include: mask computed auth/proto bitmasks to 32 bits

GCC 15.2 warns when assigning computed "all" bitmask macros to 32-bit flag types because negated masks expand to the full width of unsigned long/long on 64-bit platforms. Mask these macros to a 32-bit domain so they do not set high bits and avoid -Woverflow/-Wconversion warnings in callers. Reported-by: Patrick Monnerat Fixes #20242 Closes #20416
tool: rename curl handle and result variable in --libcurl-generated code
2026-08-25 09:33:36 +03:00 · 2026-01-26 13:48:05 +01:00 · 2026-01-26 13:21:46 +01:00 · 2026-01-26 12:53:03 +01:00 · 2026-01-26 12:47:02 +01:00 · 2026-01-26 12:28:25 +01:00
42 changed files with 587 additions and 410 deletions
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@ -13,12 +13,7 @@ body:

        Only file bugs here! Ask questions on the mailing lists https://curl.se/mail/

-        **SECURITY RELATED?** Post it here: https://hackerone.com/curl
-
-        There are collections of known issues to be aware of:
-
-        - https://curl.se/docs/knownbugs.html
-        - https://curl.se/docs/todo.html
+        **SECURITY RELATED?** Submit here: https://github.com/curl/curl/security/advisories

  - type: textarea
    id: reproducer
@ -40,7 +35,7 @@ body:
      label: curl/libcurl version
      description: |
        Please paste the output of `curl -V` here.
-      placeholder: 'curl 8.2.0'
+      placeholder: 'curl 8.18.0'
    validations:
      required: true

--- a/.github/workflows/http3-linux.yml
+++ b/.github/workflows/http3-linux.yml
@ -269,8 +269,8 @@ jobs:
          git clone --quiet --depth 1 -b "v${WOLFSSL_VERSION}-stable" https://github.com/wolfSSL/wolfssl
          cd wolfssl
          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-all --enable-quic \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix="$PWD"/build
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-all --enable-quic \
+            --disable-benchmark --disable-crypttests --disable-examples
          make
          make install

@ -294,13 +294,14 @@ jobs:
          git clone --quiet --depth 1 -b "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2
          cd ngtcp2
          autoreconf -fi
-          ./configure --disable-dependency-tracking --prefix="$PWD"/build \
-            PKG_CONFIG_PATH=/home/runner/libressl/build/lib/pkgconfig --enable-lib-only --with-openssl
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            PKG_CONFIG_PATH=/home/runner/libressl/build/lib/pkgconfig \
+            --with-openssl
          make install
          make clean
-          ./configure --disable-dependency-tracking --prefix="$PWD"/build \
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
            PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig:/home/runner/nettle/build/lib64/pkgconfig:/home/runner/gnutls/build/lib/pkgconfig:/home/runner/wolfssl/build/lib/pkgconfig \
-            --enable-lib-only --with-openssl --with-gnutls --with-wolfssl --with-boringssl \
+            --with-openssl --with-gnutls --with-wolfssl --with-boringssl \
            BORINGSSL_LIBS='-L/home/runner/awslc/build/lib -lssl -lcrypto' \
            BORINGSSL_CFLAGS='-I/home/runner/awslc/build/include'
          make install
@ -312,8 +313,8 @@ jobs:
          git clone --quiet --depth 1 -b "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-boringssl
          cd ngtcp2-boringssl
          autoreconf -fi
-          ./configure --disable-dependency-tracking --prefix="$PWD"/build \
-            --enable-lib-only --with-openssl=no --with-boringssl \
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            --with-openssl=no --with-boringssl \
            BORINGSSL_LIBS='-L/home/runner/boringssl/build/lib -lssl -lcrypto' \
            BORINGSSL_CFLAGS='-I/home/runner/boringssl/build/include'
          make install
@ -328,11 +329,10 @@ jobs:
          autoreconf -fi
          # required (for nghttpx application): libc-ares-dev libev-dev zlib1g-dev
          # optional (for nghttpx application): libbrotli-dev
-          ./configure --disable-dependency-tracking --prefix="$PWD"/build \
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-app --enable-http3 \
            PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig \
            LDFLAGS=-Wl,-rpath,/home/runner/openssl/build/lib \
-            --with-libbrotlienc --with-libbrotlidec \
-            --enable-app --enable-http3
+            --with-libbrotlienc --with-libbrotlidec
          make install

  linux:
@ -644,9 +644,9 @@ jobs:
              ${MATRIX_GENERATE}
          else
            mkdir bld && cd bld && ../configure --enable-warnings --enable-werror --enable-debug --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
              --with-libuv \
              --with-test-nghttpx=/home/runner/nghttp2/build/bin/nghttpx \
-              --disable-dependency-tracking --enable-option-checking=fatal \
              ${MATRIX_CONFIGURE}
          fi

--- a/.github/workflows/linux-old.yml
+++ b/.github/workflows/linux-old.yml
@ -158,9 +158,9 @@ jobs:
        run: |
          mkdir bld-am
          cd bld-am
-          ../configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-warnings --enable-werror --disable-shared \
-            --without-ssl --enable-ares --without-libssh2 --with-zstd --with-gssapi --with-librtmp \
-            --prefix="$PWD"/../curl-install-am
+          ../configure --prefix="$PWD"/../curl-install-am --enable-unity --enable-warnings --enable-werror --disable-shared \
+            --disable-dependency-tracking --enable-option-checking=fatal \
+            --without-ssl --enable-ares --without-libssh2 --with-zstd --with-gssapi --with-librtmp

      - name: 'AM configure log'
        if: ${{ !cancelled() }}
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@ -538,8 +538,8 @@ jobs:
            --location "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" | tar -xz
          cd "wolfssl-${WOLFSSL_VERSION}-stable"
          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-tls13 --enable-harden --enable-all \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=/home/runner/wolfssl-all
+          ./configure --disable-dependency-tracking --prefix=/home/runner/wolfssl-all --enable-tls13 --enable-harden --enable-all \
+            --disable-benchmark --disable-crypttests --disable-examples
          make install

      - name: 'cache wolfssl (opensslextra-intel)'  # does support `OPENSSL_COEXIST`
@ -559,8 +559,8 @@ jobs:
            --location "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" | tar -xz
          cd "wolfssl-${WOLFSSL_VERSION}-stable"
          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-tls13 --enable-harden --enable-ech --enable-opensslextra \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=/home/runner/wolfssl-opensslextra
+          ./configure --disable-dependency-tracking --prefix=/home/runner/wolfssl-opensslextra --enable-tls13 --enable-harden --enable-ech --enable-opensslextra \
+            --disable-benchmark --disable-crypttests --disable-examples
          make install

      - name: 'cache wolfssl (opensslextra-arm)'  # does support `OPENSSL_COEXIST`
@ -580,8 +580,8 @@ jobs:
            --location "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" | tar -xz
          cd "wolfssl-${WOLFSSL_VERSION}-stable"
          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-tls13 --enable-harden --enable-ech --enable-opensslextra \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=/home/runner/wolfssl-opensslextra
+          ./configure --disable-dependency-tracking --prefix=/home/runner/wolfssl-opensslextra --enable-tls13 --enable-harden --enable-ech --enable-opensslextra \
+            --disable-benchmark --disable-crypttests --disable-examples
          make install

      - name: 'cache mbedtls (latest-intel)'
@ -669,7 +669,7 @@ jobs:
          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
            --location "https://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-${OPENLDAP_VERSION}.tgz" | tar -xz
          cd "openldap-${OPENLDAP_VERSION}"
-          ./configure --enable-static --disable-shared --disable-slapd --prefix=/home/runner/openldap-static
+          ./configure --prefix=/home/runner/openldap-static --enable-static --disable-shared --disable-slapd
          make install

      - name: 'cache openssl (thread sanitizer)'
--- a/.github/workflows/non-native.yml
+++ b/.github/workflows/non-native.yml
@ -186,11 +186,10 @@ jobs:
                options='--disable-manual --disable-docs'  # Slow with autotools, skip on emulated CPU
              fi
              mkdir bld && cd bld
-              time ../configure --enable-unity --enable-debug --enable-warnings --enable-werror --disable-static \
-                --prefix="$HOME"/curl-install \
+              time ../configure --prefix="$HOME"/curl-install --enable-unity --enable-debug --enable-warnings --enable-werror --disable-static \
+                --disable-dependency-tracking --enable-option-checking=fatal \
                --with-openssl \
                --with-brotli --enable-ldap --enable-ldaps --with-libidn2 --with-libssh2 --with-nghttp2 --with-gssapi \
-                --disable-dependency-tracking --enable-option-checking=fatal \
                ${options} \
                ${MATRIX_OPTIONS} \
                || { tail -n 1000 config.log; false; }
@ -283,7 +282,8 @@ jobs:
              ${MATRIX_OPTIONS}
          else
            TOOLCHAIN="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64"
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-warnings --enable-werror --disable-shared \
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-shared \
+              --disable-dependency-tracking --enable-option-checking=fatal \
              CC="$TOOLCHAIN/bin/aarch64-linux-android${MATRIX_PLATFORM}-clang" \
              AR="$TOOLCHAIN/bin/llvm-ar" \
              RANLIB="$TOOLCHAIN/bin/llvm-ranlib" \
@ -388,7 +388,8 @@ jobs:
              -DWATT_ROOT="$HOME/djgpp/net/watt"
          else
            autoreconf -fi
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-warnings --enable-werror --disable-shared \
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-shared \
+              --disable-dependency-tracking --enable-option-checking=fatal \
              CC="$HOME/djgpp/bin/i586-pc-msdosdjgpp-gcc" \
              AR="$HOME/djgpp/bin/i586-pc-msdosdjgpp-ar" \
              RANLIB="$HOME/djgpp/bin/i586-pc-msdosdjgpp-ranlib" \
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@ -98,10 +98,9 @@ jobs:
              -DCURL_WERROR=ON \
              ${MATRIX_CONFIG}
          else
-            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-static \
-              --prefix="$HOME"/curl-install \
-              --with-libssh2 \
+            mkdir bld && cd bld && ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libssh2 \
              ${MATRIX_CONFIG}
          fi

@ -312,10 +311,9 @@ jobs:
            fi
          else
            export CFLAGS CPPFLAGS
-            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-static \
-              --prefix="$HOME"/curl-install \
-              --with-libssh2 \
+            mkdir bld && cd bld && ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libssh2 \
              ${MATRIX_CONFIG}
          fi

@ -668,10 +666,10 @@ jobs:
              ${options}
          else
            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
              --host="${TRIPLET}" \
              --with-schannel --with-winidn \
-              --without-libpsl \
-              --disable-dependency-tracking --enable-option-checking=fatal
+              --without-libpsl
          fi

      - name: 'configure log'
--- a/8
+++ b/8
@ -33,18 +33,18 @@ WEBSITE

  Visit the curl website for the latest news and downloads:

-        https://curl.se/
+  https://curl.se/

 GIT

  To download the latest source code off the GIT server, do this:

-    git clone https://github.com/curl/curl
+  git clone https://github.com/curl/curl

  (you will get a directory named curl created, filled with the source code)

 SECURITY PROBLEMS

-  Report suspected security problems via our HackerOne page and not in public.
+  Report suspected security problems privately and not in public.

-    https://hackerone.com/curl
+  https://curl.se/dev/vuln-disclosure.html
--- a/README.md
+++ b/README.md
@ -54,8 +54,8 @@ Download the latest source from the Git server:

 ## Security problems

-Report suspected security problems via [our HackerOne
-page](https://hackerone.com/curl) and not in public.
+Report suspected security problems
+[privately](https://curl.se/dev/vuln-disclosure.html) and not in public.

 ## Backers

--- a/62
+++ b/62
@ -4,10 +4,12 @@ curl and libcurl 8.19.0
 Command line options:         273
 curl_easy_setopt() options:   308
 Public functions in libcurl:  100
- Contributors:                 3582
+ Contributors:                 3587

 This release includes the following changes:

+ o BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026 [23]
+ o cmake: add `CURL_BUILD_EVERYTHING` option [51]
 o mqtt: initial support for MQTTS [81]
 o tool: support fractions for --limit-rate and --max-filesize [79]
 o vquic: drop support for OpenSSL-QUIC [80]
@ -17,17 +19,27 @@ This release includes the following changes:
 This release includes the following bugfixes:

 o altsvc: only accept 17 byte dates from files [22]
+ o asyn-ares: abort with OOM error when Curl_dnscache_mk_entry fails [107]
+ o build: constify `memchr()`/`strchr()`/etc result variables (cont.) [85]
 o build: detect and include `inttypes.h` again [13]
 o build: drop duplicate C includes [54]
 o build: drop global suppression of `-Wformat-nonliteral`, fix fallouts [19]
+ o build: fully omit verbose strings and code when disabled [113]
 o build: globally suppress DJGPP warnings in `FD_SET()` [56]
 o build: merge TrackMemory (`CURLDEBUG`) into debug-enabled option [46]
+ o build: opt-in MSVC to C99-style verbose logging logic [108]
 o checksrc: do not apply `BANNEDFUNC` to struct member functions [35]
 o checksrc: warn for leading spaces before the preprocessor hash [72]
+ o cmake: add `CURL_DROP_UNUSED` option to reduce binary sizes [105]
+ o cmake: always define `CURL::win32_winsock` on Windows in `curl-config.cmake` [104]
+ o cmake: enable binutils ld workaround for all toolchains at build-time [57]
+ o cmake: fix logic for openssl/zlib binutils ld workaround [71]
 o cmake: reference OpenSSL and ZLIB imported targets only when enabled [41]
 o cmake: silence silly Apple clang warnings in C89 mode, test in CI [14]
 o cmake: silence useless compiler warnings triggered by the FASTBuild generator [43]
+ o cmke: add `*_USE_STATIC_LIBS` options for 9 dependencies [49]
 o config-plan9: set `HAVE_STDINT_H` again [17]
+ o config2setopts: acknowledge OOM error from CURLOPT_MIMEPOST [120]
 o config2setopts: fix for --disable-aws build configuration [34]
 o curl: limit Windows-specific code to Windows builds, other tidy-ups [48]
 o curl_easy_nextheader.md: a new transfer invalidates 'prev' [69]
@ -65,15 +77,24 @@ This release includes the following bugfixes:
 o mprintf: drop old sprintf fallback [7]
 o mqtt: better too-big-message-check [73]
 o msvc: drop exception, make `BIT()` a bitfield with Visual Studio [2]
+ o multi: probe for IPv6 functionality in multi_init() [114]
 o ngtcp2: stabilize recv [18]
+ o noproxy: simplify, don't mix const non-const in strchr() [88]
 o openldap: avoid forward declarations in ldaps code [62]
 o plan9: drop special build and orphaned references [33]
 o ratelimit: download finetune [16]
 o REUSE: drop broken reference to `MAIL-ETIQUETTE` [59]
+ o runtests: pass config filename to stunnel in native format (Windows) [94]
+ o setopt: fix checking range for CURLOPT_MAXCONNECTS [92]
 o sigpipe: unset SA_SIGINFO since it is using sa_handler [40]
+ o socket: check result of SO_NOSIGPIPE [124]
+ o socketpair: set SO_NOSIGPIPE where possible [103]
 o tftp: correct the filename length check [70]
+ o timeout handling: auto-detect effective timeout [121]
 o tls: add new SSLSUPP flags for several options [32]
+ o tool: enable header separation for HTTPS proxies [106]
 o tool: improve error/warning messages when output filename sanitization fails [36]
+ o tool: return code variable consistency [84]
 o tool_cb_hdr: suppress header output when --out-null [10]
 o tool_dirhie: drop superfluous `F_OK` fallback (Windows) [8]
 o tool_doswin: document `ENABLE_VIRTUAL_TERMINAL_PROCESSING` toolchain support [44]
@ -84,6 +105,8 @@ This release includes the following bugfixes:
 o urldata: change 'keep_post' into three distinct bitfields [21]
 o urldata: convert 'long' fields to fixed variable types [47]
 o urldata: switch to uint* types [1]
+ o verbose.md: explain the { and } prefixes [96]
+ o winapi: use FormatMessageA instead of FormatMessageW [115]
 o wolfssl: fix build without USE_BIO_CHAIN [27]

 This release includes the following known bugs:
@ -105,13 +128,15 @@ Planned upcoming removals include:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:

-  Andrew Kvalheim, Arnav-Purushotam-CUBoulder, calm329, Dag Haavi Finstad,
-  Daniel Gustafsson, Daniel Stenberg, dependabot[bot], Frank Buss,
-  gudyuu on hackerone, James Fuller, Joshua Vandaële, Maksim Ściepanienka,
+  Andrew Kvalheim, Arnav Purushotam, Arnav-Purushotam-CUBoulder, calm329,
+  Dag Haavi Finstad, Dan Fandrich, Daniel Gustafsson, Daniel Stenberg,
+  dEajL3kA, dependabot[bot], Frank Buss, gudyuu on hackerone, Jacek Migacz,
+  James Fuller, Joshua Vandaële, Kai Pastor, Maksim Ściepanienka,
  Megamouse on github, Michał Antoniak, Patrick Monnerat, Ray Satiro,
-  renovate[bot], Sascha Frinken, Stefan Eissing, Tomáš Malý, tommy,
-  Viktor Szakats, z2_, Йоте
-  (24 contributors)
+  renovate[bot], Rudi Heitbaum, Sascha Frinken, Stefan Eissing,
+  Thibault de Villèle, Tomáš Malý, tommy, Viktor Szakats, Wyuer on github, z2_,
+  Йоте
+  (32 contributors)

 References to bug reports and discussions on issues:

@ -136,6 +161,7 @@ References to bug reports and discussions on issues:
 [20] = https://curl.se/bug/?i=20260
 [21] = https://curl.se/bug/?i=20262
 [22] = https://curl.se/bug/?i=20259
+ [23] = https://curl.se/bug/?i=20312
 [24] = https://curl.se/bug/?i=20334
 [25] = https://curl.se/bug/?i=20333
 [27] = https://curl.se/bug/?i=20250
@ -160,12 +186,15 @@ References to bug reports and discussions on issues:
 [46] = https://curl.se/bug/?i=20331
 [47] = https://curl.se/bug/?i=20227
 [48] = https://curl.se/bug/?i=20213
+ [49] = https://curl.se/bug/?i=20015
 [50] = https://curl.se/bug/?i=20295
+ [51] = https://curl.se/bug/?i=20429
 [52] = https://curl.se/bug/?i=20326
 [53] = https://curl.se/bug/?i=20350
 [54] = https://curl.se/bug/?i=20303
 [55] = https://curl.se/bug/?i=20302
 [56] = https://curl.se/bug/?i=20299
+ [57] = https://curl.se/bug/?i=20382
 [58] = https://curl.se/bug/?i=20298
 [59] = https://curl.se/bug/?i=20348
 [60] = https://curl.se/bug/?i=20296
@ -179,6 +208,7 @@ References to bug reports and discussions on issues:
 [68] = https://curl.se/bug/?i=20346
 [69] = https://curl.se/bug/?i=20285
 [70] = https://hackerone.com/reports/3508321
+ [71] = https://curl.se/bug/?i=20382
 [72] = https://curl.se/bug/?i=20282
 [73] = https://hackerone.com/reports/3508500
 [74] = https://curl.se/bug/?i=20344
@ -189,3 +219,21 @@ References to bug reports and discussions on issues:
 [80] = https://curl.se/bug/?i=20226
 [81] = https://curl.se/bug/?i=19418
 [82] = https://curl.se/bug/?i=18279
+ [84] = https://curl.se/bug/?i=20426
+ [85] = https://curl.se/bug/?i=20420
+ [88] = https://curl.se/bug/?i=20425
+ [92] = https://curl.se/bug/?i=20414
+ [94] = https://curl.se/bug/?i=20413
+ [96] = https://curl.se/bug/?i=20386
+ [103] = https://curl.se/bug/?i=20397
+ [104] = https://curl.se/bug/?i=20382
+ [105] = https://curl.se/bug/?i=20357
+ [106] = https://curl.se/bug/?i=20398
+ [107] = https://curl.se/bug/?i=20385
+ [108] = https://curl.se/bug/?i=20387
+ [113] = https://curl.se/bug/?i=20341
+ [114] = https://curl.se/bug/?i=20383
+ [115] = https://curl.se/bug/?i=20261
+ [120] = https://curl.se/bug/?i=20375
+ [121] = https://curl.se/bug/?i=20347
+ [124] = https://curl.se/bug/?i=20370
--- a/SECURITY.md
+++ b/SECURITY.md
@ -11,18 +11,19 @@ Read our [Vulnerability Disclosure Policy](docs/VULN-DISCLOSURE-POLICY.md).
 ## Reporting a Vulnerability

 If you have found or just suspect a security problem somewhere in curl or
-libcurl, report it on [HackerOne](https://hackerone.com/curl).
+libcurl, [report it](https://curl.se/dev/vuln-disclosure.html)!

-We treat security issues with confidentiality until controlled and disclosed responsibly.
+We treat security issues with confidentiality until controlled and disclosed
+responsibly.

 ## OpenSSF Best Practices

 curl has achieved Gold status on the Open Source Security Foundation (OpenSSF)
 [Best Practices](https://bestpractices.dev/) (formerly Core Infrastructure
-Initiative Best Practices), reflecting its adherence to rigorous
-security and best practice standards. This achievement highlights curl's
-comprehensive documentation, secure development processes, effective change
-control mechanisms, and strong maintenance routines. Meeting these criteria
+Initiative Best Practices), reflecting its adherence to rigorous security and
+best practice standards. This achievement highlights curl's comprehensive
+documentation, secure development processes, effective change control
+mechanisms, and strong maintenance routines. Meeting these criteria
 demonstrates curl's commitment to security and reliability, ensuring the
 project's sustainability and trustworthiness. This underscores curl's role as
 a leader in open-source software practices. More information can be found on
--- a/docs/BUG-BOUNTY.md
+++ b/docs/BUG-BOUNTY.md
@ -6,88 +6,13 @@ SPDX-License-Identifier: curl

 # The curl bug bounty

-The curl project runs a bug bounty program in association with
-[HackerOne](https://www.hackerone.com/) and the [Internet Bug
-Bounty](https://internetbugbounty.org/).
+Up until the end of January 2026 there was a curl bug bounty. It is no more.

-## How does it work?
+The curl project does not offer any rewards for reported bugs or
+vulnerabilities. We also do not aid security researchers to get such rewards
+for curl problems from other sources either.

-Start out by posting your suspected security vulnerability directly to [curl's
-HackerOne program](https://hackerone.com/curl).
+A bug bounty gives people too strong incentives to find and make up "problems"
+in bad faith that cause overload and abuse.

-After you have reported a security issue, it has been deemed credible, and a
-patch and advisory has been made public, you may be eligible for a bounty from
-this program. See the [Security Process](https://curl.se/dev/secprocess.html)
-document for how we work with security issues.
-
-## What are the reward amounts?
-
-The curl project offers monetary compensation for reported and published
-security vulnerabilities. The amount of money that is rewarded depends on how
-serious the flaw is determined to be.
-
-Since 2021, the Bug Bounty is managed in association with the Internet Bug
-Bounty and they set the reward amounts. If it would turn out that they set
-amounts that are way lower than we can accept, the curl project intends to
-"top up" rewards.
-
-In 2025, typical "Medium" rated vulnerabilities are rewarded 2,500 USD each.
-
-## Who is eligible for a reward?
-
-Everyone and anyone who reports a security problem in a released curl version
-that has not already been reported can ask for a bounty.
-
-Dedicated - paid for - security audits that are performed in collaboration
-with curl developers are not eligible for bounties.
-
-Vulnerabilities in features that are off by default and documented as
-experimental are not eligible for a reward.
-
-The vulnerability has to be fixed and publicly announced (by the curl project)
-before a bug bounty is considered.
-
-Once the vulnerability has been published by curl, the researcher can request
-their bounty from the [Internet Bug Bounty](https://hackerone.com/ibb).
-
-Bounties need to be requested within twelve months from the publication of the
-vulnerability.
-
-The curl security team reserves themselves the right to deny or allow bug
-bounty payouts on its own discretion. There is no appeals process.
-
-## Product vulnerabilities only
-
-This bug bounty only concerns the curl and libcurl products and thus their
-respective source codes - when running on existing hardware. It does not
-include curl documentation, curl websites, or other curl related
-infrastructure.
-
-The curl security team is the sole arbiter if a reported flaw is subject to a
-bounty or not.
-
-## Third parties
-
-The curl bug bounty does not cover flaws in third party dependencies
-(libraries) used by curl or libcurl. If the bug triggers because of curl
-behaving wrongly or abusing a third party dependency, the problem is rather in
-curl and not in the dependency and then the bounty might cover the problem.
-
-## How are vulnerabilities graded?
-
-The grading of each reported vulnerability that makes a reward claim is
-performed by the curl security team. The grading is based on the CVSS (Common
-Vulnerability Scoring System) 3.0.
-
-## How are reward amounts determined?
-
-The curl security team gives the vulnerability a score or severity level, as
-mentioned above. The actual monetary reward amount is decided and paid by the
-Internet Bug Bounty..
-
-## Regarding taxes, etc. on the bounties
-
-In the event that the individual receiving a bug bounty needs to pay taxes on
-the reward money, the responsibility lies with the receiver. The curl project
-or its security team never actually receive any of this money, hold the money,
-or pay out the money.
+We still appreciate and value valid vulnerability reports.
--- a/docs/BUGS.md
+++ b/docs/BUGS.md
@ -36,13 +36,11 @@ vulnerable if the bug becomes public knowledge, then please report that bug
 using our security development process.

 Security related bugs or bugs that are suspected to have a security impact,
-should be reported on the
-[curl security tracker at HackerOne](https://hackerone.com/curl).
+should be reported [privately](https://curl.se/dev/vuln-disclosure.html).

-This ensures that the report reaches the curl security team so that they
-first can deal with the report away from the public to minimize the harm and
-impact it has on existing users out there who might be using the vulnerable
-versions.
+This ensures that the report reaches the curl security team so that they first
+can deal with the report away from the public to minimize the harm and impact
+it has on existing users out there who might be using the vulnerable versions.

 The curl project's process for handling security related issues is
 [documented separately](https://curl.se/dev/secprocess.html).
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@ -169,7 +169,7 @@ the web based archives of the mailing lists), thus saving us from having to
 repeat ourselves even more. Thanks for respecting this.

 If you have found or simply suspect a security problem in curl or libcurl,
-submit all the details at [HackerOne](https://hackerone.com/curl). On there we
+[submit all the details to us](https://curl.se/dev/vuln-disclosure.html). We
 keep the issue private while we investigate, confirm it, work and validate a
 fix and agree on a time schedule for publication etc. That way we produce a
 fix in a timely manner before the flaw is announced to the world, reducing the
--- a/docs/GOVERNANCE.md
+++ b/docs/GOVERNANCE.md
@ -46,9 +46,8 @@ the project.

 Donating plain money to curl is best done to curl's [Open Collective
 fund](https://opencollective.com/curl). Open Collective is a US based
-non-profit organization that holds on to funds for us. This fund is then used
-for paying the curl security bug bounties, to reimburse project related
-expenses etc.
+non-profit organization that holds on to funds for us. This fund is used to
+reimburse and pay for project related expenses etc.

 Donations to the project can also come in the form of server hosting, providing
 services and paying for people to work on curl related code etc. Usually, such
--- a/docs/INFRASTRUCTURE.md
+++ b/docs/INFRASTRUCTURE.md
@ -172,14 +172,6 @@ instances used for this.
 We use a few rare additional curl related email aliases in the curl domains.
 They go through the mail server `mail.haxx.se` maintained by Daniel Stenberg

-## Bug-bounty
-
-We run a [bug-bounty](https://curl.se/docs/bugbounty.html) on HackerOne. The
-setup runs entirely at https://hackerone.com/curl.
-
-The money part for the bug bounty is sponsored by the [Internet Bug
-Bounty](https://hackerone.com/ibb).
-
 ## Open Collective

 We use [Open Collective](https://opencollective.com/curl) as our "fiscal
--- a/docs/RELEASE-PROCEDURE.md
+++ b/docs/RELEASE-PROCEDURE.md
@ -125,11 +125,11 @@ push for it.

 Based on the description above, here are some planned future release dates:

- September 10, 2025
- November 5, 2025
- January 7, 2026
- March 4, 2026
+- March 11, 2026
 - April 29, 2026
 - June 24, 2026
 - August 19, 2026
 - October 14, 2026
+- December 9, 2026
+- February 3, 2027
+- March 31, 2027
--- a/docs/SPONSORS.md
+++ b/docs/SPONSORS.md
@ -17,8 +17,8 @@ two to spend work hours on curl related tasks.

 We promise to use donated funds for things and activities that we believe are
 beneficial for the project and its development. That includes but is not
-limited to bug-bounties, developer conferences, infrastructure, development,
-services and hardware.
+limited to developer conferences, infrastructure, development, services and
+hardware.

 Recurring donations above a certain amount of money puts the sponsor at a
 named sponsor level: **Silver**, **Gold**, **Platinum** or **Top**.
--- a/docs/TODO.md
+++ b/docs/TODO.md
@ -819,25 +819,6 @@ already transferred before the retry.

 See [curl issue 1084](https://github.com/curl/curl/issues/1084)

-## consider filename from the redirected URL with `-O` ?
-
-When a user gives a URL and uses `-O`, and curl follows a redirect to a new
-URL, the filename is not extracted and used from the newly redirected-to URL
-even if the new URL may have a much more sensible filename.
-
-This is clearly documented and helps for security since there is no surprise
-to users which filename that might get overwritten, but maybe a new option
-could allow for this or maybe `-J` should imply such a treatment as well as
-`-J` already allows for the server to decide what filename to use so it
-already provides the "may overwrite any file" risk.
-
-This is extra tricky if the original URL has no filename part at all since
-then the current code path does error out with an error message, and we cannot
-*know* already at that point if curl is redirected to a URL that has a
-filename...
-
-See [curl issue 1241](https://github.com/curl/curl/issues/1241)
-
 ## retry on network is unreachable

 The `--retry` option retries transfers on *transient failures*. We later added
--- a/docs/VULN-DISCLOSURE-POLICY.md
+++ b/docs/VULN-DISCLOSURE-POLICY.md
@ -29,9 +29,11 @@ mailing lists. Messages associated with any commits should not make any
 reference to the security nature of the commit if done prior to the public
 announcement.

- The person discovering the issue, the reporter, reports the vulnerability on
-  [HackerOne](https://hackerone.com/curl). Issues filed there reach a handful
-  of selected and trusted people.
+- The person discovering the issue, the reporter, reports the vulnerability to
+  the curl project. Do this [on
+  GitHub](https://github.com/curl/curl/security/advisories) or send an email
+  to `security at curl.se`. Such submissions reach a handful of selected and
+  trusted people.

 - Messages that do not relate to the reporting or managing of an undisclosed
  security vulnerability in curl or libcurl are ignored and no further action
@ -76,10 +78,6 @@ announcement.
  repository via a normal PR - but without mentioning it being a security
  vulnerability.

- The monetary reward part of the bug-bounty is managed by the Internet Bug
-  Bounty team and the reporter is asked to request the reward from them after
-  the issue has been completely handled and published by curl.
-
 - No more than seven days before release, inform
  [distros@openwall](https://oss-security.openwall.org/wiki/mailing-lists/distros)
  to prepare them about the upcoming public security vulnerability
@ -144,11 +142,6 @@ has been published.
 *All* reports submitted to the project, valid or not, should be disclosed and
 made public.

-## Bug Bounty
-
-See [BUG-BOUNTY](https://curl.se/docs/bugbounty.html) for details on the
-bug bounty program.
-
 # Severity levels

 The curl project's security team rates security problems using four severity
--- a/docs/cmdline-opts/remote-header-name.md
+++ b/docs/cmdline-opts/remote-header-name.md
@ -34,6 +34,9 @@ this option may provide you with rather unexpected filenames.
 This feature uses the name from the `filename` field, it does not yet support
 the `filename*` field (filenames with explicit character sets).

+Starting in 8.19.0, curl falls back and uses the filename extracted from the
+last redirect header if no `Content-Disposition:` header provides a filename.
+
 **WARNING**: Exercise judicious use of this option, especially on Windows. A
 rogue server could send you the name of a DLL or other file that could be
 loaded automatically by Windows or some third party software.
--- a/include/curl/curl.h
+++ b/include/curl/curl.h
@ -842,10 +842,13 @@ typedef enum {
 #define CURLAUTH_BEARER       (((unsigned long)1) << 6)
 #define CURLAUTH_AWS_SIGV4    (((unsigned long)1) << 7)
 #define CURLAUTH_ONLY         (((unsigned long)1) << 31)
-#define CURLAUTH_ANY          (~CURLAUTH_DIGEST_IE)
-#define CURLAUTH_ANYSAFE      (~(CURLAUTH_BASIC | CURLAUTH_DIGEST_IE))
+#define CURLAUTH_ANY          ((~CURLAUTH_DIGEST_IE) & \
+                               ((unsigned long)0xffffffff))
+#define CURLAUTH_ANYSAFE      ((~(CURLAUTH_BASIC | CURLAUTH_DIGEST_IE)) & \
+                               ((unsigned long)0xffffffff))

-#define CURLSSH_AUTH_ANY       ~0L       /* all types supported by server */
+/* all types supported by server */
+#define CURLSSH_AUTH_ANY       ((unsigned long)0xffffffff)
 #define CURLSSH_AUTH_NONE      0L        /* none allowed, silly but complete */
 #define CURLSSH_AUTH_PUBLICKEY (1L << 0) /* public/private key files */
 #define CURLSSH_AUTH_PASSWORD  (1L << 1) /* password */
@ -1101,7 +1104,7 @@ typedef CURLSTScode (*curl_hstswrite_callback)(CURL *easy,
 #define CURLPROTO_MQTT    (1L << 28)
 #define CURLPROTO_GOPHERS (1L << 29)
 #define CURLPROTO_MQTTS   (1L << 30)
-#define CURLPROTO_ALL     (~0L) /* enable everything */
+#define CURLPROTO_ALL     ((unsigned long)0xffffffff) /* enable everything */

 /* long may be 32 or 64 bits, but we should never depend on anything else
   but 32 */
--- a/lib/setopt.c
+++ b/lib/setopt.c
@ -1194,7 +1194,7 @@ static CURLcode setopt_long_proto(struct Curl_easy *data, CURLoption option,
 #endif
 #ifdef USE_SSH
  case CURLOPT_SSH_AUTH_TYPES:
-    s->ssh_auth_types = (int)arg;
+    s->ssh_auth_types = (uint32_t)arg;
    break;
  case CURLOPT_NEW_DIRECTORY_PERMS:
    if((arg < 0) || (arg > 0777))
--- a/lib/urldata.h
+++ b/lib/urldata.h
@ -1389,7 +1389,7 @@ struct UserDefined {
 #ifdef USE_SSH
  curl_sshkeycallback ssh_keyfunc; /* key matching callback */
  void *ssh_keyfunc_userp;         /* custom pointer to callback */
-  int ssh_auth_types;    /* allowed SSH auth types */
+  uint32_t ssh_auth_types;   /* allowed SSH auth types */
  uint32_t new_directory_perms; /* when creating remote dirs */
 #endif
  uint32_t new_file_perms;      /* when creating remote files */
--- a/src/tool_cb_hdr.c
+++ b/src/tool_cb_hdr.c
@ -148,30 +148,40 @@ locdone:
 /*
 * Copies a filename part and returns an ALLOCATED data buffer.
 */
-static char *parse_filename(const char *ptr, size_t len)
+static char *parse_filename(const char *ptr, size_t len, char stop)
 {
  char *copy;
  char *p;
  char *q;
-  char stop = '\0';

  copy = memdup0(ptr, len);
  if(!copy)
    return NULL;

  p = copy;
-  if(*p == '\'' || *p == '"') {
-    /* store the starting quote */
-    stop = *p;
-    p++;
-  }
-  else
-    stop = ';';
+  if(stop) {
+    /* a Content-Disposition: header */
+    if(*p == '\'' || *p == '"') {
+      /* store the starting quote */
+      stop = *p;
+      p++;
+    }

-  /* scan for the end letter and stop there */
-  q = strchr(p, stop);
-  if(q)
-    *q = '\0';
+    /* scan for the end letter and stop there */
+    q = strchr(p, stop);
+    if(q)
+      *q = '\0';
+  }
+  else {
+    /* this is a Location: header, so we need to trim off any queries and
+       fragments present */
+    q = strchr(p, '?'); /* trim off query, if present */
+    if(q)
+      *q = '\0';
+    q = strchr(p, '#'); /* trim off fragment, if present */
+    if(q)
+      *q = '\0';
+  }

  /* if the filename contains a path, only use filename portion */
  q = strrchr(p, '/');
@ -283,12 +293,44 @@ static size_t save_etag(const char *etag_h, const char *endp,
 * Content-Disposition header specifying a filename property.
 */
 static size_t content_disposition(const char *str, const char *end,
-                                  size_t cb, struct per_transfer *per)
+                                  size_t cb, struct per_transfer *per,
+                                  long response) /* response code */
 {
  struct HdrCbData *hdrcbdata = &per->hdrcbdata;
  struct OutStruct *outs = &per->outs;

-  if((cb > 20) && checkprefix("Content-disposition:", str)) {
+  if((cb > 9) && checkprefix("Location:", str) && (response/100 == 3)) {
+    /* Get the name off the location header as a temporary measure in case
+       there is no Content-Disposition */
+    const char *p = &str[9];
+    curlx_str_passblanks(&p);
+    if(p < end) { /* as a precaution */
+      char *filename = parse_filename(p, cb - (p - str), 0);
+      if(filename) {
+        if(outs->stream) {
+          /* indication of problem, get out! */
+          curlx_free(filename);
+          return CURL_WRITEFUNC_ERROR;
+        }
+        if(outs->alloc_filename)
+          curlx_free(outs->filename);
+
+        if(per->config->output_dir) {
+          outs->filename = curl_maprintf("%s/%s", per->config->output_dir,
+                                         filename);
+          curlx_free(filename);
+          if(!outs->filename)
+            return CURL_WRITEFUNC_ERROR;
+        }
+        else
+          outs->filename = filename;
+        outs->alloc_filename = TRUE;
+        outs->is_cd_filename = TRUE; /* set to avoid clobbering existing files
+                                        by default */
+      }
+    }
+  }
+  else if((cb > 20) && checkprefix("Content-disposition:", str)) {
    const char *p = str + 20;
    /* look for the 'filename=' parameter (encoded filenames (*=) are not
       supported) */
@ -312,14 +354,17 @@ static size_t content_disposition(const char *str, const char *end,
      }
      p += 9;

+      curlx_str_passblanks(&p);
      len = cb - (size_t)(p - str);
-      filename = parse_filename(p, len);
+      filename = parse_filename(p, len, ';');
      if(filename) {
        if(outs->stream) {
          /* indication of problem, get out! */
          curlx_free(filename);
          return CURL_WRITEFUNC_ERROR;
        }
+        if(outs->alloc_filename)
+          curlx_free(outs->filename);

        if(per->config->output_dir) {
          outs->filename = curl_maprintf("%s/%s", per->config->output_dir,
@ -440,13 +485,13 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
        return rc;
    }

-    /* Parse the content-disposition header. When honor_cd_filename is true
-       other headers may be stored until the content-disposition header is
-       reached, at which point the saved headers can be written. That means
-       the content_disposition() may return an rc when it has saved a
-       different header for writing later. */
+    /* Parse the content-disposition and location headers. When
+       honor_cd_filename is true, other headers may be stored until the
+       content-disposition header is reached, at which point the saved headers
+       can be written. That means the content_disposition() may return an rc
+       when it has saved a different header for writing later. */
    else if(hdrcbdata->honor_cd_filename) {
-      size_t rc = content_disposition(str, end, cb, per);
+      size_t rc = content_disposition(str, end, cb, per, response);
      if(rc)
        return rc;
    }
--- a/src/tool_easysrc.c
+++ b/src/tool_easysrc.c
@ -50,8 +50,8 @@ static const char * const srchead[] = {
  "",
  "int main(int argc, char *argv[])",
  "{",
-  "  CURLcode ret;",
-  "  CURL *hnd;",
+  "  CURLcode result;",
+  "  CURL *curl;",
  NULL
 };
 /* easysrc_decl declarations come here */
@ -66,7 +66,7 @@ static const char * const srchard[] = {
 };
 static const char *const srcend[] = {
  "",
-  "  return (int)ret;",
+  "  return (int)result;",
  "}",
  "/**** End of sample code ****/",
  NULL
@ -121,7 +121,7 @@ CURLcode easysrc_addf(struct slist_wc **plist, const char *fmt, ...)

 CURLcode easysrc_init(void)
 {
-  return easysrc_add(&easysrc_code, "hnd = curl_easy_init();");
+  return easysrc_add(&easysrc_code, "curl = curl_easy_init();");
 }

 CURLcode easysrc_perform(void)
@ -152,7 +152,7 @@ CURLcode easysrc_perform(void)
  if(!result)
    result = easysrc_add(&easysrc_code, "");
  if(!result)
-    result = easysrc_add(&easysrc_code, "ret = curl_easy_perform(hnd);");
+    result = easysrc_add(&easysrc_code, "result = curl_easy_perform(curl);");
  if(!result)
    result = easysrc_add(&easysrc_code, "");

@ -161,9 +161,9 @@ CURLcode easysrc_perform(void)

 CURLcode easysrc_cleanup(void)
 {
-  CURLcode result = easysrc_add(&easysrc_code, "curl_easy_cleanup(hnd);");
+  CURLcode result = easysrc_add(&easysrc_code, "curl_easy_cleanup(curl);");
  if(!result)
-    result = easysrc_add(&easysrc_code, "hnd = NULL;");
+    result = easysrc_add(&easysrc_code, "curl = NULL;");

  return result;
 }
--- a/src/tool_sdecls.h
+++ b/src/tool_sdecls.h
@ -36,7 +36,8 @@
 * dynamically allocated and 'belongs' to this OutStruct, otherwise FALSE.
 *
 * 'is_cd_filename' member is TRUE when string pointed by 'filename' has been
- * set using a server-specified Content-Disposition filename, otherwise FALSE.
+ * set using a server-specified Content-Disposition or Location filename,
+ * otherwise FALSE.
 *
 * 'regular_file' member is TRUE when output goes to a regular file, this also
 * implies that output is 'seekable' and 'appendable' and also that member
--- a/src/tool_setopt.c
+++ b/src/tool_setopt.c
@ -253,12 +253,12 @@ CURLcode tool_setopt_enum(CURL *curl, const char *name, CURLoption tag,
      /* If no definition was found, output an explicit value.
       * This could happen if new values are defined and used
       * but the NameValue list is not updated. */
-      result = easysrc_addf(&easysrc_code, "curl_easy_setopt(hnd, %s, %ldL);",
+      result = easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, %ldL);",
                            name, lval);
    }
    else
      result =
-        easysrc_addf(&easysrc_code, "curl_easy_setopt(hnd, %s, (long)%s);",
+        easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, (long)%s);",
                     name, nv->name);
  }

@ -296,19 +296,19 @@ CURLcode tool_setopt_SSLVERSION(CURL *curl, const char *name, CURLoption tag,
      /* If no definition was found, output an explicit value.
       * This could happen if new values are defined and used
       * but the NameValue list is not updated. */
-      result = easysrc_addf(&easysrc_code, "curl_easy_setopt(hnd, %s, %ldL);",
+      result = easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, %ldL);",
                            name, lval);
    }
    else {
      if(nv2->name && *nv2->name)
        /* if max is set */
        result = easysrc_addf(&easysrc_code,
-                              "curl_easy_setopt(hnd, %s, (long)(%s | %s));",
+                              "curl_easy_setopt(curl, %s, (long)(%s | %s));",
                              name, nv->name, nv2->name);
      else
        /* without a max */
        result = easysrc_addf(&easysrc_code,
-                              "curl_easy_setopt(hnd, %s, (long)%s);",
+                              "curl_easy_setopt(curl, %s, (long)%s);",
                              name, nv->name);
    }
  }
@ -336,7 +336,7 @@ CURLcode tool_setopt_bitmask(CURL *curl, const char *name, CURLoption tag,
    unsigned long rest = (unsigned long)lval;
    const struct NameValueUnsigned *nv = NULL;
    curl_msnprintf(preamble, sizeof(preamble),
-                   "curl_easy_setopt(hnd, %s, ", name);
+                   "curl_easy_setopt(curl, %s, ", name);
    for(nv = nvlist; nv->name; nv++) {
      if((nv->value & ~rest) == 0) {
        /* all value flags contained in rest */
@ -533,7 +533,7 @@ static CURLcode libcurl_generate_mime(CURL *curl,
  if(!result)
    result = easysrc_addf(&easysrc_data, "mime%d = NULL;", *mimeno);
  if(!result)
-    result = easysrc_addf(&easysrc_code, "mime%d = curl_mime_init(hnd);",
+    result = easysrc_addf(&easysrc_code, "mime%d = curl_mime_init(curl);",
                          *mimeno);
  if(!result)
    result = easysrc_addf(&easysrc_clean, "curl_mime_free(mime%d);", *mimeno);
@ -563,7 +563,7 @@ CURLcode tool_setopt_mimepost(CURL *curl, struct OperationConfig *config,

    if(!result)
      result =
-        easysrc_addf(&easysrc_code, "curl_easy_setopt(hnd, %s, mime%d);",
+        easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, mime%d);",
                     name, mimeno);
  }

@ -584,7 +584,7 @@ CURLcode tool_setopt_slist(CURL *curl, const char *name, CURLoption tag,
    result = libcurl_generate_slist(list, &i);
    if(!result)
      result =
-        easysrc_addf(&easysrc_code, "curl_easy_setopt(hnd, %s, slist%d);",
+        easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, slist%d);",
                     name, i);
  }

@ -610,7 +610,7 @@ CURLcode tool_setopt_long(CURL *curl, const char *name, CURLoption tag,
  result = curl_easy_setopt(curl, tag, lval);
  if((lval != defval) && global->libcurl && !result) {
    /* we only use this for real if --libcurl was used */
-    result = easysrc_addf(&easysrc_code, "curl_easy_setopt(hnd, %s, %ldL);",
+    result = easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, %ldL);",
                          name, lval);
  }
  return result;
@ -627,7 +627,7 @@ CURLcode tool_setopt_offt(CURL *curl, const char *name, CURLoption tag,
  if(global->libcurl && !result && lval) {
    /* we only use this for real if --libcurl was used */
    result =
-      easysrc_addf(&easysrc_code, "curl_easy_setopt(hnd, %s, (curl_off_t)%"
+      easysrc_addf(&easysrc_code, "curl_easy_setopt(curl, %s, (curl_off_t)%"
                   CURL_FORMAT_CURL_OFF_T ");", name, lval);
  }

@ -690,7 +690,7 @@ CURLcode tool_setopt_str(CURL *curl, struct OperationConfig *config,
    escaped = c_escape(str, len);
    if(escaped) {
      result = easysrc_addf(&easysrc_code,
-                            "curl_easy_setopt(hnd, %s, \"%s\");",
+                            "curl_easy_setopt(curl, %s, \"%s\");",
                            name, escaped);
      curlx_free(escaped);
    }
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@ -218,7 +218,7 @@ test1620 test1621 test1622 test1623 \
 \
 test1630 test1631 test1632 test1633 test1634 test1635 test1636 \
 \
-test1640 \
+test1640 test1641 test1642 test1643 \
 \
 test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
 test1658 \
--- a/tests/data/data1400.c
+++ b/tests/data/data1400.c
@ -6,16 +6,16 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -36,11 +36,11 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1401.c
+++ b/tests/data/data1401.c
@ -6,26 +6,26 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;
  struct curl_slist *slist1;

  slist1 = NULL;
  slist1 = curl_slist_append(slist1, "X-Files: Mulder");
  slist1 = curl_slist_append(slist1, "X-Men: cyclops, iceman");

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_USERPWD, "fake:user");
-  curl_easy_setopt(hnd, CURLOPT_HTTPAUTH, (long)CURLAUTH_BASIC);
-  curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, slist1);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "MyUA");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_COOKIE, "chocolate=chip");
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_PROTOCOLS_STR, "file,ftp,http");
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_USERPWD, "fake:user");
+  curl_easy_setopt(curl, CURLOPT_HTTPAUTH, (long)CURLAUTH_BASIC);
+  curl_easy_setopt(curl, CURLOPT_HTTPHEADER, slist1);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "MyUA");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_COOKIE, "chocolate=chip");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, "file,ftp,http");

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -46,13 +46,13 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;
  curl_slist_free_all(slist1);
  slist1 = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1402.c
+++ b/tests/data/data1402.c
@ -6,18 +6,18 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "foo=bar&baz=quux");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)16);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "foo=bar&baz=quux");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)16);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -38,11 +38,11 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1403.c
+++ b/tests/data/data1403.c
@ -6,16 +6,16 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER\?foo=bar&baz=quux");
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER\?foo=bar&baz=quux");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -36,11 +36,11 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1404.c
+++ b/tests/data/data1404.c
@ -6,8 +6,8 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;
  curl_mime *mime1;
  curl_mimepart *part1;
  curl_mime *mime2;
@ -20,16 +20,16 @@ int main(int argc, char *argv[])
  slist1 = curl_slist_append(slist1, "X-testheader-1: header 1");
  slist1 = curl_slist_append(slist1, "X-testheader-2: header 2");

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  mime1 = curl_mime_init(hnd);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  mime1 = curl_mime_init(curl);
  part1 = curl_mime_addpart(mime1);
  curl_mime_data(part1, "value", CURL_ZERO_TERMINATED);
  curl_mime_name(part1, "name");
  part1 = curl_mime_addpart(mime1);
-  mime2 = curl_mime_init(hnd);
+  mime2 = curl_mime_init(curl);
  part2 = curl_mime_addpart(mime2);
  curl_mime_filedata(part2, "%LOGDIR/test%TESTNUMBER.txt");
  part2 = curl_mime_addpart(mime2);
@ -43,10 +43,10 @@ int main(int argc, char *argv[])
  curl_mime_subparts(part1, mime2);
  mime2 = NULL;
  curl_mime_name(part1, "file");
-  curl_easy_setopt(hnd, CURLOPT_MIMEPOST, mime1);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl_easy_setopt(curl, CURLOPT_MIMEPOST, mime1);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -67,10 +67,10 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;
  curl_mime_free(mime1);
  mime1 = NULL;
  curl_mime_free(mime2);
@ -78,6 +78,6 @@ int main(int argc, char *argv[])
  curl_slist_free_all(slist1);
  slist1 = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1405.c
+++ b/tests/data/data1405.c
@ -6,8 +6,8 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;
  struct curl_slist *slist1;
  struct curl_slist *slist2;
  struct curl_slist *slist3;
@ -21,15 +21,15 @@ int main(int argc, char *argv[])
  slist3 = curl_slist_append(slist3, "NOOP 2");
  slist3 = curl_slist_append(slist3, "*FAIL HARD");

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "ftp://%HOSTIP:%FTPPORT/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
-  curl_easy_setopt(hnd, CURLOPT_QUOTE, slist1);
-  curl_easy_setopt(hnd, CURLOPT_POSTQUOTE, slist2);
-  curl_easy_setopt(hnd, CURLOPT_PREQUOTE, slist3);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "ftp://%HOSTIP:%FTPPORT/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_FTP_SKIP_PASV_IP, 1L);
+  curl_easy_setopt(curl, CURLOPT_QUOTE, slist1);
+  curl_easy_setopt(curl, CURLOPT_POSTQUOTE, slist2);
+  curl_easy_setopt(curl, CURLOPT_PREQUOTE, slist3);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -50,10 +50,10 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;
  curl_slist_free_all(slist1);
  slist1 = NULL;
  curl_slist_free_all(slist2);
@ -61,6 +61,6 @@ int main(int argc, char *argv[])
  curl_slist_free_all(slist3);
  slist3 = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1406.c
+++ b/tests/data/data1406.c
@ -6,24 +6,24 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;
  struct curl_slist *slist1;

  slist1 = NULL;
  slist1 = curl_slist_append(slist1, "recipient.one@example.com");
  slist1 = curl_slist_append(slist1, "recipient.two@example.com");

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_MAIL_FROM, "sender@example.com");
-  curl_easy_setopt(hnd, CURLOPT_MAIL_RCPT, slist1);
-  curl_easy_setopt(hnd, CURLOPT_INFILESIZE_LARGE, (curl_off_t)38);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl_easy_setopt(curl, CURLOPT_MAIL_FROM, "sender@example.com");
+  curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, slist1);
+  curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)38);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -44,13 +44,13 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;
  curl_slist_free_all(slist1);
  slist1 = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1407.c
+++ b/tests/data/data1407.c
@ -6,16 +6,16 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "pop3://%HOSTIP:%POP3PORT/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_DIRLISTONLY, 1L);
-  curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "pop3://%HOSTIP:%POP3PORT/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_DIRLISTONLY, 1L);
+  curl_easy_setopt(curl, CURLOPT_USERPWD, "user:secret");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -36,11 +36,11 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1420.c
+++ b/tests/data/data1420.c
@ -6,16 +6,16 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1");
-  curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/%TESTNUMBER/;MAILINDEX=1");
+  curl_easy_setopt(curl, CURLOPT_USERPWD, "user:secret");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -36,11 +36,11 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1465.c
+++ b/tests/data/data1465.c
@ -6,18 +6,18 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "ab\201cd\000e\\\"\?\r\n\t\001fghi\x1ajklm\xfd");
-  curl_easy_setopt(hnd, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)24);
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDS, "ab\201cd\000e\\\"\?\r\n\t\001fghi\x1ajklm\xfd");
+  curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE_LARGE, (curl_off_t)24);
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -38,11 +38,11 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/data1481.c
+++ b/tests/data/data1481.c
@ -6,19 +6,19 @@

 int main(int argc, char *argv[])
 {
-  CURLcode ret;
-  CURL *hnd;
+  CURLcode result;
+  CURL *curl;

-  hnd = curl_easy_init();
-  curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
-  curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
-  curl_easy_setopt(hnd, CURLOPT_URL, "http://moo/");
-  curl_easy_setopt(hnd, CURLOPT_PROXY, "http://%HOSTIP:%HTTPPORT");
-  curl_easy_setopt(hnd, CURLOPT_USERAGENT, "curl/%VERSION");
-  curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
-  curl_easy_setopt(hnd, CURLOPT_SSLVERSION, (long)(CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_TLSv1_3));
-  curl_easy_setopt(hnd, CURLOPT_PROXY_SSLVERSION, (long)CURL_SSLVERSION_TLSv1);
-  curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
+  curl = curl_easy_init();
+  curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(curl, CURLOPT_BUFFERSIZE, 102400L);
+  curl_easy_setopt(curl, CURLOPT_URL, "http://moo/");
+  curl_easy_setopt(curl, CURLOPT_PROXY, "http://%HOSTIP:%HTTPPORT");
+  curl_easy_setopt(curl, CURLOPT_USERAGENT, "curl/%VERSION");
+  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt(curl, CURLOPT_SSLVERSION, (long)(CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_TLSv1_3));
+  curl_easy_setopt(curl, CURLOPT_PROXY_SSLVERSION, (long)CURL_SSLVERSION_TLSv1);
+  curl_easy_setopt(curl, CURLOPT_TCP_KEEPALIVE, 1L);

  /* Here is a list of options the curl code used that cannot get generated
     as source easily. You may choose to either not use them or implement
@ -39,11 +39,11 @@ int main(int argc, char *argv[])

  */

-  ret = curl_easy_perform(hnd);
+  result = curl_easy_perform(curl);

-  curl_easy_cleanup(hnd);
-  hnd = NULL;
+  curl_easy_cleanup(curl);
+  curl = NULL;

-  return (int)ret;
+  return (int)result;
 }
 /**** End of sample code ****/
--- a/tests/data/test1641
+++ b/tests/data/test1641
@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Location: %TESTNUMBER0002
+
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+Content-Disposition: filename=name%TESTNUMBER; charset=funny; option=strange
+
+12345
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J, a redirect and Content-Disposition in the second response
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -L -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/name%TESTNUMBER">
+12345
+</file>
+
+</verify>
+</testcase>
--- a/tests/data/test1642
+++ b/tests/data/test1642
@ -0,0 +1,61 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Location: go/here/%TESTNUMBER0002
+
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+12345
+</data2>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP GET with -J, redirect, no Content-Disposition use the Location: name
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -L -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /go/here/%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/%TESTNUMBER0002">
+12345
+</file>
+
+</verify>
+</testcase>
--- a/tests/data/test1643
+++ b/tests/data/test1643
@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+-J
+</keywords>
+</info>
+
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Location: go/here/%TESTNUMBER0002#first
+
+</data>
+<data2 nocheck="yes">
+HTTP/1.1 301 OK
+Location: too/%TESTNUMBER0003?fooo#second/%TESTNUMBER0003
+
+</data2>
+<data3 nocheck="yes">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Connection: close
+Content-Type: text/html
+
+12345
+</data3>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+HTTP -J, two redirects, use the last Location: name
+</name>
+<command option="no-output,no-include">
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -J -L -O --output-dir %LOGDIR
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET /%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /go/here/%TESTNUMBER0002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /go/here/too/%TESTNUMBER0003?fooo HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+User-Agent: curl/%VERSION
+Accept: */*
+
+</protocol>
+<file name="%LOGDIR/%TESTNUMBER0003">
+12345
+</file>
+
+</verify>
+</testcase>
Author	SHA1	Message	Date
Arnav-Purushotam-CUBoulder	9b20a672b8	include: mask computed auth/proto bitmasks to 32 bits GCC 15.2 warns when assigning computed "all" bitmask macros to 32-bit flag types because negated masks expand to the full width of unsigned long/long on 64-bit platforms. Mask these macros to a 32-bit domain so they do not set high bits and avoid -Woverflow/-Wconversion warnings in callers. Reported-by: Patrick Monnerat Fixes #20242 Closes #20416	2026-01-26 13:48:05 +01:00
Viktor Szakats	2f8c9812b1	tool: rename curl handle and result variable in `--libcurl`-generated code To match documentation, examples and curl source code: - `hnd` -> `curl` - `ret` -> `result` Closes #20437	2026-01-26 13:21:46 +01:00
Daniel Stenberg	fa6a46473e	tool_cb_hdr: with -J, use the redirect name as a backup The -J / --remote-header-name logic now records the file name part used in the redirects so that it can use the last one as a name if no Content-Disposition header arrives. Add tests to verify: 1641: -J with a redirect and extract the CD contents in the second response 1642: -J with a redirect but no Content-Disposition, use the name from the Location: header 1643: -J with two redirects, using the last file name and also use queries and fragments to verify them stripped off Closes #20430	2026-01-26 12:53:03 +01:00
Daniel Stenberg	146de2460a	RELEASE-NOTES: synced	2026-01-26 12:47:02 +01:00
Daniel Stenberg	04c060b004	RELEASE-PROCEDURE.md: update future release dates	2026-01-26 12:28:25 +01:00
Viktor Szakats	63d75de95d	GHA: sync up configure option order across builds Closes #20423	2026-01-26 12:08:47 +01:00
Daniel Stenberg	ca7ef4b817	BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026 Remove mentions of the bounty and hackerone. Closes #20312	2026-01-26 08:26:28 +01:00