RELEASE-NOTES 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354
  1. curl and libcurl 8.11.0
  2. Public curl releases: 262
  3. Command line options: 266
  4. curl_easy_setopt() options: 306
  5. Public functions in libcurl: 94
  6. Contributors: 3255
  7. This release includes the following changes:
  8. o curl: --create-dirs works for --dump-header as well [4]
  9. o gtls: Add P12 format support [9]
  10. o ipfs: add options to disable [8]
  11. o TLS: TLSv1.3 earlydata support for curl [140]
  12. o WebSockets: make support official (non-experimental) [106]
  13. This release includes the following bugfixes:
  14. o alt-svc: honor data->state.httpwant [19]
  15. o altsvc: avoid using local buffer and memcpy [124]
  16. o asyn-ares: remove typecast, fix expire [113]
  17. o autotools: add support for 'unity' builds, enable in CI [15]
  18. o bearssl: avoid strpcy() when generating TLS version log message [120]
  19. o bufq: unwrite fix [121]
  20. o build: add `ldap` to `libcurl.pc` `Requires:` [139]
  21. o build: add pytest targets [71]
  22. o build: clarify CA embed is for curl tool, mark default, improve summary [72]
  23. o build: detect and use `_setmode()` with Cygwin/MSYS, also use on Windows [136]
  24. o build: fix cross-compile check for poll with bionic [70]
  25. o build: fix possible `-Wformat-overflow` in lib557 [85]
  26. o build: limit arc4random detection to no-SSL configs [43]
  27. o build: show if CA bundle to embed was found [83]
  28. o build: tidy up and improve versioned-symbols options [5]
  29. o build: tidy up deprecation suppression, enable warnings for clang [12]
  30. o checksrc: Added checks for colon operator in ternary expressions [77]
  31. o checksrc: check for spaces around '?', '>' and '<' [46]
  32. o cmake, Makefile.mk: use -isystem for headers, silence BearSSL issues [37]
  33. o cmake/FindNGTCP2: use library path as hint for finding crypto module [40]
  34. o cmake: add missed variable to comment
  35. o cmake: add native `pkg-config` detection for mbedTLS, MSH3, Quiche, Rustls, wolfSSL [149]
  36. o cmake: allow building tests in unity mode [31]
  37. o cmake: allow manual configuration for LDAP [144]
  38. o cmake: delete unused NEED_LBER_H, HAVE_LDAP_H [38]
  39. o cmake: detect `HAVE_NETINET_IN6_H`, `HAVE_CLOSESOCKET_CAMEL`, `HAVE_PROTO_BSDSOCKET_H` [132]
  40. o cmake: detect GNU GSS [127]
  41. o cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled [44]
  42. o cmake: do not propagate unused `HAVE_GSSAPI_GSSAPI_KRB5_H` to C [131]
  43. o cmake: drop redundant assignments [49]
  44. o cmake: drop redundant zlib var, rename function (internals) [50]
  45. o cmake: expand CURL_USE_PKGCONFIG to non-cross MINGW [13]
  46. o cmake: fix broken dependency chain for cmdline-opts, tidy-ups [11]
  47. o cmake: make `test-ci` target skip building dependencies [88]
  48. o cmake: readd `generate-curl.1` dependency for `src` just in case [86]
  49. o cmake: replace `check_include_file_concat()` for LDAP and GSS detection [143]
  50. o cmake: require quictls (or fork) when using msh3 on non-Windows [14]
  51. o cmake: separate target for examples, optimize CI, fix fallouts [16]
  52. o cmake: stop adding dependency headers to global `CMAKE_REQUIRED_INCLUDES` [146]
  53. o cmake: sync torture test parallelism with autotools [35]
  54. o cmake: use OpenSSL for LDAP detection only if available [102]
  55. o configure: add GSS to `libcurl.pc` `Depends:` [126]
  56. o configure: catch Apple in more target triplets [6]
  57. o configure: drop duplicate feature checks for `poll()`, `if_nametoindex()` [135]
  58. o configure: drop unused bare `socket.h` detection [133]
  59. o configure: improve help string for some options [78]
  60. o conncache: find bundle again in case it is removed [129]
  61. o cookie: overhaul and cleanup [142]
  62. o curl: add build options for safe/no CA bundle search (Windows) [26]
  63. o curl_trc: fix build with verbose messages disabled [79]
  64. o curl_url_set.md: document HOST handling when URL is parsed [2]
  65. o CURLMOPT_PIPELINING.md: clarify that CURLPIPE_NOTHING is not default [54]
  66. o CURLOPT_APPEND.md: goes for SFTP as well [128]
  67. o CURLOPT_HEADERFUNCTION.md: do not modify the passed in buffer [107]
  68. o docs/cmdline-opts: GnuTLS supports PKCS#11 URI in --cert option [101]
  69. o ech: spelling, whitespace, say `--ech` default config [137]
  70. o ftp: fix 0-length last write on upload from stdin [76]
  71. o hsts: avoid the local buffer and memcpy on lookup [125]
  72. o hsts: improve subdomain handling [158]
  73. o http_aws_sigv4: avoid local buffer and strcpy [92]
  74. o INSTALL-CMAKE.md: mention focus on shared libraries [73]
  75. o INSTALL.md: fix a typo that slipped in to RISC OS
  76. o json.md: cli-option `--json` is an alias of `--data-binary` [89]
  77. o lib, src, tests: added space around ternary expressions [56]
  78. o lib/cw-out: initialize 'flush_all' directly [62]
  79. o lib/src: white space edits to comply better with code style [47]
  80. o lib: avoid assigning 'result' temporarily [97]
  81. o lib: fix disabled-verbose-strings + enable-debug build warnings
  82. o lib: fix unity builds with BearSSL, MSH3, Quiche, OmniOS [32]
  83. o lib: use bool/TRUE/FALSE properly [48]
  84. o libssh.c: handle EGAINS during proto-connect correctly [23]
  85. o libssh2: use the Curl_* memory functions to avoid memdebug [22]
  86. o multi.c: make stronger check for paused transfer before asserting [24]
  87. o multi.c: warn/assert on stall only without timer [80]
  88. o multi: avoid reading whole struct pointer from pointer [10]
  89. o multi: convert Curl_follow to static multi_follow [141]
  90. o multi: make curl_multi_cleanup invalidate magic latter [159]
  91. o multi: make multi_handle_timeout use the connect timeout [98]
  92. o negotiate: conditional check around GSS & SSL specific code [1]
  93. o netrc: cache the netrc file in memory [138]
  94. o openssl quic: populate x509 store before handshake [117]
  95. o openssl: convert a memcpy to dynbuf use [57]
  96. o openssl: remove two strcpy() calls [64]
  97. o packages/OS400/curlmain: remove the strncpy calls [155]
  98. o processhelp.pm: improve taskkill calls (Windows) [52]
  99. o pytest: improve pytest_07_42a reliability [118]
  100. o quic: use send/recvmmsg when available [93]
  101. o request: on shutdown send, proceed normally on timeout [18]
  102. o runtests.md: suggest a value for -j for torture tests
  103. o runtests: drop unused code for old/classic-mingw support [87]
  104. o select: use poll() if existing, avoid poll() with no sockets [75]
  105. o sendf: add condition to max-filesize check [3]
  106. o setopt: avoid superfluous length checks before strcmp() [105]
  107. o singleuse: make `git grep` faster, add Apple `nm` support [109]
  108. o smb: replace use of strcpy() with snprintf() [122]
  109. o socks_gssapi: switch to dynbuf from buffer with strcpy [42]
  110. o sws: fix unused static function with `TCP_NODELAY` undefined [134]
  111. o telnet: avoid two strcpy() by pointing to the strings instead [99]
  112. o test1035: convert host name back to utf8 as should be [63]
  113. o test1515: add tracing and more debug info [119]
  114. o test1540: add debug logging [58]
  115. o test190: replace %FTPTIME2 with a fixed value [34]
  116. o test1915: add tracing and connect timeout [114]
  117. o test1915: remove wrong comment
  118. o test2502: add libtest debug tracing [60]
  119. o test504: fix handling on pending connect [59]
  120. o testrun: explicitly set proper IP address for stunnel listen/connect [61]
  121. o tests/server/util.c: remove use of strncpy [156]
  122. o tests/valgrind.pm: fix warnings with no valgrind report to show [25]
  123. o tests/valgrind.supp: remove a travis suppression, add a Debian [116]
  124. o tests: add and use `%PERL` variable to refer to the Perl binary [82]
  125. o tests: add codeset-utf8 as a feature [66]
  126. o tests: add file: tests with existing files [45]
  127. o tests: change Python code style to pass ruff checks
  128. o tests: check http/2 and http/3 server responsiveness [28]
  129. o tests: delete duplicate macro check [53]
  130. o tests: enable additional ruff Python lint options
  131. o tests: fix `%POSIX_PWD` on native Windows Perl [111]
  132. o tests: fix keyword for test1411
  133. o tests: fix shell quoting on native Windows Perl [110]
  134. o tests: fix some Python typing issues
  135. o tests: fixup `checkcmd` `PATH` on non-unixy platforms [108]
  136. o tests: improve mqtt server handling [27]
  137. o tests: introduce %CLIENT6IP-NB [67]
  138. o tests: let openssl generate random cert serials [91]
  139. o tests: libtests and unit tests need explicit #include memdebug [7]
  140. o tests: make precheck for HTTP on 127.0.0.1 into a feature [68]
  141. o tests: Only log warnings or worse by default in smbserver [33]
  142. o tests: postcheck is now in verify [69]
  143. o tests: remove all valgrind disable instructions [21]
  144. o tests: remove debug requirement on 38 tests [100]
  145. o tests: remove the %FTPTIME3 variable [41]
  146. o tests: replace `%PWD` with `%FILE_PWD` for `file://` [84]
  147. o tests: replace `%PWD` with `%SSH_PWD` in SCP/SFTP tests [112]
  148. o tests: replace hard-coded `/dev/null` with variable [81]
  149. o tests: simplify `pathhelp.pm`, avoid using external tools [95]
  150. o tests: speed up builds with single-binary test bundles [29]
  151. o tests: testrunner fairness [39]
  152. o tests: testrunner reliability improvements [55]
  153. o tests: use '-4' where needed [17]
  154. o tftp: avoid two memcpy/strcpy [94]
  155. o tidy-up: rename CURL_WINDOWS_APP to CURL_WINDOWS_UWP [36]
  156. o tool: support --show-headers AND --remote-header-name [103]
  157. o tool_doswin: simplify; remove unused options and strncpy calls [65]
  158. o tool_getparam: replace two uses of strncpy(), ban strncpy [157]
  159. o unit1660: fix unreachable code warning in no-SSL builds [30]
  160. o url: connection reuse on h3 connections [20]
  161. o urlapi: drop unused header [51]
  162. o urlapi: normalize the IPv6 address [115]
  163. o vtls: convert Curl_pin_peer_pubkey to use dynbuf [74]
  164. o vtls: convert pubkey_pem_to_der to use dynbuf [90]
  165. o warnless: remove curlx_sktosi and curlx_sitosk [104]
  166. o wolfssl: convert malloc + memcpys to dynbuf for cipher string [96]
  167. o wolfssl: use old version API without openssl extra [160]
  168. This release includes the following known bugs:
  169. See docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)
  170. For all changes ever done in curl:
  171. See https://curl.se/changes.html
  172. Planned upcoming removals include:
  173. o Hyper support
  174. o TLS libraries not supporting TLS 1.3
  175. See https://curl.se/dev/deprecate.html for details
  176. This release would not have looked like this without help, code, reports and
  177. advice from friends like these:
  178. ad-chaos on github, Aki Sakurai, Baruch Siach, Chris Stubbs, Colton Willey,
  179. Dan Fandrich, Daniel Stenberg, Denis Goleshchikhin, Deniz Sökmen,
  180. dependabot[bot], Emanuel Komínek, Gabriel Marin, Ian Spence, Jon Rumsey,
  181. Kai Pastor, lomberd2 on github, MacKenzie, Montg0mery on github,
  182. Moritz Knüsel, Nemos2024 on github, Nicolas George, Pavel Kropachev,
  183. Pierre-Etienne Meunier, ralfjunker on github, Rasmus Melchior Jacobsen,
  184. Ray Satiro, renovate[bot], Sebastian Walz, Stefan Eissing, Tal Regev,
  185. Tatsuhiro Tsujikawa, Testclutch, Venkat Krishna R, Viktor Szakats,
  186. Vollstrecker on github, vvb2060 on github
  187. (36 contributors)
  188. References to bug reports and discussions on issues:
  189. [1] = https://curl.se/bug/?i=14938
  190. [2] = https://curl.se/bug/?i=14942
  191. [3] = https://curl.se/bug/?i=14958
  192. [4] = https://curl.se/bug/?i=14941
  193. [5] = https://curl.se/bug/?i=14818
  194. [6] = https://curl.se/bug/?i=14728
  195. [7] = https://curl.se/bug/?i=15007
  196. [8] = https://curl.se/bug/?i=14824
  197. [9] = https://curl.se/bug/?i=14991
  198. [10] = https://curl.se/bug/?i=15063
  199. [11] = https://curl.se/bug/?i=14883
  200. [12] = https://curl.se/bug/?i=14789
  201. [13] = https://curl.se/bug/?i=14658
  202. [14] = https://curl.se/bug/?i=15003
  203. [15] = https://curl.se/bug/?i=14815
  204. [16] = https://curl.se/bug/?i=14906
  205. [17] = https://curl.se/bug/?i=15060
  206. [18] = https://curl.se/bug/?i=14843
  207. [19] = https://curl.se/bug/?i=14966
  208. [20] = https://curl.se/bug/?i=14890
  209. [21] = https://curl.se/bug/?i=14983
  210. [22] = https://curl.se/bug/?i=14984
  211. [23] = https://curl.se/bug/?i=14982
  212. [24] = https://curl.se/bug/?i=14981
  213. [25] = https://curl.se/bug/?i=14977
  214. [26] = https://curl.se/bug/?i=14582
  215. [27] = https://curl.se/bug/?i=15059
  216. [28] = https://curl.se/bug/?i=15058
  217. [29] = https://curl.se/bug/?i=14772
  218. [30] = https://curl.se/bug/?i=14971
  219. [31] = https://curl.se/bug/?i=14765
  220. [32] = https://curl.se/bug/?i=14932
  221. [33] = https://curl.se/bug/?i=14950
  222. [34] = https://curl.se/bug/?i=15056
  223. [35] = https://curl.se/bug/?i=14969
  224. [36] = https://curl.se/bug/?i=14881
  225. [37] = https://curl.se/bug/?i=14763
  226. [38] = https://curl.se/bug/?i=14690
  227. [39] = https://curl.se/bug/?i=14967
  228. [40] = https://github.com/curl/curl-for-win/blob/8b8909e1206de1dcca356a8dd33eb1e4ffeea7fd/curl.sh#L289
  229. [41] = https://curl.se/bug/?i=15064
  230. [42] = https://curl.se/bug/?i=15057
  231. [43] = https://curl.se/bug/?i=14909
  232. [44] = https://curl.se/bug/?i=14828
  233. [45] = https://curl.se/bug/?i=15045
  234. [46] = https://curl.se/bug/?i=14921
  235. [47] = https://curl.se/bug/?i=14921
  236. [48] = https://curl.se/bug/?i=15123
  237. [49] = https://curl.se/bug/?i=14924
  238. [50] = https://curl.se/bug/?i=14918
  239. [51] = https://curl.se/bug/?i=14867
  240. [52] = https://curl.se/bug/?i=14959
  241. [53] = https://curl.se/bug/?i=14963
  242. [54] = https://curl.se/bug/?i=14961
  243. [55] = https://curl.se/bug/?i=14960
  244. [56] = https://curl.se/bug/?i=14912
  245. [57] = https://curl.se/bug/?i=15049
  246. [58] = https://curl.se/bug/?i=15055
  247. [59] = https://curl.se/bug/?i=15054
  248. [60] = https://curl.se/bug/?i=15053
  249. [61] = https://curl.se/bug/?i=15051
  250. [62] = https://curl.se/bug/?i=15044
  251. [63] = https://curl.se/bug/?i=15050
  252. [64] = https://curl.se/bug/?i=15052
  253. [65] = https://curl.se/bug/?i=15047
  254. [66] = https://curl.se/bug/?i=15039
  255. [67] = https://curl.se/bug/?i=15039
  256. [68] = https://curl.se/bug/?i=15039
  257. [69] = https://curl.se/bug/?i=15046
  258. [70] = https://curl.se/bug/?i=15013
  259. [71] = https://curl.se/bug/?i=15034
  260. [72] = https://curl.se/bug/?i=15035
  261. [73] = https://curl.se/bug/?i=14845
  262. [74] = https://curl.se/bug/?i=15126
  263. [75] = https://curl.se/bug/?i=15096
  264. [76] = https://curl.se/bug/?i=15101
  265. [77] = https://curl.se/bug/?i=14990
  266. [78] = https://curl.se/bug/?i=15033
  267. [79] = https://curl.se/bug/?i=15026
  268. [80] = https://curl.se/bug/?i=15028
  269. [81] = https://curl.se/bug/?i=15098
  270. [82] = https://curl.se/bug/?i=15097
  271. [83] = https://curl.se/bug/?i=15027
  272. [84] = https://curl.se/bug/?i=15090
  273. [85] = https://curl.se/bug/?i=15012
  274. [86] = https://curl.se/bug/?i=15088
  275. [87] = https://curl.se/bug/?i=15087
  276. [88] = https://curl.se/bug/?i=15001
  277. [89] = https://curl.se/bug/?i=15197
  278. [90] = https://curl.se/bug/?i=15126
  279. [91] = https://curl.se/bug/?i=15129
  280. [92] = https://curl.se/bug/?i=15200
  281. [93] = https://curl.se/bug/?i=14880
  282. [94] = https://curl.se/bug/?i=15199
  283. [95] = https://curl.se/bug/?i=15111
  284. [96] = https://curl.se/bug/?i=15124
  285. [97] = https://curl.se/bug/?i=15122
  286. [98] = https://curl.se/bug/?i=15100
  287. [99] = https://curl.se/bug/?i=15198
  288. [100] = https://curl.se/bug/?i=15114
  289. [101] = https://curl.se/bug/?i=15075
  290. [102] = https://curl.se/bug/?i=15077
  291. [103] = https://curl.se/bug/?i=15110
  292. [104] = https://curl.se/bug/?i=15153
  293. [105] = https://curl.se/bug/?i=15192
  294. [106] = https://curl.se/bug/?i=14936
  295. [107] = https://curl.se/bug/?i=15148
  296. [108] = https://curl.se/bug/?i=15106
  297. [109] = https://curl.se/bug/?i=15070
  298. [110] = https://curl.se/bug/?i=15105
  299. [111] = https://curl.se/bug/?i=15104
  300. [112] = https://curl.se/bug/?i=15103
  301. [113] = https://curl.se/bug/?i=15145
  302. [114] = https://curl.se/bug/?i=15107
  303. [115] = https://curl.se/bug/?i=15143
  304. [116] = https://curl.se/bug/?i=15142
  305. [117] = https://curl.se/bug/?i=15137
  306. [118] = https://curl.se/bug/?i=15138
  307. [119] = https://curl.se/bug/?i=15140
  308. [120] = https://curl.se/bug/?i=15194
  309. [121] = https://curl.se/bug/?i=15136
  310. [122] = https://curl.se/bug/?i=15196
  311. [124] = https://curl.se/bug/?i=15191
  312. [125] = https://curl.se/bug/?i=15190
  313. [126] = https://curl.se/bug/?i=15177
  314. [127] = https://curl.se/bug/?i=15176
  315. [128] = https://curl.se/bug/?i=15181
  316. [129] = https://curl.se/bug/?i=15185
  317. [131] = https://curl.se/bug/?i=15174
  318. [132] = https://curl.se/bug/?i=15172
  319. [133] = https://curl.se/bug/?i=15173
  320. [134] = https://curl.se/bug/?i=15171
  321. [135] = https://curl.se/bug/?i=15170
  322. [136] = https://curl.se/bug/?i=15169
  323. [137] = https://curl.se/bug/?i=15167
  324. [138] = https://curl.se/bug/?i=15248
  325. [139] = https://curl.se/bug/?i=15163
  326. [140] = https://curl.se/bug/?i=15211
  327. [141] = https://curl.se/bug/?i=15260
  328. [142] = https://curl.se/bug/?i=15247
  329. [143] = https://curl.se/bug/?i=15157
  330. [144] = https://curl.se/bug/?i=15255
  331. [146] = https://curl.se/bug/?i=15252
  332. [149] = https://curl.se/bug/?i=15193
  333. [155] = https://curl.se/bug/?i=15214
  334. [156] = https://curl.se/bug/?i=15213
  335. [157] = https://curl.se/bug/?i=15212
  336. [158] = https://curl.se/bug/?i=15210
  337. [159] = https://curl.se/bug/?i=15201
  338. [160] = https://curl.se/bug/?i=15205