curl and libcurl 8.23.1 Public curl releases: 277 Command line options: 278 curl_easy_setopt() options: 312 Public functions in libcurl: 100 Authors: 1556 Contributors: 3862 This release includes the following changes: This release includes the following bugfixes: o altsvc: cap 'ma' values at two years maximum [17] o API: readonly calls and callbacks [51] o apple sectrust: require OCSP for cert-status [10] o autotools: drop adjacent duplicate `LDFLAGS` from `libcurl.pc` [14] o autotools: drop adjacent duplicate `LIBS` from `libcurl.pc` [73] o cert-status: tests and fixes [5] o CMake/unix-cache.cmake: document BSD version requirements for two features [85] o cmake: drop duplicate deduplication of linker flags [13] o cmake: fix detecting `netinet/ip.h` on OpenBSD, FreeBSD <14.3 (HTTP/3) [86] o cmake: fix preconditions for option `CURL_STATIC_CRT=ON` [15] o cmake: silence MSVC linker warning in debug builds with `CURL_DROP_UNUSED=ON` [11] o conncache: poll an idle connection for pending input on every reuse [27] o cookie: reload complete self-generated cookie jar rows [24] o curl: apply --hsts to ipfs:// and ipns:// gateway requests [70] o curl_getdate.md: clarify that the weekday name means nothing [29] o curl_memrchr: keep reverse searches within the buffer [35] o curl_setup.h: fix dangling pointer in Unicode `CURL_DUMP_MODULE_PATHS()` (Windows) [49] o cw-pause: only pass EOS with the last flushed piece [57] o DEPENDENCIES.md: document LibreSSL 3.4.1+ as required (due to TLSv1.3 API) [83] o docs: encourage verifying tarball before unpacking [89] o doh: inherit the CURLOPT_DNS_* options from the mother transfer [82] o examples: simplify timeout handling in multi-uv.c [31] o ftp: return the error from an invalid range on download [21] o getinfo: clarify invalid URL handling for CURLINFO_EFFECTIVE_URL [90] o gtls/sectrust: fix ocsp checks [56] o http2: do not let a rate limit enlarge the stream window [66] o http2: fail the parent transfer on CURL_PUSH_ERROROUT [64] o INSTALL-CMAKE.md: update 'Testing' section [93] o INSTALL.md: various updates and improvements [87] o libssh2: make the knownhost name check also verify length [19] o libssh: refuse SCP downloads large than CURL_OFF_T_MAX [71] o mk-ca-bundle.pl: add `-x` option to exclude specific CA roots [52] o mk-ca-bundle.pl: include SHA-256 fingerprint for each CA root [55] o mk-ca-bundle.pl: restore option for NSS repo [32] o msvc: replace debug CRT GUI popups with stderr output [34] o multi: undo the counters when curl_multi_add_handle fails [30] o ngh2: a shim in front of nghttp2 calls [39] o openssl: avoid CA caching for providers [91] o openssl: avoid OpenSSL API namespace for local fallback symbol [46] o parsedate: minor simplifications [25] o pingpong: allow impa to add a prefix directly [7] o processhelp.pm: improve task info in trace output (Windows) [77] o proxy: fix 0.0.0.0/0 and ::/0 CIDR matching [12] o pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont. 2) [37] o pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont.) [84] o pytest: timeline check time_queue [40] o rtsp: refuse doing uploads with CRLF conversions [20] o runtests: add `-S` option to show success logs [3] o runtests: add with/without-server test feature tags [62] o runtests: disable test server log output on feature detection [95] o runtests: pass `--disable` to more curl feature detection invocations [94] o runtests: retrieve curl version without using disk files [96] o setopt: fix setting `CURLWS_NOAUTOPONG` with compilers lacking C99 bool type [16] o setopt: keep a paused transfer paused when the speed limit is changed [63] o share: connection pool shutdowns [28] o slist: duplicate lists in linear time [6] o socketpair: fix compiler warning `-Wunreachable-code` [9] o test1488: drop unused C preprocessor logic [79] o test3230: delete local edit committed by accident o test776: delete long-running, flaky, NTLM stress test [61] o test: fix test_60_h3_proxy.py to include scheme in log line [72] o test_06_eyeballs: silence Code Quality warning [2] o tests/server: fix crashing with VS2013 and earlier [4] o tests: drop unused includes [74] o tests: use %TESTNUMBER more instead of the actual test number [88] o testutil: better function implementation [23] o tidy-up: simplify CRTDBG logic in `generate.bat` [33] o tool: append buffered response headers in constant time [78] o tool: preserve absent schemes when appending upload filenames [22] o tool_cb_hdr: treat an empty -J filename as no filename [65] o tool_operhlp: trim remote filename separators in linear time [81] o transfer: drop a pending read rewind when a new transfer starts [54] o urlapi: check host for bad content after IDN decode [18] o urldata: move OpenSSL provider state to OpenSSL context struct [1] o VERSIONS: add the new rock-solid curl releases o vtls: encode session peer key fields unambiguously [8] o vtls_scache: add scheme name to session key [92] o vtls_scache: if using native-ca, use that in key [50] o VULN-DISCLOSURE-POLICY.md: officially don't care for old issues [69] o wolfssl: require a peer certificate when verifying [53] o x509: verify that ASN.1 parsing does not get out of sync [80] o x509asn1: free the field buffer when a public key value fails to convert [58] This release includes the following known bugs: See https://curl.se/docs/knownbugs.html For all changes ever done in curl: See https://curl.se/changes.html Planned upcoming removals include: o Common Name support in TLS certificates for OpenSSL o HTTP/2 Server Push o local crypto implementations o NTLM See https://curl.se/dev/deprecate.html This release would not have looked like this without help, code, reports and advice from friends like these: akashdeshmukh-git, Bootherr on hackerone, Dan Fandrich, Daniel McCarney, Daniel Stenberg, Daniel Wade, David H-yan, David H_YAN, Jeremy Levartovsky, Jon DeVree, Kartatz on github, Martin Mirchev, Martin Vlach, Máté Szabó, matty69v, Mihai-Gabriel Marin, Nora Qiu, Patrick Monnerat, pszemus, Ray Satiro, renovate[bot], revolik on hackerone, Rhino, Roger Light, Samuel Henrique, Stefan Eissing, stze on hackerone, Sujit Jaunjal, Umut, vansukmbg on hackerone, Vasiliy-Kkk, Viktor Szakats, Zefan Xu, Zheng Yu (34 contributors) References to bug reports and discussions on issues: [1] = https://curl.se/bug/?i=23436 [2] = https://curl.se/bug/?i=23367 [3] = https://curl.se/bug/?i=23381 [4] = https://curl.se/bug/?i=23306 [5] = https://curl.se/bug/?i=23420 [6] = https://curl.se/bug/?i=23361 [7] = https://curl.se/bug/?i=23373 [8] = https://curl.se/bug/?i=23357 [9] = https://curl.se/bug/?i=23437 [10] = https://curl.se/bug/?i=23430 [11] = https://curl.se/bug/?i=23435 [12] = https://curl.se/bug/?i=23434 [13] = https://curl.se/bug/?i=23427 [14] = https://curl.se/bug/?i=23348 [15] = https://curl.se/bug/?i=23336 [16] = https://curl.se/bug/?i=23306 [17] = https://curl.se/bug/?i=23429 [18] = https://hackerone.com/reports/4129950 [19] = https://curl.se/bug/?i=23423 [20] = https://curl.se/bug/?i=23425 [21] = https://curl.se/bug/?i=23524 [22] = https://curl.se/bug/?i=23402 [23] = https://curl.se/bug/?i=23422 [24] = https://curl.se/bug/?i=23407 [25] = https://curl.se/bug/?i=23417 [27] = https://hackerone.com/reports/4098761 [28] = https://curl.se/bug/?i=23404 [29] = https://curl.se/bug/?i=23413 [30] = https://curl.se/bug/?i=23526 [31] = https://curl.se/bug/?i=23408 [32] = https://curl.se/bug/?i=23537 [33] = https://curl.se/bug/?i=23410 [34] = https://curl.se/bug/?i=23400 [35] = https://curl.se/bug/?i=23538 [37] = https://curl.se/bug/?i=23468 [39] = https://curl.se/bug/?i=23504 [40] = https://curl.se/bug/?i=23531 [46] = https://curl.se/bug/?i=23520 [49] = https://curl.se/bug/?i=23512 [50] = https://curl.se/bug/?i=23495 [51] = https://curl.se/bug/?i=23096 [52] = https://curl.se/bug/?i=23508 [53] = https://curl.se/bug/?i=23503 [54] = https://curl.se/bug/?i=23505 [55] = https://curl.se/bug/?i=23502 [56] = https://curl.se/bug/?i=23486 [57] = https://curl.se/bug/?i=23461 [58] = https://curl.se/bug/?i=23459 [61] = https://curl.se/bug/?i=23493 [62] = https://curl.se/bug/?i=23492 [63] = https://curl.se/bug/?i=23462 [64] = https://curl.se/bug/?i=23481 [65] = https://curl.se/bug/?i=23469 [66] = https://curl.se/bug/?i=23472 [69] = https://curl.se/bug/?i=23470 [70] = https://curl.se/bug/?i=23454 [71] = https://curl.se/bug/?i=23474 [72] = https://curl.se/bug/?i=23477 [73] = https://curl.se/bug/?i=23447 [74] = https://curl.se/bug/?i=23316 [77] = https://curl.se/bug/?i=23467 [78] = https://curl.se/bug/?i=23352 [79] = https://curl.se/bug/?i=23471 [80] = https://curl.se/bug/?i=23426 [81] = https://curl.se/bug/?i=23405 [82] = https://curl.se/bug/?i=23456 [83] = https://curl.se/bug/?i=23466 [84] = https://curl.se/bug/?i=23468 [85] = https://curl.se/bug/?i=23464 [86] = https://curl.se/bug/?i=23448 [87] = https://curl.se/bug/?i=23455 [88] = https://curl.se/bug/?i=23395 [89] = https://curl.se/bug/?i=23441 [90] = https://curl.se/bug/?i=23444 [91] = https://curl.se/bug/?i=23453 [92] = https://curl.se/bug/?i=23452 [93] = https://curl.se/bug/?i=23438 [94] = https://curl.se/bug/?i=23450 [95] = https://curl.se/bug/?i=23424 [96] = https://curl.se/bug/?i=23442