curl 8.15.0

curl / Docs / Releases / Changes in 8.15.0 Related: Daily Snapshots Source repo Release log Pending Release 🠰 8.14.1 all changes 8.16.0 🠲

Changes in 8.15.0 - July 16 2025

8.15.0 8.15.0 Changes:

• TLS: remove support for Secure Transport and BearSSL Bugfixes:
• altsvc: accept 'clear' without semicolon as well
• asyn-ares: remove redundant NULL check
• asyn-thrdd: free the previous name before strdup'ing the new
• autotools: detect and link brotlicommon library for brotli
• autotools: drop $top_builddir/src from src header path
• autotools: drop headers from src mk-unity rules (fixup)
• autotools: drop no longer necessary --srcdir unity options
• autotools: drop redundant Makefile.inc from EXTRA_DIST in src
• autotools: simplify configuration in tests, examples
• bufq: change read/write signatures
• bufq: remove the unused Curl_bufq_unwrite function
• build: assume sys/socket.h, sys/time.h on non-Windows (as in curl/curl.h)
• build: drop HAVE_SYS_SOCKET_H and HAVE_SYS_TIME_H macros
• build: drop explicit curlx from hdr paths, refer headers with curlx/ prefix
• build: drop unused variables in tests
• build: fix libcurltool with cmake and tunits, related tidy-ups
• build: split .c and .h file lists in tests
• build: stop checking for sys/stat.h
• build: stubgss tidy-ups (in tests)
• build: sync build scripts between client/libtest
• build: tidy up Makefile.inc use in lib and src
• build: tidy up header paths, use srcdir where possible
• cf-socket: make socket data_pending a nop
• checksrc-all: rewrite in Perl, remove checksrc.bat
• checksrc: reduce exceptions, apply again to curlx
• cmake/FindGSS: fix processing C header path options
• cmake/FindGSS: initialize result variables
• cmake: curl_add_clang_tidy_test_target tidy-ups
• cmake: build stubgss library for libtests to match autotools
• cmake: check USE_WINDOWS_SSPI when adding secur32 to CURL_LIBS
• cmake: configure c-ares header directory in project root (was: lib)
• cmake: document OpenSSL and ngtcp2 crypto lib custom variables
• cmake: drop never propagated C macros
• cmake: drop passing redundant CURL_STATICLIB in examples and clients
• cmake: drop redundant macro from test clients
• cmake: drop reference to future variable
• cmake: enable soversion by default for OpenHarmony OS
• cmake: fix curl_add_clang_tidy_test_target when no -D option
• cmake: fix generator expression in docs/examples
• cmake: gather options recursively in curl_add_clang_tidy_test_target
• cmake: make docs depend on support files
• cmake: move OUTPUT argument in the add_custom_command() line
• cmake: omit clang-tidy on internal libs curlu and curltool
• cmake: replace cmakelint with cmake-lint from cmakelang, fix issues
• cmake: replace the way clang-tidy verifies tests, fix issues found
• cmake: simplify handling generated lib1521.c in libtests
• cmake: sync target_link_libraries() order in tests more
• cmake: sync tests scripts by using the variable BUNDLE
• cmake: sync tests scripts with each other and autotools (more)
• cmake: use target_link_options() when available
• config-win32: fix default targets, shorten macro logic
• configure: order LDAP after the SSL libraries
• connect: drop unused struct member
• connection: clarify transport
• connection: eliminate member remote_addr
• curl-config: fix whitespace in usage text
• curl.h: make CURL_IPRESOLVE_* symbols defined as longs
• curl.h: make CURLSSLOPT_* symbols defined as longs
• curl.h: remove the "RESERVED" error codes
• curl: implement non-blocking STDIN read on Windows
• curl: improve non-blocking STDIN performance
• curl: remove the global argument from many functions
• curl: unify pointer names to global config
• curl_get_line: make sure lines end with newline
• curl_memory.h: fix to undefine accept4
• curl_path: make SFTP handle a path like /~ properly.
• curlinfo: provide the 'digest' feature
• CURLSHOPT_SHARE.md: mention multi-threading requires callbacks
• DEPRECATE.md: add VS2005 removal to the list
• digest: fix build with disabled digest auth
• DISTROS: update NixOS link
• docs,tests: fix english grammar "allow to" -> "allow to"
• docs/CONTRIBUTE: fix broken link
• docs/examples: add ftp-delete.c
• docs: beef up examples/websocket.c
• docs: fix broken link in CODE_REVIEW.md
• docs: fix broken link in INSTALL.md
• docs: fix docs for CURLOPT_PREQUOTE after #17616
• docs: fix documentation of connect_only 2
• docs: fix two typos
• docs: mention that the netrc file works without port numbers
• docs: mention the as-is concept generically
• docs: note SSLS-EXPORT feature in -ssl-sessions doc
• docs: reflect that delimiter-separated capath is only OpenSSL
• docs: sync -tls-earlydata support w/ CURLOPT_SSL_OPTIONS
• docs: warn about lifetime in CURLOPT_CLOSESOCKET*
• easy: fix comment-documentation
• easygetopt: fix curl logo in header comment
• firefox-db2pem: avoid use of eval in script
• ftp: fix prequotes for a directory in URL
• ftplistparser: split parse_unix into sub functions
• h2_serverpush: fix file handle leaks reported by clang-tidy
• h3: fix query of concurrent streams
• http/3: report handshake with version and cipher as for TCP connections
• http2: do not delay RST send on aborted transfer
• http2: fix var types in is_alive() implementations
• http: explicitly ignore parsing errors for Retry-After
• http: fix build with cookies and HSTS disabled
• http_ntlm: protect against null deref
• http_ntlm: remove unreachable code
• INSTALL.md: cygwin details and add source code link
• ldap: avoid automake caching issues with LDAP library names
• ldap: if ldap-lib is sufficient, add it to LIBS.
• ldap: initial support for --with-ldap option
• lib2082: drop typedef struct
• lib: address singleuse issues
• lib: avoid reusing unclean connection
• lib: drop two interim macros in favor of native libcurl API calls
• lib: fix unused parameter/function compiler warnings
• lib: make CURLX_SET_BINMODE() and use it
• lib: make curlx_wait_ms() and use it
• lib: replace scache no-op macros with #ifdef
• lib: stop time() debug overrides at the end of source in altsvc, hsts
• lib: unify recv/send function signatures
• libcurl-env.md: drop LOGNAME, USER and NTLMUSER
• libcurl.m4: fix indentation
• libssh2: remove use of 'initialised' for cleanup
• libssh: de-complex myssh_statemach_act()
• libssh: fix readdir issues
• libtests: make test 1503,1504,1505 use the 1502 binary
• libtests: more header tidy-ups
• libtests: stop building the sames source multiple times
• memdebug.h: #undef fclose before defining it
• memdebug.h: eliminate global macro CURL_MT_LOGFNAME_BUFSIZE
• memdebug: include in unity batch
• memory: stop overriding unused wcsdup()/_wcsdup() system functions
• memory: tidy up _tcsdup() override
• misc: fix typos
• mk-lib1521: replace printf with curl_mprintf
• multi: add dirty bitset
• multi: do no expire a blocked transfer
• multi: fix polling with pending input
• multi: remove careful bounds check as coverity says it is not needed
• multi: xfer table/bitset, handle limits
• ngtcp2: fix coverity warning about result handling
• openssl: enable readahead
• openssl: error on SSL_ERROR_SYSCALL
• openssl: fix handling of buffered data
• openssl: fix openssl engine use
• openssl: fix pkcs11 provider available check
• os400: upgrade ILE/RPG bindings with latest definitions.
• pingpong: on disconnect, check for unflushed pingpong state
• projects/build-openssl.bat: remove
• pytest test_07_70, weaken early data check
• pytest: adapt for runs with openssl-1.1.1
• pytest: disable test_07_37 and test_07_36 with openssl's quic
• quic: implement CURLINFO_TLS_SSL_PTR
• RELEASE-PROCEDURE.md: update docs/VERSIONS
• runtests.pl: fix sprintf() using one too many %s
• runtests: fix LD_PRELOAD detection for cmake-built curl binaries
• runtests: support memory-limits per test
• rustls: apply memory function overrides, fixing an ECH buffer free
• rustls: don't try printing the not provided file
• schannel: allow partial chains for manual peer verification
• schannel: drop Windows 2000 compatibility logic
• scorecard: flame graphs and documentation
• SCP/SFTP: avoid busy loop after EAGAIN
• scripts: fix to quote the copyright email address
• socks: fix query when filter context is null
• system.h: remove some macros
• test1117: reduce write delays
• test1175: fix to run, and fix documentation issues detected
• test1222: fix for out-of-tree and no-libcurl-manual builds
• test1499, 1599: use %LOGDIR
• test1499: verify two chunked responses on reused connection
• test1596: let test pass after year 2036
• test1706: pass include directory to managen for out-of-tree builds
• tests/client: drop autotools logic no longer necessary
• tests/client: use curl_mfprintf()
• tests/dnsd: read config from file
• tests/http/clients: drop hack and use curl_setup.h again
• tests/http/clients: move to tests/client
• tests/http/requirements: remove multipart
• tests/libtest: call curlx_now_init() for unit 1399, 2600 (Windows)
• tests/libtest: drop TEST_HANG_TIMEOUT redefinition hack
• tests/libtest: drop a checksrc exception
• tests/libtest: use curltime from curlx
• tests/server/util.c: include netinet/in6.h
• tests/server: de-dupe/merge three sockdaemon() clones into one
• tests/server: drop memdebug.h
• tests/server: make all global vars/funcs static
• tests/server: move memory init to memptr.c
• tests/servers.pm: add more ways to figure out current user
• tests: always make bundles, adapt build and tests
• tests: bundle http clients, de-dupe, enable for MSVC
• tests: constify, make consts static
• tests: drop BUNDLE_SRC variable
• tests: drop mk-bundle exceptions
• tests: drop unused or redundant includes
• tests: drop useless "nodist_SOURCES" assignments
• tests: fail torture if !valgrind&threaded resolver
• tests: fix 1301, 1308 to fail on error
• tests: fix BUNDLE variable references in Makefile.am
• tests: make all names < 75 characters long
• tests: make individual test sources compile cleanly
• tests: make sshserver less verbose
• tests: move curlcheck.h to libtest as unitcheck.h
• tests: move GSS-API dynamic stub into debug-mode libcurl
• tests: torture: don't duplicate valgrind command
• tests: use %b64[] to base64 data
• tests: use %b64[] to base64 data in 2056, 2057
• tftpd: use CURLMIN() macro
• tidy-up: replace <memdebug.h> with "memdebug.h" (src, units)
• tls: remove Curl_ssl false_start
• tool1621: drop unused internal libcurl headers
• tool_getparam: fix --ftp-pasv
• tool_operate: fix return code when --retry is used but not triggered
• tool_paramhelp: fix language in comments
• top-complexity: lower max allowed complexity threshold to 90
• unit tests: extract "private" prototypes at build time
• unit1302: expand the base64 encode/decode tests
• url: fix connection lifetime checks
• url: fix NULL deref with bad password when no user is provided
• urlapi: simplify and split into sub functions
• urlapi: use uppercase hex encoding
• vauth: move auth structs to conn meta data
• vtls: change send/recv signatures of tls backends
• vtls: fix a copy-pasted early data comment typo
• vtls: log rustls negotiated KEX group name
• vtls: prefer ciphersuite to cipher in msgs
• vtls: prefer rustls-ffi ciphersuite name API
• VULN-DISCLOSURE-POLICY.md: fix typos
• VULN-DISCLOSURE-POLICY: all reports should be disclosed
• VULN-DISCLOSURE-POLICY: exclude not installed software
• VULN-DISCLOSURE-POLICY: minor language polish
• warnless: drop parts of the read/write preprocessor hack (Windows)
• warnless: replace read()/write() wrapper functions with macros (Windows)
• windows: drop redundant curl_wcsdup_callback callback
• windows: fixup fopen() in CURLDEBUG builds
• windows: reduce/stop loading DLLs at runtime
• wolfssl: add support for ML_KEM hybrids
• ws: drop redundant CURL_EXTERN from function definitions
• xfer: manage pause bits

Further

…