# curl 8.19.0

- Product: curl (https://whatsnew.fyi/product/curl)
- Vendor: curl
- Date: 2026-03-11
- Version: 8.19.0
- Original notes: https://curl.se/ch/8.19.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.19.0
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add CURL_BUILD_EVERYTHING cmake option
- **added** — Add initial support for MQTTS
- **added** — Add build option to use the native CA store on Windows
- **added** — Support fractions for --limit-rate and --max-filesize
- **changed** — With -J, use the redirect name as a backup in tool_cb_hdr
- **changed** — Bump minimum Windows version to Vista from XP
- **changed** — Drop support for OpenSSL-QUIC in vquic
- **changed** — Return 'identity' if no other content encoding exists
- **fixed** — Only accept 17 byte dates from altsvc files
- **fixed** — Abort with OOM error when Curl_dnscache_mk_entry fails in asyn-ares
- **fixed** — Improve blocking resolve timeout handling in async-ares
- **fixed** — Fix memory leak in digest auth_create_digest_http_message
- **fixed** — Escape double quotes and backslashes in digest realm and nonce
- **fixed** — Handle quotes in the digest path
- **removed** — Stop the bug-bounty program end of Jan 2026

curl / Docs / Releases / Changes in 8.19.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.18.0 all changes 8.20.0 🠲
#### Changes in 8.19.0 - March 11 2026
8.19.0
8.19.0
Changes:
- BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026
- cmake: add `CURL_BUILD_EVERYTHING` option
- mqtt: initial support for MQTTS
- tool: support fractions for --limit-rate and --max-filesize
- tool_cb_hdr: with -J, use the redirect name as a backup
- vquic: drop support for OpenSSL-QUIC
- windows: add build option to use the native CA store
- windows: bump minimum to Vista (from XP)
Bugfixes:
- altsvc: only accept 17 byte dates from files
- asyn-ares: abort with OOM error when Curl_dnscache_mk_entry fails
- async-ares: blocking resolve timeout handling, better
- badwords: move into ./scripts, speed up
- build: add missing `GENERATEDCERTS` files
- build: adjust minimum version for some clang picky warnings
- build: check `MSG_NOSIGNAL` directly, drop detection and interim macro
- build: constify `memchr()`/`strchr()`/etc result variables (cont.)
- build: detect and include `inttypes.h` again
- build: do not include wolfSSL header in `curl_setup.h`
- build: drop duplicate C includes
- build: drop global suppression of `-Wformat-nonliteral`, fix fallouts
- build: drop unused `snprintf()` feature check on Windows
- build: fix `-Wunused-macros` warnings, and related tidy-ups
- build: fix building rare combinations
- build: fully omit verbose strings and code when disabled
- build: globally suppress DJGPP warnings in `FD_SET()`
- build: merge TrackMemory (`CURLDEBUG`) into debug-enabled option
- build: move curl stat struct type to the curlx namespace
- build: opt-in MSVC to C99-style verbose logging logic
- build: require POSIX `strdup()`
- build: tidy up and dedupe `strdup` functions
- cf-socket: ignore SOCK_CLOEXEC etc for socktype equality checks
- cf-socket: use SOCK_CLOEXEC in socket_open when available
- checksrc-all.pl: skip non-repository files
- checksrc: do not apply `BANNEDFUNC` to struct member functions
- checksrc: warn for leading spaces before the preprocessor hash
- clang-tidy: add missing and delete redundant parentheses
- clang-tidy: add more missing parentheses in macro values
- clang-tidy: avoid/silence `bugprone-not-null-terminated-result`
- clang-tidy: check `bugprone-macro-parentheses`, fix fallouts
- clang-tidy: drop redundant conditions reported by `misc-redundant-expression`
- clang-tidy: enable `bugprone-signed-char-misuse`, fix fallouts
- clang-tidy: enable more checks
- clang-tidy: enable scanning headers
- clang-tidy: fix issues found with build-fuzzing
- clang-tidy: silence more minor issues found by v22
- cmake/FindMbedTLS: add workaround for missing static MSVC `mbedcrypto.lib` 4.0.0
- cmake: add `CURL_DROP_UNUSED` option to reduce binary sizes
- cmake: add native clang-tidy support for tests, with concatenated sources
- cmake: always build curlu and curltool test libs in unity mode
- cmake: always define `CURL::win32_winsock` on Windows in `curl-config.cmake`
- cmake: convert `curl_add_clang_tidy_test_target()` macro to function
- cmake: enable binutils ld workaround for all toolchains at build-time
- cmake: fix `LOCATION` property access condition (debug)
- cmake: fix `LOCATION` property read errors in target debug function
- cmake: fix building with `CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON`
- cmake: fix confusing error when a dependency is undetected in `curl-config.cmake`
- cmake: fix logic for openssl/zlib binutils ld workaround
- cmake: fix passing system header directories to clang-tidy for tests
- cmake: fix system include directory position for clang-tidy in tests
- cmake: improve clang-tidy test command-line reproduction
- cmake: minor fixes to test targets after prev
- cmake: normalize uppercase hex winver (for display)
- cmake: omit `curl.rc` from curltool lib
- cmake: reference OpenSSL and ZLIB imported targets only when enabled
- cmake: replace internal option with a new `tt` (test tool

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.19.0.html]_