cURL

What's new in this version:

Changed:
- curl: named globs in output filename for upload glob references
- HTTP/3: add proxy CONNECT and MASQUE CONNECT-UDP support (ngtcp2 QUIC)
- http2: remove stream dependency tracking
- lib: drop support for CURLAUTH_DIGEST_IE
- libssh: add support for SHA256 host public keys
- tool_urlglob: add named globs

Fixed:
- _ENVIRONMENT.md. Windows does case insensitive env variables
- _URL.md: remove the zone-id mention
- AmigaOS: curl_setup.h avoid explicit_bzero with clib2
- AmigaOS: fix build fallouts, re-add to CI
- asyn-thrdd: add IPv6 guards
- asyn-thrdd: fix result processing without wakeup socketpair
- autotools: mbedtls detection fixes
- BINDINGS: Update Hollywood link
- BUFQ.md: re-sync with source code
- build: enable `-Wlogical-op` picky warning for GCC 4.4+
- build: omit zlib pkg-config reference for Android
- cf-h2-prox: fix peer leak
- cf-h2-proxy: drop interim responses
- cf-https-connect: do not engage on proxy origin
- cf-ip-happy.c: minor comment typo
- cf-ip-happy: update documentation
- cf-socket: make Curl_addr2string static
- cf-socket: set scope_id for IPv6 link-local addresses
- cf-socket: store errno from do_connect in ctx->error
- cfilters: fix busy loop on blocked transfers
- chunked: reject invalid bytes in trailer
- CIPHERS.md: fix the example that uses only TLS 1.3
- cmake/FindGSS: drop "MIT Unknown" version value, related tidy ups
- cmake/FindGSS: drop CMake <3.16 compatibility logic
- cmake/FindGSS: fix comment, adjust custom flavor property name
- cmake/FindGSS: prioritize MIT over GNU in pkg-config detection
- cmake: auto-select static nghttp2/nghttp3/ngtcp2 Config
- cmake: export/forward `NGTCP2_CRYPTO_BACKEND`
- cmake: fix three issues generating lib options in config files
- cmake: fix zstd CMake config name
- cmake: opt in `MSVC_VERSION` 1951 to picky warnings
- cmake: quote `COMPONENTS` string in `curl-config.in.cmake`
- cmake: simplify `LINK_ONLY` imported target extraction
- config2setopts: use default protocol properly
- connect: remove deref of freed pointer in trace call
- content_encoding: fix limit failure message
- content_encoding: fix non-last chunked rejection
- content_encoding: timeout during slow decoding
- cookie: check __Secure- and __Host- case sensitively when read from file
- cookie: compare path case sensitively
- cookie: reject control octets in file-loaded cookies
- cookie: simplify strstore(), remove outdated comment
- cookie: tailmatch the domains for secure override
- cookie: trim trailing dots when checking PSL
- creds: add sasl service name
- creds: create with empty user+pass
- creds: mask OAuth bearer token in trace logs
- creds: remove two unused functions
- curl_easy_pause.md: rephrase the stream cache when pause clause
- curl_easy_setopt.md: change options when no transfer runs
- curl_formdata: fix to pass long where missing, document `CURLFORM_NAMELENGTH`
- curl_multi_assign.md: clarify lifetime
- curl_ntlm_core: fix nettle 4+ builds in certain MultiSSL combos
- curl_ntlm_core: propagate DES `CryptEncrypt()` error
- curl_sha512_256: fix result code on error
- CURLINFO_CONTENT_LENGTH_UPLOAD_T.md: expand
- CURLMOPT_SOCKETFUNCTION.md: this sends *all* file descriptors
- CURLOPT_CHUNK_BGN_FUNCTION: target is there for symlinks only
- CURLOPT_DISALLOW_USERNAME_IN_URL: is for CURLOPT_URL only
- CURLOPT_DOH_URL.md: does not inherit proxy options
- CURLOPT_ECH.md: simplify the description language
- CURLOPT_HAPROXYPROTOCOL.md: only sent for newly setup connections
- CURLOPT_MAXFILESIZE: clarify this also works for on-going transfers
- CURLOPT_PINNEDPUBLICKEY.md: does not apply for other origins
- CURLOPT_PORT.md: use stronger language
- CURLOPT_SHARE: warn about early remove
- CURLOPT_SSH_HOSTKEYFUNCTION.md: for new connections only
- CURLOPT_WRITEFUNCTION.md: mention redirects
- CURLOPT_WRITEFUNCTION.md: remove stray reference to HSTS
- delta: harden external command invocations
- digest: escape control codes too
- digest: flush proxy state on proxy or credential change
- digest: flush state on origin or credential change
- dns-httpsrr-lookup: use origin, not peer
- dnscache: remove Curl_dns_entry_link
- docs/libcurl: fix the version for curl_multi_socket_action
- docs: end "...can be used several times..." sentences with period
- docs: fix --follow doc typo
- docs: fix a couple of typos
- docs: fix grammar and wording in FAQ
- docs: fix odd wording in CONTRIBUTE.md
- docs: note CURLOPT_PINNEDPUBLICKEY has no effect on legacy LDAP backend
- docs: returned header size reflects HTTP/1-style format
- doh: cap the maximum TTL to 24 hours
- doh: stricter HTTPS RNAME parsing
- ECH: cleanups
- event: fix wakeup consumption
- ftp: avoid accessing EPSV response one byte past the NULL
- ftp: remove 2 Curl_resolv_blocking() calls
- ftp: remove bits.ftp_use_control_ssl
- ftplistparser: clear strings.target if not symlink
- gnutls: allow building with nettle 4.0
- gnutls: fix more nettle 4+ compatibility issues
- gnutls: require 3.7.2 for earlydata
- gsasl: fix potential double free
- gtls: fix ignored return and uninitialized status in OCSP check
- gtls: fix some typos
- gtls: minor fixes and improvements
- gtls: use the correct return code in trace output
- gtls: verify OCSP response signature in gtls_verify_ocsp_status
- h3-proxy: fix callback return values, and a typo in tests
- hostip: remove unused MAX_HOSTCACHE_LEN and MAX_DNS_CACHE_SIZE
- hsts.md: mention multiple curl invokes effect
- hsts: duplicate live HSTS data in curl_easy_duphandle
- http-proxy: verify CONNECT response headers
- HTTP3.md: update quiche build
- http: don't pass on set cookies to new origins
- http: prefer chunked encoding over Content-Length: 0
- http: reject spurious CR bytes in headers
- http_digest: return better error
- idn: replace header guards with forward declaration
- INSTALL-CMAKE.md: document CMake environment variables
- INTERNALS.md: document minimum nghttp3 and ngtcp2 versions
- KNOWN_BUGS.md: remove fixed GnuTLS <-> OpenSSL incompat bug
- KNOWN_BUGS: remove stale Threads::Threads entry
- krb5_sspi: fix error message on `DecryptMessage()` fail
- ldap: base64 encode binary LDIF values with WinLDAP
- ldap: fix minor leak on write callback error
- ldap: fix to not leak `attribute` on OOM (WinLDAP)
- ldap: switch off chasing referrals
- lib678: fix to not be perma-skipped
- lib: make `__STDC_VERSION__` literals `L` (where missing)
- lib: transfer origin and proxy handling
- lib: two minor typos
- libcurl-easy.md: minor clarifications
- libssh2: do not use deprecated macros when unavailable
- libssh2: drop stray double-negative from `strncmp()` result
- libssh2: fix to return error code on missing parameter
- libssh2: replace macro names with non-misspelled alternatives
- libssh2: save non-standard port to `known_hosts`
- libssh2: sync version check with INTERNALS.md
- libssh2: use non-deprecated `libssh2_knownhost_addc()`
- libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
- m4: drop redundant conditions in TLS library detections
- Makefile.am: drop test1190 listed twice
- managen: apply minor fixes and improvements
- mbedtls: null-terminate the private key blob
- mk-unity.pl: `#include`, and not concatenate input headers
- mqtt: return error on truncated Remaining Length
- mqtt: validate PINGRESP and DISCONNECT have remaining_length == 0
- multi: handle pause in multi socket callback
- multi: remove a stale comment
- multi: silence gcc 16 `-Wnull-dereference`, bump CI job to test
- multi: xfers_really_alive
- netrc: remember and check filename loaded
- netrc: scanner refactor
- ngtcp2: fail handshake directly
- openssl: do not mix OpenSSL int result with `CURLcode` variable
- os400sys: fix theoretical length overflows
- peer.h: fix typo in comment
- pingpong: reject nul byte in server response line
- progress: fix CURLINFO time reporting
- psl: require libpsl 0.16.0 (2016-12-10) or greater
- pytest: pass `--disable` to curl
- pytest: re-enable test test_05_01 and test_05_02 for quiche 0.29.0+
- pythonlint.sh: make it fail on error, fix ruff warnings in pytest
- quic: count zero length packets against max
- ratelimits: use minimal burst rate
- RELEASE-PROCEDURE.md: update coming release dates
- resolve: mention in error that IP address is expected
- rtsp: bump buf after rtsp_filter_rtp()
- runner.pm: apply minor correctness fix
- runner.pm: set `CURL_TESTNUM` for `precheck` commands
- runtests: fix tests for curl builds with embedded CA bundle
- rustls: error on CURLOPT_CRLFILE with native CA store
- schannel: check `schannel_sha256sum()` success, and more
- schannel: enforce Extended Key Usage for custom CA roots
- schannel: error on TLS 1.3-only with cipher list
- schannel: fix https proxy for client cert and certinfo
- schannel: fix revoke_best_effort setting for proxy
- schannel: use fopen instead CreateFile
- schannel_verify: avoid out of blob access
- schannel_verify: simplify CryptQueryObject use
- scripts: catch Credits-to contributors
- SECURITY-ADVISORY.md: expand
- setopt: changing the proxy port is also a proxy change
- setopt: clear proxy auth properly on NULL
- setopt: clear the "custom" CA booleans when set to NULL
- setopt: CURLOPT_MAXCONNECTS set to 0 restores default value
- setopt: defref the old referer when setting a new
- setopt: fix to honor `CURLOPT_PROXY_CAINFO_BLOB` over Native CA
- setopt: gate a few proxy TLS options by checking backend support
- setopt: more careful cleanup of the HSTS cache
- setopt: return error if received `curl_blob->data` is NULL
- show-headers.md: mention bold headers and --no-styled-output
- sigv4: URL encode the username in the header
- smb: constify `strchr()` result variable
- smb: integer overflow proof a size check
- smbserver: update internal id generation for Python 3
- socket: introduce `SOCK_EAGAIN()` and use it
- socket: use name `sockerr` for socket error variables
- socks_sspi: invalid response length is a fatal error
- socks_sspi: store socks5_gssapi_enctype
- spnego_sspi: honor CURLOPT_GSSAPI_DELEGATION for Windows SSPI
- spnego_sspi: preserve distinction btw policy-only and uncond delegation
- src: fix comment typos
- src: sync nghttp2 versions checks with current requirements
- ssl native_ca_store: always reinit
- SSLCERTS: document 8.19.0 default Native CA builds (Windows)
- sspi: clear SSPI credentials on AcquireCredentialsHandle failure
- sspi: free libcurl allocated memory with curlx_free
- telnet: drop an `int` cast no longer necessary
- telnet: drop redundant interim variables
- telnet: fix error message typos
- telnet: fix old copy-paste typo in variable name
- telnet: honor CURLOPT_TIMEOUT in send_telnet_data()
- test1588: use %TESTNUMBER, not hard-coded number
- test1981: explicitly set the locale
- tests: add `cookies` feature to some tests
- tests: add an assert to avoid IPC blocking
- tests: add the "--resolve" keyword to tests that lack it
- tests: fix unit1636 with --disable-progress-meter
- tftp: avoid the timeout calc if the timeout is crazy
- tftp: stricter option name checks
- tidy-up: add space around operators, where missing
- tidy-up: apply clang-format fixes
- tidy-up: drop stray casts for allocated pointers
- tidy-up: miscellaneous
- tls: fix incomplete mTLS config in conn reuse and session cache
- tls: wolfssl: fixes for PQC key shares
- tool: warn when --ssl and --ftp-ssl-control override each other
- tool_formparse.c: fix two minor comment typos
- tool_formparse: polish error message + make two functions static
- tool_formparse: tool2curlparts is no longer recursive
- tool_help: rectify a bad assert
- tool_operhlp: avoid NULL to %s
- tool_urlglob: avoid overflow at end of range
- tool_urlglob: better 'Duplicate glob name' position
- tool_urlglob: make globbing error reported for correct position
- tool_writeout: fix %time{} output for %s
- transfer: clear referer when set to NULL
- unit1675: fix potential memory leak on dynbuf fail path
- unix-sockets: ignore proxy settings
- URL-SYNTAX: document more URL parsing details
- url: compare full origin when setting credentials
- url: connection credentials origin
- url: connection reuse fixes for starttls
- url: detect proxy changes read from environment
- url: don't log bits.close state
- url: fix connection reuse for starttls protocols
- url: keep the question mark for empty queries
- url: remove superfluous check
- url: url_match_destination fix
- urlapi: accept 0X prefix in IPv4 address as well
- urlapi: change more lowercase percent-encoded to uppercase
- urlapi: compare zone-id in Curl_url_same_origin()
- urlapi: consume trailing dots after IPv4 numerical addresses
- urlapi: deny hostnames with more than one trailing dot
- urlapi: drop base fragment on empty redirect
- urlapi: fix an issue parsing file URLs
- urlapi: fix memleaks on error in `parse_hostname_login()`
- urlapi: fix redirect handling if CURLU_NO_GUESS_SCHEME is set
- urlapi: forbid '|' in host
- urlapi: handle redirect without set scheme with default-scheme
- urlapi: URL decode hostname before IP address normalization
- user-agent.md: mention double quotes too
- var: use a dedicated pointer for the alloc
- verify-release: verify more thoroughly with git
- vquic: drop stray casts for `iovec.iov_len`
- vtls: more large buffer support and error checks for SHA-256
- vtls: use Curl_safecmp for CRLfile and pinned_key comparison
- vtls_scache: include signature_algorithms in the SSL peer cache key
- vtls_spack: drop redundant macro fallbacks
- VULN-DISCLOSURE-POLICY.md: emphasize comm as a human
- VULN-DISCLOSURE-POLICY.md: emphasize the no email thank you part
- VULN-DISCLOSURE-POLICY.md: test code is not secure
- VULN-DISCLOSURE-POLICY: non-released code
- websockets: auto-tunnel through http proxy
- websockets: buffer upgrade data at connection level
- windows: update MS SDK versions in comments
- winldap: avoid NULL pointer deref on `ldap_get_dn()` fail
- ws: make pong sending lazy
- x509asn1: fix DH public key parameter extraction
- x509asn1: fix operator order in do_pubkey