RELEASE-NOTES: synced

This commit is contained in:
Daniel Stenberg 2025-10-25 17:55:58 +02:00
parent 3e12ed955b
commit 6f36d58c25
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2

View file

@ -4,7 +4,7 @@ curl and libcurl 8.17.0
Command line options: 273
curl_easy_setopt() options: 308
Public functions in libcurl: 100
Contributors: 3523
Contributors: 3529
This release includes the following changes:
@ -33,6 +33,7 @@ This release includes the following bugfixes:
o autotools: fix duplicate UNIX and BSD flags in buildinfo.txt [113]
o autotools: fix silly mistake in clang detection for buildinfo.txt [114]
o autotools: make --enable-code-coverage support llvm/clang [79]
o autotools: merge `if`s in GnuTLS/OpenSSL feature detection [385]
o aws-lc: re-enable large read-ahead with v1.61.0 again [16]
o base64: accept zero length argument to base64_encode [82]
o build: address some -Weverything warnings, update picky warnings [74]
@ -50,6 +51,7 @@ This release includes the following bugfixes:
o cf-socket: tweak a memcpy() to read better [177]
o cf-socket: use the right byte order for ports in bindlocal [61]
o cfilter: unlink and discard [46]
o cfilters: check return code from Curl_pollset_set_out_only() [402]
o checksrc: allow disabling warnings on FIXME/TODO comments [324]
o checksrc: catch banned functions when preceded by ( [146]
o checksrc: fix possible endless loop when detecting BANNEDFUNC [149]
@ -80,6 +82,7 @@ This release includes the following bugfixes:
o cmdline-opts/_PROGRESS.md: explain the suffixes [154]
o configure: add "-mt" for pthread support on HP-UX [52]
o conn: fix hostname move on connection reuse [272]
o connect: for CONNECT_ONLY, CURLOPT_TIMEOUT does not apply [404]
o connect: remove redundant condition in shutdown start [289]
o cookie: avoid saving a cookie file if no transfer was done [11]
o cookie: only count accepted cookies in Curl_cookie_add [364]
@ -88,6 +91,7 @@ This release includes the following bugfixes:
o curl_easy_getinfo: error code on NULL arg [2]
o curl_easy_setopt.md: add missing CURLOPT_POSTFIELDS [319]
o curl_mem_undef.h: limit to CURLDEBUG for non-memalloc overrides [19]
o curl_ngtcp2: fix `-Wunreachable-code` with H3 !verbose !unity clang [383]
o curl_osslq: error out properly if BIO_ADDR_rawmake() fails [184]
o curl_path: make sure just whitespace is illegal [351]
o Curl_resolv: fix comment. 'entry' argument is not optional [187]
@ -99,6 +103,7 @@ This release includes the following bugfixes:
o CURLOPT_MAXLIFETIME_CONN: make default 24 hours [10]
o CURLOPT_SSL_VERIFYHOST.md: add see-also to two other VERIFYHOST options [32]
o CURLOPT_TIMECONDITION.md: works for FILE and FTP as well [27]
o cw-out: unify the error handling pattern in cw_out_do_write [414]
o digest_sspi: fix two memory leaks in error branches [77]
o dist: do not distribute CI.md [29]
o docs/cmdline-opts: drop double quotes from GLOBBING and URL examples [238]
@ -129,14 +134,20 @@ This release includes the following bugfixes:
o firefox-db2pem.sh: add macOS support, tidy-ups [348]
o form.md: drop reference to MANUAL [178]
o ftp: add extra buffer length check [195]
o ftp: check errors on remote ip for data connection [423]
o ftp: fix ftp_do_more returning with *completep unset [122]
o ftp: fix port number range loop for PORT commands [66]
o ftp: fix the 213 scanner memchr buffer limit argument [196]
o ftp: improve fragile check for first digit > 3 [194]
o ftp: reduce size of some struct fields [418]
o ftp: remove 'newhost' and 'newport' from the ftp_conn struct [419]
o ftp: remove misleading comments [193]
o ftp: remove the retr_size_saved struct field [416]
o ftp: remove the state_saved struct field [417]
o ftp: replace strstr() in ;type= handling [313]
o ftp: simplify the 150/126 size scanner [288]
o gnutls: check conversion of peer cert chain [275]
o gnutls: fix re-handshake comments [422]
o gtls: avoid potential use of uninitialized variable in trace output [83]
o hmac: free memory properly on errors [377]
o hostip: don't store negative resolves due unrelated errors [256]
@ -149,8 +160,10 @@ This release includes the following bugfixes:
o http: handle user-defined connection headers [165]
o http: look for trailing 'type=' in ftp:// without strstr [315]
o http: make Content-Length parser more WHATWG [183]
o http: only accept ';' as a separator for custom headers [407]
o http: return error for a second Location: header [393]
o httpsrr: free old pointers when storing new [57]
o imap: parse and use UIDVALIDITY as a number [420]
o imap: treat capabilities case insensitively [345]
o INSTALL-CMAKE.md: add manual configuration examples [360]
o INSTALL-CMAKE.md: document useful build targets [215]
@ -171,6 +184,7 @@ This release includes the following bugfixes:
o ldap: do not pass a \n to failf() [370]
o ldap: tidy-up types, fix error code confusion [191]
o lib1514: fix return code mixup [304]
o lib: delete unused crypto header includes [384]
o lib: drop unused include and duplicate guards [226]
o lib: fix build error with verbose strings disabled [173]
o lib: remove newlines from failf() calls [366]
@ -213,13 +227,17 @@ This release includes the following bugfixes:
o managen: verify the options used in example lines [181]
o mbedtls: add support for 4.0.0 [344]
o mbedtls: check result of setting ALPN [127]
o mbedtls: fix building with <3.6.1 [400]
o mbedtls: fix building with sha-256 missing from PSA [391]
o mbedtls: handle WANT_WRITE from mbedtls_ssl_read() [145]
o md4: drop mbedtls implementation (not available in mbedtls v3+) [406]
o mdlinkcheck: reject URLs containing quotes [174]
o memdup0: handle edge case [241]
o mime: fix unpausing of readers [375]
o mime: fix use of fseek() [334]
o multi.h: add CURLMINFO_LASTENTRY [51]
o multi_ev: remove unnecessary data check that confuses analysers [167]
o netrc: when the cached file is discarded, unmark it as loaded [409]
o nghttp3: return NGHTTP3_ERR_CALLBACK_FAILURE from recv_header [227]
o ngtcp2: add a comment explaining write result handling [340]
o ngtcp2: adopt ngtcp2_conn_get_stream_user_data if available [362]
@ -230,6 +248,8 @@ This release includes the following bugfixes:
o ngtcp2: fix handling of blocked stream data [236]
o ngtcp2: fix returns when TLS verify failed [251]
o noproxy: fix the IPV6 network mask pattern match [166]
o NTLM: disable if DES support missing from OpenSSL or mbedTLS [399]
o ntlm: improved error path on bad incoming NTLM TYPE3 message [412]
o openldap: avoid indexing the result at -1 for blank responses [44]
o openldap: check ber_sockbuf_add_io() return code [163]
o openldap: check ldap_get_option() return codes [119]
@ -251,6 +271,7 @@ This release includes the following bugfixes:
o openssl: fix unable do typo in failf() calls [341]
o openssl: free UI_METHOD on exit path [373]
o openssl: make the asn1_object_dump name null terminated [56]
o openssl: only try engine/provider if a cert file/name is provided [415]
o openssl: set io_need always [99]
o openssl: skip session resumption when verifystatus is set [230]
o os400: document threads handling in code. [254]
@ -279,6 +300,7 @@ This release includes the following bugfixes:
o sasl: clear canceled mechanism instead of toggling it [41]
o schannel: assign result before using it [62]
o schannel: fix memory leak [363]
o schannel: lower the maximum allowed time to block to 7 seconds [333]
o schannel_verify: do not call infof with an appended \n [371]
o schannel_verify: fix mem-leak in Curl_verify_host [208]
o schannel_verify: use more human friendly error messages [96]
@ -290,6 +312,7 @@ This release includes the following bugfixes:
o smb: adjust buffer size checks [45]
o smb: transfer debugassert to real check [303]
o smtp: check EHLO responses case insensitively [50]
o smtp: fix EOB handling [410]
o smtp: return value ignored [357]
o socks: advance iobuf instead of reset [276]
o socks: avoid UAF risk in error path [359]
@ -348,6 +371,7 @@ This release includes the following bugfixes:
o tool_cb_hdr: fix fwrite check in header callback [49]
o tool_cb_hdr: size is always 1 [70]
o tool_cb_rea: use poll instead of select if available [329]
o tool_cfgable: remove superfluous free calls [403]
o tool_doswin: fix to use curl socket functions [108]
o tool_filetime: cap crazy file times instead of erroring [327]
o tool_filetime: replace cast with the fitting printf mask (Windows) [212]
@ -368,6 +392,7 @@ This release includes the following bugfixes:
o tool_progress: handle possible integer overflows [164]
o tool_progress: make max5data() use an algorithm [170]
o transfer: avoid busy loop with tiny speed limit [100]
o transfer: fix retry for empty downloads on reuse [411]
o transfer: reset retry count on each request [310]
o unit1323: sync time types and printf masks, drop casts [211]
o unit1664: drop casts, expand masks to full values [221]
@ -378,9 +403,13 @@ This release includes the following bugfixes:
o vauth/digest: improve the digest parser [203]
o version: add GSS backend name and version [353]
o vquic: fix idle-timeout checks (ms<-->ns), 64-bit log & honor 0=no-timeout [249]
o vquic: fix recvmsg loop for max_pkts [421]
o vquic: handling of io improvements [239]
o vquic: sending non-gso packets fix for EAGAIN [265]
o vtls: alpn setting, check proto parameter [134]
o vtls: drop duplicate `CURL_SHA256_DIGEST_LENGTH` definition [387]
o vtls: remove call to PKCS12_PBE_add() [408]
o vtls: unify the error handling in ssl_cf_connect(). [413]
o vtls_int.h: clarify data_pending [124]
o vtls_scache: fix race condition [157]
o windows: replace _beginthreadex() with CreateThread() [80]
@ -419,21 +448,22 @@ Planned upcoming removals include:
This release would not have looked like this without help, code, reports and
advice from friends like these:
Adam Light, Alice Lee Poetics, Andrei Kurushin, Andrew Kirillov,
Andrew Olsen, BobodevMm on github, Christian Schmitz, curl.stunt430,
Dan Fandrich, Daniel Stenberg, Daniel Terhorst-North, dependabot[bot],
divinity76 on github, Emilio Pozuelo Monfort, Emre Çalışkan, Ethan Everett,
Evgeny Grin (Karlson2k), fds242 on github, Harry Sintonen, Howard Chu,
Ignat Loskutov, Jakub Stasiak, James Fuller, Javier Blazquez, Jicea,
jmaggard10 on github, Jochen Sprickerhof, Johannes Schindelin,
Adam Light, Alexander Blach, Alice Lee Poetics, Andrei Kurushin,
Andrew Kirillov, Andrew Olsen, BobodevMm on github, Christian Schmitz,
curl.stunt430, Dalei, Dan Fandrich, Daniel Stenberg, Daniel Terhorst-North,
dependabot[bot], divinity76 on github, Emilio Pozuelo Monfort, Emre Çalışkan,
Ethan Everett, Evgeny Grin (Karlson2k), fds242 on github, Harry Sintonen,
Howard Chu, Ignat Loskutov, Jakub Stasiak, James Fuller, Javier Blazquez,
Jicea, jmaggard10 on github, Jochen Sprickerhof, Johannes Schindelin,
Jonathan Cardoso Machado, Joseph Birr-Pixton, Joshua Rogers,
kapsiR on github, kuchara on github, Marcel Raad, Michael Osipov,
Michał Petryka, Mitchell Blank Jr, Mohamed Daahir, Nir Azkiel,
Patrick Monnerat, plv1313 on github, Pocs Norbert, Ray Satiro, renovate[bot],
rinsuki on github, Sakthi SK, Samuel Dionne-Riel, Samuel Henrique,
Stanislav Fort, Stefan Eissing, Tatsuhiro Tsujikawa, tkzv on github,
Viktor Szakats, WangDaLei on github, Xiaoke Wang, Yedaya Katsman, 包布丁
(57 contributors)
kapsiR on github, kuchara on github, madoe on github, Marcel Raad,
Michael Osipov, Michał Petryka, Mitchell Blank Jr, Mohamed Daahir,
Nir Azkiel, Patrick Monnerat, Pavel P, plv1313 on github, Pocs Norbert,
Ray Satiro, renovate[bot], rinsuki on github, Sakthi SK, Samuel Dionne-Riel,
Samuel Henrique, Stanislav Fort, Stefan Eissing, Tatsuhiro Tsujikawa,
Theo Buehler, Tim Becker, tkzv on github, Viktor Szakats,
WangDaLei on github, Xiaoke Wang, Yedaya Katsman, 包布丁
(63 contributors)
References to bug reports and discussions on issues:
@ -769,6 +799,7 @@ References to bug reports and discussions on issues:
[330] = https://curl.se/bug/?i=19101
[331] = https://curl.se/bug/?i=19046
[332] = https://curl.se/bug/?i=19102
[333] = https://curl.se/bug/?i=19205
[334] = https://curl.se/bug/?i=19100
[335] = https://curl.se/bug/?i=19125
[336] = https://curl.se/bug/?i=19145
@ -814,9 +845,37 @@ References to bug reports and discussions on issues:
[379] = https://curl.se/bug/?i=19163
[380] = https://curl.se/bug/?i=19168
[382] = https://curl.se/bug/?i=19170
[383] = https://curl.se/bug/?i=19226
[384] = https://curl.se/bug/?i=19225
[385] = https://curl.se/bug/?i=19222
[386] = https://curl.se/bug/?i=19018
[387] = https://curl.se/bug/?i=19224
[388] = https://curl.se/bug/?i=19161
[389] = https://curl.se/bug/?i=19160
[390] = https://curl.se/bug/?i=19137
[391] = https://curl.se/bug/?i=19223
[393] = https://curl.se/bug/?i=19130
[394] = https://curl.se/bug/?i=19153
[399] = https://curl.se/bug/?i=19206
[400] = https://curl.se/bug/?i=19208
[402] = https://curl.se/bug/?i=19211
[403] = https://curl.se/bug/?i=19213
[404] = https://curl.se/bug/?i=18991
[406] = https://curl.se/bug/?i=19202
[407] = https://curl.se/bug/?i=19200
[408] = https://curl.se/bug/?i=19201
[409] = https://curl.se/bug/?i=19199
[410] = https://curl.se/bug/?i=18798
[411] = https://curl.se/bug/?i=19165
[412] = https://curl.se/bug/?i=19198
[413] = https://curl.se/bug/?i=19196
[414] = https://curl.se/bug/?i=19195
[415] = https://issues.oss-fuzz.com/issues/435278402
[416] = https://curl.se/bug/?i=19194
[417] = https://curl.se/bug/?i=19192
[418] = https://curl.se/bug/?i=19191
[419] = https://curl.se/bug/?i=19190
[420] = https://curl.se/bug/?i=19188
[421] = https://curl.se/bug/?i=19186
[422] = https://curl.se/bug/?i=19187
[423] = https://curl.se/bug/?i=19185