RELEASE-NOTES 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337
  1. curl and libcurl 8.8.0
  2. Public curl releases: 257
  3. Command line options: 259
  4. curl_easy_setopt() options: 305
  5. Public functions in libcurl: 94
  6. Contributors: 3161
  7. This release includes the following changes:
  8. o curl_version_info: provide librtmp version [73]
  9. o file: add support for directory listings [63]
  10. o idn: add native AppleIDN (icucore) support for macOS/iOS [95]
  11. o lib: add curl_multi_waitfds [34]
  12. o mbedTLS: implement CURLOPT_SSL_CIPHER_LIST option [103]
  13. o NTLM_WB: drop support [67]
  14. o TLS: add support for ECH (Encrypted Client Hello) [109]
  15. o urlapi: add CURLU_GET_EMPTY for empty queries and fragments [111]
  16. This release includes the following bugfixes:
  17. o bearssl: fix compiler warnings [43]
  18. o bearssl: use common code for cipher suite lookup [126]
  19. o build: prefer `USE_IPV6` macro internally (was: `ENABLE_IPV6`) [85]
  20. o build: remove MacOSX-Framework script [60]
  21. o cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set [36]
  22. o cf-https-connect: use timeouts as unsigned ints [143]
  23. o cf-socket: remove references to l_ip, l_port [9]
  24. o ci: add curl-for-win builds: Linux MUSL, macOS, Windows [68]
  25. o cmake: add `BUILD_EXAMPLES` option to build examples [128]
  26. o cmake: add librtmp/rtmpdump option and detection [108]
  27. o CMake: check fseeko after detecting HAVE_FILE_OFFSET_BITS [64]
  28. o cmake: enable `-pedantic-errors` for clang when `CURL_WERROR=ON` [47]
  29. o cmake: FindNGHTTP2 add static lib name to find_library call [141]
  30. o cmake: fix `CURL_WERROR=ON` for old CMake and use it in GHA/linux-old [48]
  31. o cmake: fixup `DEPENDS` filename [51]
  32. o cmake: forward `USE_LIBRTMP` option to C [59]
  33. o cmake: generate misc manpages and install `mk-ca-bundle.pl` [24]
  34. o cmake: speed up libcurl doc building again [15]
  35. o cmake: tidy-up to use `WORKING_DIRECTORY` [23]
  36. o cmake: use namespaced custom target names [80]
  37. o cmdline-docs: fix make install with configure --disable-docs [1]
  38. o configure: error on missing perl if docs or manual is enabled [135]
  39. o configure: make --disable-docs imply --disable-manual [2]
  40. o content_encoding: brotli and others, pass through 0-length writes [5]
  41. o content_encoding: ignore duplicate chunked encoding [137]
  42. o contrithanks: honor `CURLWWW` variable [69]
  43. o curl-confopts.m4: define CARES_NO_DEPRECATED when c-ares is used [17]
  44. o curl.h: change CURL_SSLVERSION_* from enum to defines [132]
  45. o curl: make --help adapt to the terminal width [11]
  46. o curl: use curl_getenv instead of the curlx_ version [20]
  47. o Curl_creader_read: init two variables to avoid using them uninited [99]
  48. o curl_getdate.md: document two-digit year handling [127]
  49. o curl_global_trace.md: shorten the description [29]
  50. o curl_setup.h: detect 'inline' support [133]
  51. o curl_sha512_256: do not use workaround for NetBSD when not needed [21]
  52. o curl_sha512_256: fix detection of OpenSSL 1.1.1 or later [8]
  53. o curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY [105]
  54. o CURLINFO_REQUEST_SIZE: fixed, add tests for transfer infos reported [52]
  55. o cw-out: improved error handling [104]
  56. o dist: `set -eu`, fix shellcheck, make reproducible and smaller tarballs [38]
  57. o dist: add files missing from release tarball [53]
  58. o dist: add reproducible dir entries to tarballs [56]
  59. o dist: do not require Perl in `maketgz` [71]
  60. o dist: remove the curl-config.1 from the tarball [28]
  61. o dist: verify tarball reproducibility in CI [40]
  62. o DISTROS: add patch and issues link for curl-for-win [110]
  63. o DISTROS: Cygwin updates [44]
  64. o dllmain: Call OpenSSL thread cleanup for Windows and Cygwin [114]
  65. o doc: pytest `--repeat` -> `--count` [58]
  66. o docs/cmdline-opts: invoke managen using a relative path [30]
  67. o docs/MAIL-ETIQUETTE: convert to markdown [12]
  68. o docs: add CURLOPT_NOPROGRESS to CURLOPT_XFERINFOFUNCTION example [61]
  69. o docs: clarify CURLOPT_MAXFILESIZE and CURLOPT_MAXFILESIZE_LARGE [74]
  70. o file: remove useless assignment [89]
  71. o ftp: fix socket leak on rare error [102]
  72. o GHA: add shellcheck job and fix warnings, shell tidy-ups [70]
  73. o GHA: add valgrind to a wolfSSL build [37]
  74. o GHA: on macOS remove $HOME/.curlrc [50]
  75. o gnutls: lazy init the trust settings [75]
  76. o hash: change 'slots' to size_t from int [144]
  77. o http/2, http/3: decouple stream state from easy handle [92]
  78. o http2 + ngtcp2: pass CURLcode errors from callbacks [94]
  79. o http2: emit RST when client write fails [65]
  80. o http3: quiche+ngtcp2 improvements [129]
  81. o http: acknowledge a returned error code [123]
  82. o http: reject HTTP major version switch mid connection [100]
  83. o http: with chunked POST forced, disable length check on read callback [31]
  84. o http_aws_sigv4: remove useless assignment [88]
  85. o idn: make Curl_idnconvert_hostname() use Curl_idn_decode() [16]
  86. o if2ip: make the buf_size arg a size_t [142]
  87. o INSTALL-CMAKE.md: explain `cmake -G <generator-name>` [32]
  88. o lib: add trace support for client reads and writes [45]
  89. o lib: merge `ENABLE_QUIC` C macro into `USE_HTTP3` [84]
  90. o lib: silence `-Wsign-conversion` in base64, strcase, mprintf [139]
  91. o lib: silence warnings on comma misuse [91]
  92. o lib: use `#error` instead of invalid syntax in `curl_setup_once.h` [49]
  93. o lib: use multi instead of multi_easy for the active multi [41]
  94. o libcurl-opts: mention pipelining less [33]
  95. o libssh2: replace `access()` with `stat()` [145]
  96. o libssh2: set length to 0 if strdup failed [6]
  97. o m4: fix rustls pkg-config codepath [22]
  98. o makefile: remove the sorting from the vc-ide action [42]
  99. o maketgz: put docs/RELEASE-TOOL.md into the tarball [35]
  100. o mbedtls: call mbedtls_ssl_setup() after RNG callback is set [66]
  101. o mbedtls: cut off trailing newlines from debug logs [87]
  102. o mbedtls: fix building with v3 in CMake Unity mode [107]
  103. o mime: avoid using access() [125]
  104. o misc: fix typos [62]
  105. o mprintf: check fputc error rather than matching returned character [82]
  106. o mqtt: when Curl_xfer_recv returns error, don't use nread [101]
  107. o multi: avoid memory-leak risk [134]
  108. o multi: introduce SETUP state for better timeouts [26]
  109. o multi: multi_wait improvements [131]
  110. o multi: remove the unused Curl_preconnect function [98]
  111. o multi: remove useless assignment [146]
  112. o multi: timeout handles even without connection [81]
  113. o openldap: create ldap URLs correctly for IPv6 addresses [19]
  114. o openssl: do not set SSL_MODE_RELEASE_BUFFERS [10]
  115. o OS400: fix shellcheck warnings in scripts [72]
  116. o projects: drop MSVC project files for recent versions [79]
  117. o quic: fixup duplicate static function name (for cmake unity) [77]
  118. o quiche: expire all active transfers on connection close [116]
  119. o RELEASE-PROCEDURE: mention an initial working build [7]
  120. o request: make Curl_req_init return void [96]
  121. o request: paused upload on completed download, assess connection [54]
  122. o reuse: add copyright + license info to individual docs/*.md files [13]
  123. o ROADMAP: remove completed entries, mention websocket
  124. o rustls: remove incorrect SSLSUPP_TLS13_CIPHERSUITES flag [115]
  125. o sendf: fix two typos in comments [90]
  126. o sendf: useless assignment in cr_lc_read() [120]
  127. o smtp: result of Curl_bufq_cread was not used [78]
  128. o telnet: check return code from fileno() [112]
  129. o tests/http: fix compiler warning [39]
  130. o tests: add -q as first option when invoking curl for tests [97]
  131. o tests: check caddy server version to match test expectations [106]
  132. o tests: enable test 1117 for hyper [119]
  133. o tests: fix feature case in test1481 [117]
  134. o tls: fix SecureTransport + BearSSL cmake unity builds [113]
  135. o tls: use shared init code for TCP+QUIC [57]
  136. o tool: move tool_ftruncate64 to tool_util.c [138]
  137. o tool_cb_rea: limit rate unpause for -T . uploads [136]
  138. o tool_getparam: output warning for leading unicode quote character [14]
  139. o tool_operate: don't truncate the etag save file by default [118]
  140. o tool_operate: init vars unconditionally in post_per_transfer [124]
  141. o tool_paramhlp: remove duplicate assign [121]
  142. o tool_xattr: "guess" URL scheme if none is provided [3]
  143. o tool_xattr: in debug builds, act normally if CURL_FAKE_XATTR is not set [4]
  144. o transfer: remove useless assignment [122]
  145. o url: do not URL decode proxy crendentials [55]
  146. o url: fix use of an uninitialized variable [86]
  147. o urlapi: allow setting port number zero [76]
  148. o urlapi: fix relative redirects to fragment-only [83]
  149. o urldata: remove fields not used depending on used features [46]
  150. o vquic: use CURL_FORMAT_CURL_OFF_T for 64 bit printf output [18]
  151. o vtls: TLS session storage overhaul [130]
  152. o winbuild: add ENABLE_WEBSOCKETS option [93]
  153. o winbuild: use $(RC) correctly [27]
  154. o wolfssl: plug memory leak in wolfssl_connect_step2() [25]
  155. This release includes the following known bugs:
  156. o see docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)
  157. Planned upcoming removals include:
  158. o support for space-separated NOPROXY patterns
  159. See https://curl.se/dev/deprecate.html for details
  160. This release would not have looked like this without help, code, reports and
  161. advice from friends like these:
  162. Abdullah Alyan, blankie, Brian Inglis, Carlos Henrique Lima Melara,
  163. Christian Schmitz, Chris Webb, Colin Leroy-Mira, Dagfinn Ilmari Mannsåker,
  164. Dan Fandrich, Daniel J. H., Daniel McCarney, Daniel Stenberg, Dmitry Karpov,
  165. Emanuele Torre, Evgeny Grin (Karlson2k), Fabian Keil, fuzzard, Gisle Vanem,
  166. Gusted, hammlee96 on github, Harmen Stoppels, Harry Sintonen, Hongfei Li,
  167. Jan Macku, Jan Venekamp, Jeff King, Jérôme Leclercq, Jiwoo Park,
  168. Johann Sebastian Schicho, Jonatan Vela, Kailun Qin, kalvdans on github,
  169. Keitagit-kun on github, Konstantin Kuzov, kpcyrd on github, Laramie Leavitt,
  170. magisterquis on hackerone, Marcel Raad, Matt Jolly, Mel Zuser,
  171. Michael Kaufmann, Michał Antoniak, Patrick Monnerat, Paul Gilmartin,
  172. Paul Howarth, Pavel Kropachev, Philip Heiduck, Rahul Krishna M, RainRat,
  173. Ray Satiro, riastradh on github, Robert Moreton, Sanjay Pujare,
  174. Sergey Bronnikov, Sergey Ogryzkov, Sergio Durigan Junior,
  175. southernedge on github, Stefan Eissing, Stephen Farrell, Tal Regev,
  176. Tobias Stoeckmann, Toon Claes, Viktor Szakats, zmcx16 on github
  177. (64 contributors)
  178. References to bug reports and discussions on issues:
  179. [1] = https://curl.se/bug/?i=13198
  180. [2] = https://curl.se/bug/?i=13191
  181. [3] = https://curl.se/bug/?i=13205
  182. [4] = https://curl.se/bug/?i=13220
  183. [5] = https://curl.se/bug/?i=13209
  184. [6] = https://curl.se/bug/?i=13213
  185. [7] = https://curl.se/bug/?i=13216
  186. [8] = https://curl.se/bug/?i=13208
  187. [9] = https://curl.se/bug/?i=13210
  188. [10] = https://curl.se/bug/?i=13203
  189. [11] = https://curl.se/bug/?i=13171
  190. [12] = https://curl.se/bug/?i=13247
  191. [13] = https://curl.se/bug/?i=13245
  192. [14] = https://curl.se/bug/?i=13214
  193. [15] = https://curl.se/bug/?i=13207
  194. [16] = https://curl.se/bug/?i=13236
  195. [17] = https://curl.se/bug/?i=13240
  196. [18] = https://curl.se/bug/?i=13224
  197. [19] = https://curl.se/bug/?i=13228
  198. [20] = https://curl.se/bug/?i=13230
  199. [21] = https://curl.se/bug/?i=13225
  200. [22] = https://curl.se/bug/?i=13200
  201. [23] = https://curl.se/bug/?i=13206
  202. [24] = https://curl.se/bug/?i=13197
  203. [25] = https://curl.se/bug/?i=13272
  204. [26] = https://curl.se/bug/?i=13371
  205. [27] = https://curl.se/bug/?i=13267
  206. [28] = https://curl.se/bug/?i=13268
  207. [29] = https://curl.se/bug/?i=13263
  208. [30] = https://curl.se/bug/?i=13281
  209. [31] = https://curl.se/bug/?i=13229
  210. [32] = https://curl.se/bug/?i=13244
  211. [33] = https://curl.se/bug/?i=13254
  212. [34] = https://curl.se/bug/?i=13135
  213. [35] = https://curl.se/bug/?i=13239
  214. [36] = https://curl.se/bug/?i=13242
  215. [37] = https://curl.se/bug/?i=13274
  216. [38] = https://curl.se/bug/?i=13299
  217. [39] = https://curl.se/bug/?i=13301
  218. [40] = https://curl.se/bug/?i=13327
  219. [41] = https://curl.se/bug/?i=12665
  220. [42] = https://curl.se/bug/?i=13294
  221. [43] = https://curl.se/bug/?i=13290
  222. [44] = https://curl.se/bug/?i=13258
  223. [45] = https://curl.se/bug/?i=13223
  224. [46] = https://curl.se/bug/?i=13188
  225. [47] = https://curl.se/bug/?i=13286
  226. [48] = https://curl.se/bug/?i=13282
  227. [49] = https://curl.se/bug/?i=13287
  228. [50] = https://curl.se/bug/?i=13284
  229. [51] = https://curl.se/bug/?i=13283
  230. [52] = https://curl.se/bug/?i=13269
  231. [53] = https://curl.se/bug/?i=13346
  232. [54] = https://curl.se/bug/?i=13260
  233. [55] = https://curl.se/bug/?i=13265
  234. [56] = https://curl.se/bug/?i=13322
  235. [57] = https://curl.se/bug/?i=13172
  236. [58] = https://curl.se/bug/?i=13218
  237. [59] = https://curl.se/bug/?i=13364
  238. [60] = https://curl.se/bug/?i=13313
  239. [61] = https://curl.se/bug/?i=13348
  240. [62] = https://curl.se/bug/?i=13344
  241. [63] = https://curl.se/bug/?i=13137
  242. [64] = https://curl.se/bug/?i=13264
  243. [65] = https://curl.se/bug/?i=13292
  244. [66] = https://curl.se/bug/?i=13314
  245. [67] = https://curl.se/bug/?i=13249
  246. [68] = https://curl.se/bug/?i=13335
  247. [69] = https://curl.se/bug/?i=13315
  248. [70] = https://curl.se/bug/?i=13307
  249. [71] = https://curl.se/bug/?i=13310
  250. [72] = https://curl.se/bug/?i=13309
  251. [73] = https://curl.se/bug/?i=13368
  252. [74] = https://curl.se/bug/?i=13372
  253. [75] = https://curl.se/bug/?i=13339
  254. [76] = https://curl.se/bug/?i=13427
  255. [77] = https://curl.se/bug/?i=13332
  256. [78] = https://curl.se/bug/?i=13398
  257. [79] = https://curl.se/bug/?i=13311
  258. [80] = https://curl.se/bug/?i=13324
  259. [81] = https://curl.se/bug/?i=13276
  260. [82] = https://curl.se/bug/?i=13367
  261. [83] = https://curl.se/bug/?i=13394
  262. [84] = https://curl.se/bug/?i=13352
  263. [85] = https://curl.se/bug/?i=13349
  264. [86] = https://curl.se/bug/?i=13399
  265. [87] = https://curl.se/bug/?i=13321
  266. [88] = https://curl.se/bug/?i=13426
  267. [89] = https://curl.se/bug/?i=13425
  268. [90] = https://curl.se/bug/?i=13393
  269. [91] = https://curl.se/bug/?i=13392
  270. [92] = https://curl.se/bug/?i=13204
  271. [93] = https://curl.se/bug/?i=13232
  272. [94] = https://curl.se/bug/?i=13411
  273. [95] = https://curl.se/bug/?i=13246
  274. [96] = https://curl.se/bug/?i=13423
  275. [97] = https://curl.se/bug/?i=13387
  276. [98] = https://curl.se/bug/?i=13422
  277. [99] = https://curl.se/bug/?i=13419
  278. [100] = https://curl.se/bug/?i=13421
  279. [101] = https://curl.se/bug/?i=13418
  280. [102] = https://curl.se/bug/?i=13417
  281. [103] = https://curl.se/bug/?i=13442
  282. [104] = https://curl.se/bug/?i=13337
  283. [105] = https://curl.se/bug/?i=13407
  284. [106] = https://curl.se/bug/?i=13405
  285. [107] = https://curl.se/bug/?i=13377
  286. [108] = https://curl.se/bug/?i=13373
  287. [109] = https://curl.se/bug/?i=11922
  288. [110] = https://curl.se/bug/?i=13499
  289. [111] = https://curl.se/bug/?i=13396
  290. [112] = https://curl.se/bug/?i=13457
  291. [113] = https://curl.se/bug/?i=13450
  292. [114] = https://curl.se/bug/?i=12327
  293. [115] = https://curl.se/bug/?i=13452
  294. [116] = https://curl.se/bug/?i=13439
  295. [117] = https://curl.se/bug/?i=13445
  296. [118] = https://curl.se/bug/?i=13432
  297. [119] = https://curl.se/bug/?i=13436
  298. [120] = https://curl.se/bug/?i=13437
  299. [121] = https://curl.se/bug/?i=13433
  300. [122] = https://curl.se/bug/?i=13435
  301. [123] = https://curl.se/bug/?i=13434
  302. [124] = https://curl.se/bug/?i=13430
  303. [125] = https://curl.se/bug/?i=13497
  304. [126] = https://curl.se/bug/?i=13464
  305. [127] = https://curl.se/bug/?i=13494
  306. [128] = https://curl.se/bug/?i=13491
  307. [129] = https://curl.se/bug/?i=13475
  308. [130] = https://curl.se/bug/?i=13386
  309. [131] = https://curl.se/bug/?i=13150
  310. [132] = https://curl.se/bug/?i=13510
  311. [133] = https://curl.se/bug/?i=13355
  312. [134] = https://curl.se/bug/?i=13471
  313. [135] = https://curl.se/bug/?i=13508
  314. [136] = https://curl.se/bug/?i=13174
  315. [137] = https://curl.se/bug/?i=13451
  316. [138] = https://curl.se/bug/?i=13458
  317. [139] = https://curl.se/bug/?i=13467
  318. [141] = https://curl.se/bug/?i=13495
  319. [142] = https://curl.se/bug/?i=13505
  320. [143] = https://curl.se/bug/?i=13503
  321. [144] = https://curl.se/bug/?i=13502
  322. [145] = https://curl.se/bug/?i=13498
  323. [146] = https://curl.se/bug/?i=13500