 'repeat' parameter
• pytest: use httpd/apache2 directly, no apachectl
• RELEASE-PROCEDURE.md: mention how to publish security advisories
• runtests.pl: fix precedence issue
• scripts/mdlinkcheck: markdown link checker
• sectransp: free certificate on error
• select: avoid a NULL deref in cwfds_add_sock
• smb: fix compiler warning
• src: add CURL_STRICMP() macro, use _stricmp() on Windows
• src: drop support for CURL_TESTDIR debug env
• src: omit hugehelp and ca-embed from libcurltool
• ssl session cache: change cache dimensions
• strparse: string parsing helper functions
• symbols-in-versions: update version for LIBCURL_VERSION and LIBCURL_VERSION_NUM
• system.h: add 64-bit curl_off_t definitions for NonStop
• system.h: drop compilers lacking 64-bit integer type (Windows/MS-DOS)
• system.h: drop duplicate and no-op code
• system.h: fix indentation
• telnet: handle single-byte input option
• test1960: don't close the socket too early
• test483: require cookie support
• tests/http/clients: use proper sleep() call on NonStop
• tests: change the behavior of swsbounce
• tests: stop promoting perl warnings to fatal errors
• TheArtOfHttpScripting.md: rewrite double 'that'
• tidy-up: curl_setup.h, curl_setup_once.h, config-win32ce.h
• tidy-up: drop parenthesis around return expression
• tidy-up: drop parenthesis around return values
• tidy-up: extend CURL_O_BINARY to lib and tests
• TLS: check connection for SSL use, not handler
• tool_formparse.c: make curlx_uztoso a static in here
• tool_formparse: accept digits in --form type= strings
• tool_getparam: ECH param parsing refix
• tool_getparam: fail --hostpubsha256 if libssh2 is not used
• tool_getparam: fix "Ignored Return Value" …