rtmp: drop support

- librtmp has no test cases, makes no proper releases and has not had a single commit within the last year - librtmp parses the URL itself and requires non-compliant URLs for this - we have no RTMP tests - RTMP is barely used by curl users (2.2% self-identified in the 2025 survey) Closes #20673
Dockerfile: update debian:bookworm-slim digest to 74d56e3
2026-04-14 22:31:41 +03:00 · 2026-03-03 12:03:35 +01:00 · 2026-03-03 01:36:55 +01:00 · 2026-03-03 00:46:41 +01:00 · 2026-03-03 00:28:35 +01:00 · 2026-03-02 22:40:29 +01:00
331 changed files with 2706 additions and 2794 deletions
--- a/.clang-tidy.yml
+++ b/.clang-tidy.yml
@ -6,21 +6,43 @@

 # https://clang.llvm.org/extra/clang-tidy/checks/list.html
 Checks:
+  - clang-analyzer-*
  - -clang-analyzer-optin.performance.Padding
  - -clang-analyzer-security.ArrayBound  # due to false positives with clang-tidy v21.1.0
  - -clang-analyzer-security.insecureAPI.bzero  # for FD_ZERO() (seen on macOS)
  - -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling
  - -clang-diagnostic-nullability-extension
+  - bugprone-assert-side-effect
+  - bugprone-chained-comparison
+  - bugprone-dynamic-static-initializers
  - bugprone-macro-parentheses
+  - bugprone-macro-repeated-side-effects
+  - bugprone-misplaced-operator-in-strlen-in-alloc
+  - bugprone-misplaced-pointer-arithmetic-in-alloc
+  - bugprone-not-null-terminated-result
+  - bugprone-posix-return
  - bugprone-redundant-branch-condition
+  - bugprone-signed-char-misuse
+  - bugprone-suspicious-enum-usage
+  - bugprone-suspicious-memset-usage
+  - bugprone-suspicious-missing-comma
  - bugprone-suspicious-realloc-usage
+  - bugprone-suspicious-semicolon
  - misc-const-correctness
  - misc-header-include-cycle
  - portability-*
+  - readability-duplicate-include
+  - readability-math-missing-parentheses
  - readability-named-parameter
  - readability-redundant-control-flow
+  - readability-redundant-declaration
+  - readability-redundant-function-ptr-dereference
+  - readability-redundant-parentheses
  - readability-redundant-preprocessor
+  - readability-suspicious-call-argument
  - readability-uppercase-literal-suffix

 CheckOptions:
-  misc-header-include-cycle.IgnoredFilesList: 'curl/curl.h;openssl/ssl.h'
+  misc-header-include-cycle.IgnoredFilesList: 'curl/curl.h'
+
+HeaderFilterRegex: '.*'
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@ -13,7 +13,7 @@ body:

        Only file bugs here! Ask questions on the mailing lists https://curl.se/mail/

-        **SECURITY RELATED?** Submit here: https://github.com/curl/curl/security/advisories
+        **SECURITY RELATED?** Submit here: https://hackerone.com/curl

  - type: textarea
    id: reproducer
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -369,14 +369,6 @@ POP3:
              lib/pop3.*\
              }"

-RTMP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindLibrtmp.cmake,\
-              lib/curl_rtmp.*\
-              }"
-
 RTSP:
  - all:
      - changed-files:
--- a/.github/scripts/badwords.txt
+++ b/.github/scripts/badwords.txt
@ -91,3 +91,4 @@ file names\b:filenames
 ---Curl Corporation
 \bmanpages[^./;=&{:-]:man pages
 \bmanpage[^si./;=&{:-]:man page
+favour:favor
--- a/.github/scripts/cmp-config.pl
+++ b/.github/scripts/cmp-config.pl
@ -53,7 +53,6 @@ my %remove = (
    '#define HAVE_LDAP_SSL 1' => 1,
    '#define HAVE_LIBBROTLIDEC 1' => 1,
    '#define HAVE_LIBPSL_H 1' => 1,
-    '#define HAVE_LIBRTMP_RTMP_H 1' => 1,
    '#define HAVE_LIBSOCKET 1' => 1,
    '#define HAVE_LIBSSH' => 1,
    '#define HAVE_LIBSSH2 1' => 1,
--- a/.github/scripts/requirements.txt
+++ b/.github/scripts/requirements.txt
@ -6,4 +6,4 @@ cmakelang==0.6.13
 codespell==2.4.1
 pytype==2024.10.11
 reuse==6.2.0
-ruff==0.14.14
+ruff==0.15.2
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@ -46,13 +46,13 @@ jobs:
          persist-credentials: false

      - name: 'initialize'
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          languages: actions, python
          queries: security-extended

      - name: 'perform analysis'
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4

  c:
    if: ${{ github.repository_owner == 'curl' || github.event_name != 'schedule' }}
@ -74,7 +74,7 @@ jobs:
          sudo rm -f /etc/apt/sources.list.d/{azure-cli.sources,microsoft-prod.list,ondrej-ubuntu-php-noble.sources}
          sudo apt-get -o Dpkg::Use-Pty=0 update
          sudo apt-get -o Dpkg::Use-Pty=0 install libpsl-dev libbrotli-dev libidn2-dev libssh2-1-dev libssh-dev \
-            libnghttp2-dev libldap-dev libkrb5-dev librtmp-dev libgnutls28-dev libwolfssl-dev
+            libnghttp2-dev libldap-dev libkrb5-dev libgnutls28-dev libwolfssl-dev
          HOMEBREW_NO_AUTO_UPDATE=1 /home/linuxbrew/.linuxbrew/bin/brew install c-ares gsasl libnghttp3 libngtcp2 mbedtls rustls-ffi

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@ -87,7 +87,7 @@ jobs:

      - name: 'initialize'
        # https://github.com/github/codeql-action/blob/main/init/action.yml
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          languages: cpp
          build-mode: manual
@ -110,7 +110,7 @@ jobs:
            export PKG_CONFIG_PATH; PKG_CONFIG_PATH="$(brew --prefix c-ares)/lib/pkgconfig:$(brew --prefix mbedtls)/lib/pkgconfig:$(brew --prefix rustls-ffi)/lib/pkgconfig:$(brew --prefix gsasl)/lib/pkgconfig"
            cmake -B _bld1 -G Ninja -DCURL_DISABLE_TYPECHECK=ON -DCURL_WERROR=ON -DENABLE_DEBUG=ON \
              -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DCURL_USE_WOLFSSL=ON \
-              -DUSE_LIBRTMP=ON -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DUSE_ECH=ON -DENABLE_ARES=ON \
+              -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DUSE_ECH=ON -DENABLE_ARES=ON \
              -DCURL_DISABLE_VERBOSE_STRINGS=ON
            cmake --build _bld1
            cmake --build _bld1 --target testdeps
@ -121,7 +121,7 @@ jobs:
            cmake -B _bld2 -G Ninja -DCURL_DISABLE_TYPECHECK=ON -DCURL_WERROR=ON \
              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR="$(brew --prefix openssl)" -DUSE_NGTCP2=ON \
              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON \
-              -DUSE_LIBRTMP=ON -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON
+              -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON
            cmake --build _bld2
            cmake --build _bld2 --target testdeps
            cmake --build _bld2 --target curl-examples-build
@ -132,4 +132,4 @@ jobs:

      - name: 'perform analysis'
        # https://github.com/github/codeql-action/blob/main/analyze/action.yml
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
--- a/.github/workflows/distcheck.yml
+++ b/.github/workflows/distcheck.yml
@ -316,6 +316,9 @@ jobs:
        run: ./tests/cmake/test.sh add_subdirectory ${TESTOPTS} -DCURL_USE_OPENSSL=ON
      - name: 'via find_package'
        run: ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via find_package (C++)'
+        if: ${{ contains(matrix.image, 'ubuntu') }}
+        run: TEST_CMAKE_FLAGS=-DTEST_CPP=ON ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON

      - name: 'via ExternalProject (old cmake)'
        if: ${{ contains(matrix.image, 'ubuntu') }}
--- a/.github/workflows/http3-linux.yml
+++ b/.github/workflows/http3-linux.yml
@ -52,7 +52,7 @@ env:
  # renovate: datasource=github-tags depName=ngtcp2/nghttp3 versioning=semver registryUrl=https://github.com
  NGHTTP3_VERSION: 1.15.0
  # renovate: datasource=github-tags depName=ngtcp2/ngtcp2 versioning=semver registryUrl=https://github.com
-  NGTCP2_VERSION: 1.20.0
+  NGTCP2_VERSION: 1.21.0
  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
  NGHTTP2_VERSION: 1.68.0
  # renovate: datasource=github-tags depName=cloudflare/quiche versioning=semver registryUrl=https://github.com
@ -65,7 +65,7 @@ jobs:

    steps:
      - name: 'cache openssl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-openssl-http3-no-deprecated
        env:
          cache-name: cache-openssl-http3-no-deprecated
@ -74,7 +74,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}

      - name: 'cache libressl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-libressl
        env:
          cache-name: cache-libressl
@ -83,7 +83,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}

      - name: 'cache awslc'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-awslc
        env:
          cache-name: cache-awslc
@ -92,7 +92,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}

      - name: 'cache boringssl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-boringssl
        env:
          cache-name: cache-boringssl
@ -101,7 +101,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}

      - name: 'cache nettle'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-nettle
        env:
          cache-name: cache-nettle
@ -110,7 +110,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}

      - name: 'cache gnutls'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-gnutls
        env:
          cache-name: cache-gnutls
@ -119,7 +119,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}

      - name: 'cache wolfssl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-wolfssl
        env:
          cache-name: cache-wolfssl
@ -128,7 +128,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}

      - name: 'cache nghttp3'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-nghttp3
        env:
          cache-name: cache-nghttp3
@ -137,7 +137,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}

      - name: 'cache ngtcp2'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-ngtcp2
        env:
          cache-name: cache-ngtcp2
@ -146,7 +146,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}

      - name: 'cache ngtcp2 boringssl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-ngtcp2-boringssl
        env:
          cache-name: cache-ngtcp2-boringssl
@ -155,7 +155,7 @@ jobs:
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}

      - name: 'cache nghttp2'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-nghttp2
        env:
          cache-name: cache-nghttp2
@ -480,7 +480,7 @@ jobs:
          echo 'CXX=g++-12' >> "$GITHUB_ENV"

      - name: 'cache openssl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-openssl-http3-no-deprecated
        env:
          cache-name: cache-openssl-http3-no-deprecated
@ -490,7 +490,7 @@ jobs:
          fail-on-cache-miss: true

      - name: 'cache libressl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-libressl
        env:
          cache-name: cache-libressl
@ -500,7 +500,7 @@ jobs:
          fail-on-cache-miss: true

      - name: 'cache awslc'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-awslc
        env:
          cache-name: cache-awslc
@ -510,7 +510,7 @@ jobs:
          fail-on-cache-miss: true

      - name: 'cache boringssl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-boringssl
        env:
          cache-name: cache-boringssl
@ -521,7 +521,7 @@ jobs:

      - name: 'cache nettle'
        if: ${{ matrix.build.name == 'gnutls' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-nettle
        env:
          cache-name: cache-nettle
@ -532,7 +532,7 @@ jobs:

      - name: 'cache gnutls'
        if: ${{ matrix.build.name == 'gnutls' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-gnutls
        env:
          cache-name: cache-gnutls
@ -543,7 +543,7 @@ jobs:

      - name: 'cache wolfssl'
        if: ${{ matrix.build.name == 'wolfssl' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-wolfssl
        env:
          cache-name: cache-wolfssl
@ -553,7 +553,7 @@ jobs:
          fail-on-cache-miss: true

      - name: 'cache nghttp3'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-nghttp3
        env:
          cache-name: cache-nghttp3
@ -563,7 +563,7 @@ jobs:
          fail-on-cache-miss: true

      - name: 'cache ngtcp2'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-ngtcp2
        env:
          cache-name: cache-ngtcp2
@ -573,7 +573,7 @@ jobs:
          fail-on-cache-miss: true

      - name: 'cache ngtcp2 boringssl'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-ngtcp2-boringssl
        env:
          cache-name: cache-ngtcp2-boringssl
@ -583,7 +583,7 @@ jobs:
          fail-on-cache-miss: true

      - name: 'cache nghttp2'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-nghttp2
        env:
          cache-name: cache-nghttp2
@ -594,7 +594,7 @@ jobs:

      - name: 'cache quiche'
        if: ${{ matrix.build.name == 'quiche' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-quiche
        env:
          cache-name: cache-quiche
--- a/.github/workflows/linux-old.yml
+++ b/.github/workflows/linux-old.yml
@ -69,7 +69,7 @@ jobs:
          sha256sum freexian-archive-keyring_2022.06.08_all.deb && dpkg -i freexian-archive-keyring_2022.06.08_all.deb
          echo 'deb http://deb.freexian.com/extended-lts stretch-lts main contrib non-free' | tee /etc/apt/sources.list.d/extended-lts.list
          apt-get -o Dpkg::Use-Pty=0 update
-          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends make automake autoconf libtool gcc pkg-config libpsl-dev libzstd-dev zlib1g-dev libc-ares-dev libkrb5-dev libldap2-dev librtmp-dev stunnel4
+          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends make automake autoconf libtool gcc pkg-config libpsl-dev libzstd-dev zlib1g-dev libc-ares-dev libkrb5-dev libldap2-dev stunnel4
          # GitHub's actions/checkout needs newer glibc and libstdc++. The latter also depends on
          # gcc-8-base, but it does not actually seem used in our situation and is not available in
          # the main repo, so force the install.
@ -97,7 +97,7 @@ jobs:
          mkdir bld-1
          cd bld-1
          ~/cmake/bin/cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
-            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=OFF -DCURL_ZSTD=OFF -DCURL_USE_GSSAPI=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_LIBRTMP=ON
+            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=OFF -DCURL_ZSTD=OFF -DCURL_USE_GSSAPI=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF

      - name: 'CM build-only build'
        run: VERBOSE=1 make -C bld-1 install
@ -121,7 +121,7 @@ jobs:
          mkdir bld-cares
          cd bld-cares
          ~/cmake/bin/cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
-            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_LIBRTMP=ON \
+            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF \
            -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON

      - name: 'CM configure log'
@ -160,7 +160,7 @@ jobs:
          cd bld-am
          ../configure --prefix="$PWD"/../curl-install-am --enable-unity --enable-warnings --enable-werror --disable-shared \
            --disable-dependency-tracking --enable-option-checking=fatal \
-            --without-ssl --enable-ares --without-libssh2 --with-zstd --with-gssapi --with-librtmp
+            --without-ssl --enable-ares --without-libssh2 --with-zstd --with-gssapi

      - name: 'AM configure log'
        if: ${{ !cancelled() }}
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@ -66,7 +66,6 @@ jobs:
      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
      MATRIX_INSTALL_PACKAGES: '${{ matrix.build.install_packages }}'
      MATRIX_INSTALL_STEPS: '${{ matrix.build.install_steps }}'
-      MATRIX_MAKE_PREFIX: '${{ matrix.build.make-prefix }}'
    strategy:
      fail-fast: false
      matrix:
@ -233,7 +232,7 @@ jobs:
              --with-openssl --enable-debug --disable-unity
              --disable-dict --disable-gopher --disable-ldap --disable-telnet
              --disable-imap --disable-pop3 --disable-smtp
-              --without-librtmp --disable-rtsp
+              --disable-rtsp
              --without-libssh2 --without-libssh
              --disable-tftp --disable-ftp --disable-file --disable-smb

@ -250,14 +249,14 @@ jobs:
            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON

          - name: 'openssl i686'
-            install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 librtmp-dev:i386 libssh2-1-dev:i386 libidn2-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386
+            install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 libssh2-1-dev:i386 libidn2-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386
            configure: >-
              PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig
              CC=i686-linux-gnu-gcc-14
              CPPFLAGS=-I/usr/include/i386-linux-gnu
              LDFLAGS=-L/usr/lib/i386-linux-gnu
              --host=i686-linux-gnu
-              --with-openssl --with-librtmp --with-libssh2 --with-libidn2 --enable-ares --enable-debug
+              --with-openssl --with-libssh2 --with-libidn2 --enable-ares --enable-debug

          - name: '!ssl !http !smtp !imap'
            image: ubuntu-24.04-arm
@ -276,82 +275,64 @@ jobs:
              -DCURL_DISABLE_LDAP=ON -DUSE_LIBIDN2=OFF -DCURL_USE_LIBSSH2=OFF

          - name: 'clang-tidy'
-            install_packages: clang-19 clang-tidy-19 libssl-dev libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev libkrb5-dev librtmp-dev libgnutls28-dev
-            install_steps: skipall mbedtls-latest-intel rustls wolfssl-opensslextra-intel
+            install_packages: clang-20 clang-tidy-20 libssl-dev libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev libkrb5-dev libgnutls28-dev
+            install_steps: skiprun mbedtls-latest-intel rustls wolfssl-opensslextra-intel
            install_steps_brew: gsasl
-            make-custom-target: tidy
-            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl-opensslextra/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/gsasl/lib
-            PKG_CONFIG_PATH: /home/linuxbrew/.linuxbrew/opt/gsasl/lib/pkgconfig
-            CC: clang-19
-            configure: >-
-              CLANG_TIDY=clang-tidy-19
-              --with-wolfssl=/home/runner/wolfssl-opensslextra --with-openssl --with-rustls --with-mbedtls=/home/runner/mbedtls --with-gnutls --with-libgsasl
-              --with-librtmp --with-libssh2 --with-libidn2
-              --enable-ech --with-gssapi --enable-ssls-export --disable-typecheck
-
-          - name: 'scan-build'
-            install_packages: clang-tools clang libssl-dev libidn2-dev libssh2-1-dev libnghttp2-dev libldap-dev libgss-dev librtmp-dev libgnutls28-dev
-            install_steps: skipall mbedtls-latest-intel rustls wolfssl-opensslextra-intel
-            install_steps_brew: gsasl
-            CC: clang
-            configure-prefix: scan-build
-            make-prefix: scan-build --status-bugs
+            CC: clang-20
            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl-opensslextra/lib -Wl,-rpath,/home/runner/mbedtls/lib -Wl,-rpath,/home/runner/rustls/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/gsasl/lib
            PKG_CONFIG_PATH: /home/runner/wolfssl-opensslextra/lib/pkgconfig:/home/runner/mbedtls/lib/pkgconfig:/home/runner/rustls/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/gsasl/lib/pkgconfig
            generate: >-
              -DCURL_USE_OPENSSL=ON -DCURL_USE_WOLFSSL=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON
-              -DCURL_USE_GSASL=ON -DUSE_LIBRTMP=ON
+              -DCURL_USE_GSASL=ON
              -DUSE_ECH=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON
-              -DCMAKE_UNITY_BUILD=OFF -DCURL_DISABLE_TYPECHECK=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-20

-          - name: 'scan-build H3 c-ares !examples'
-            install_packages: clang-tools clang libidn2-dev libssh-dev libnghttp2-dev
-            install_steps: skipall
+          - name: 'clang-tidy H3 c-ares !examples'
+            install_packages: clang-20 clang-tidy-20 libidn2-dev libssh-dev libnghttp2-dev
+            install_steps: skiprun
            install_steps_brew: openssl libngtcp2 libnghttp3 c-ares
-            CC: clang
-            configure-prefix: scan-build
-            make-prefix: scan-build --status-bugs
+            CC: clang-20
            LDFLAGS: -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libngtcp2/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib
            PKG_CONFIG_PATH: /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig
            generate: >-
              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON
              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DUSE_HTTPSRR=ON -DENABLE_ARES=ON
-              -DCMAKE_UNITY_BUILD=OFF -DCURL_DISABLE_TYPECHECK=ON
              -DCURL_DISABLE_VERBOSE_STRINGS=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-20

          - name: 'address-sanitizer'
-            install_packages: clang libssl-dev libssh-dev libidn2-dev libnghttp2-dev libubsan1 libasan8 libtsan2
+            install_packages: clang-20 libssl-dev libssh-dev libidn2-dev libnghttp2-dev libubsan1 libasan8 libtsan2
            install_steps: pytest randcurl
            CFLAGS: -fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g
            LDFLAGS: -fsanitize=address,undefined -fno-sanitize-recover=undefined,integer -ldl -lubsan
-            CC: clang
+            CC: clang-20
            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH=ON

          - name: 'address-sanitizer H3 c-ares'
-            install_packages: clang libubsan1 libasan8 libtsan2
+            install_packages: clang-20 libubsan1 libasan8 libtsan2
            install_steps: pytest
            install_steps_brew: openssl libssh2 libngtcp2 libnghttp3 c-ares
            CFLAGS: -fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g
            LDFLAGS: -fsanitize=address,undefined -fno-sanitize-recover=undefined,integer -ldl -lubsan -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib
            PKG_CONFIG_PATH: /home/linuxbrew/.linuxbrew/opt/libssh2/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig
-            CC: clang
+            CC: clang-20
            generate: -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON -DUSE_SSLS_EXPORT=ON -DENABLE_ARES=ON

          - name: 'thread-sanitizer'
-            install_packages: clang libtsan2
+            install_packages: clang-20 libtsan2
            install_steps: pytest openssl-tsan
            CFLAGS: -fsanitize=thread -g
            LDFLAGS: -fsanitize=thread
-            CC: clang
+            CC: clang-20
            generate: -DOPENSSL_ROOT_DIR=/home/runner/openssl -DENABLE_DEBUG=ON

          - name: 'memory-sanitizer'
-            install_packages: clang
+            install_packages: clang-20
            install_steps: randcurl
            CFLAGS: -fsanitize=memory -Wformat -Werror=format-security -Werror=array-bounds -g
            LDFLAGS: -fsanitize=memory
            LIBS: -ldl
-            configure: CC=clang --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug
+            configure: CC=clang-20 --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug
            tflags: '--min=1480'

          - name: 'event-based'
@ -461,7 +442,7 @@ jobs:

      - name: 'cache libressl (c-arm)'
        if: ${{ contains(matrix.build.install_steps, 'libressl-c-arm') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-libressl-c-arm
        env:
          cache-name: cache-libressl-c-arm
@ -482,7 +463,7 @@ jobs:

      - name: 'cache libressl (filc)'
        if: ${{ contains(matrix.build.install_steps, 'libressl-filc') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-libressl-filc
        env:
          cache-name: cache-libressl-filc
@ -504,7 +485,7 @@ jobs:

      - name: 'cache nghttp2 (filc)'
        if: ${{ contains(matrix.build.install_steps, 'nghttp2-filc') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-nghttp2-filc
        env:
          cache-name: cache-nghttp2-filc
@ -527,7 +508,7 @@ jobs:

      - name: 'cache wolfssl (all-arm)'
        if: ${{ contains(matrix.build.install_steps, 'wolfssl-all-arm') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-wolfssl-all-arm
        env:
          cache-name: cache-wolfssl-all-arm
@ -549,7 +530,7 @@ jobs:

      - name: 'cache wolfssl (opensslextra-intel)'  # does support `OPENSSL_COEXIST`
        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra-intel') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-wolfssl-opensslextra-intel
        env:
          cache-name: cache-wolfssl-opensslextra-intel
@ -571,7 +552,7 @@ jobs:

      - name: 'cache wolfssl (opensslextra-arm)'  # does support `OPENSSL_COEXIST`
        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra-arm') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-wolfssl-opensslextra-arm
        env:
          cache-name: cache-wolfssl-opensslextra-arm
@ -593,7 +574,7 @@ jobs:

      - name: 'cache mbedtls (latest-intel)'
        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest-intel') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-mbedtls-latest-intel
        env:
          cache-name: cache-mbedtls-latest-intel
@ -617,7 +598,7 @@ jobs:

      - name: 'cache mbedtls (latest-arm)'
        if: ${{ contains(matrix.build.install_steps, 'mbedtls-latest-arm') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-mbedtls-latest-arm
        env:
          cache-name: cache-mbedtls-latest-arm
@ -641,7 +622,7 @@ jobs:

      - name: 'cache mbedtls (prev)'
        if: ${{ contains(matrix.build.install_steps, 'mbedtls-prev') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-mbedtls-prev
        env:
          cache-name: cache-mbedtls-prev
@ -665,7 +646,7 @@ jobs:

      - name: 'cache openldap (static)'
        if: ${{ contains(matrix.build.install_steps, 'openldap-static') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-openldap-static
        env:
          cache-name: cache-openldap-static
@ -685,7 +666,7 @@ jobs:

      - name: 'cache openssl (thread sanitizer)'
        if: ${{ contains(matrix.build.install_steps, 'openssl-tsan') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-openssl-tsan
        env:
          cache-name: cache-openssl-tsan
@ -704,7 +685,7 @@ jobs:

      - name: 'cache awslc'
        if: ${{ contains(matrix.build.install_steps, 'awslc') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-awslc
        env:
          cache-name: cache-awslc
@ -725,7 +706,7 @@ jobs:

      - name: 'cache boringssl'
        if: ${{ contains(matrix.build.install_steps, 'boringssl') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-boringssl
        env:
          cache-name: cache-boringssl
@ -747,7 +728,7 @@ jobs:

      - name: 'cache rustls'
        if: ${{ contains(matrix.build.install_steps, 'rustls') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-rustls
        env:
          cache-name: cache-rustls
@ -794,14 +775,12 @@ jobs:
          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
          LIBS: '${{ matrix.build.LIBS }}'
          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
-          MATRIX_CONFIGURE_PREFIX: '${{ matrix.build.configure-prefix }}'
          MATRIX_GENERATE: '${{ matrix.build.generate }}'
          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
        run: |
          [[ "${MATRIX_INSTALL_STEPS}" = *'awslc'* ]] && sudo apt-get -o Dpkg::Use-Pty=0 purge libssl-dev
          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
-            ${MATRIX_CONFIGURE_PREFIX} \
            cmake -B bld -G Ninja \
              -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-pc-linux-gnu" -DBUILD_STATIC_LIBS=ON \
@ -809,7 +788,6 @@ jobs:
              ${MATRIX_GENERATE}
          else
            mkdir bld && cd bld && \
-            ${MATRIX_CONFIGURE_PREFIX} \
            ../configure --prefix="$HOME"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
              --disable-dependency-tracking --enable-option-checking=fatal \
              ${MATRIX_CONFIGURE}
@ -828,13 +806,11 @@ jobs:
        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true

      - name: 'build'
-        env:
-          MATRIX_MAKE_CUSTOM_TARGET: '${{ matrix.build.make-custom-target }}'
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
-            ${MATRIX_MAKE_PREFIX} cmake --build bld --verbose
+            cmake --build bld --verbose
          else
-            ${MATRIX_MAKE_PREFIX} make -C bld V=1 ${MATRIX_MAKE_CUSTOM_TARGET}
+            make -C bld V=1
          fi

      - name: 'single-use function check'
@ -849,7 +825,6 @@ jobs:
          ./scripts/singleuse.pl --unit "${libcurla}"

      - name: 'curl -V'
-        if: ${{ matrix.build.make-custom-target != 'tidy' }}
        run: |
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 file --
          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
@ -934,10 +909,10 @@ jobs:
          ../.github/scripts/randcurl.pl 60 ../bld/src/curl

      - name: 'build examples'
-        if: ${{ !contains(matrix.build.install_packages, 'valgrind') && matrix.build.make-custom-target != 'tidy' && !contains(matrix.build.name, '!examples') }}
+        if: ${{ !contains(matrix.build.install_packages, 'valgrind') && !contains(matrix.build.name, '!examples') }}
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
-            ${MATRIX_MAKE_PREFIX} cmake --build bld --verbose --target curl-examples-build
+            cmake --build bld --verbose --target curl-examples-build
          else
-            ${MATRIX_MAKE_PREFIX} make -C bld V=1 examples
+            make -C bld V=1 examples
          fi
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@ -31,12 +31,15 @@ concurrency:

 permissions: {}

-# Deprecated Apple APIs and the macos-version-min value required to avoid
-# deprecation warnings with llvm/clang:
-#
-# - 10.7  Lion (2011)          - GSS
-# - 10.9  Mavericks (2013)     - LDAP
+# Apple APIs and the macos-version-min value required to avoid deprecation
+# warnings with llvm/clang, and/or the feature getting enabled at build-time
+# or runtime:
 #
+# - 10.7   Lion (2011)          - GSS (build-time, deprecated MIT Kerberos shim)
+# - 10.9   Mavericks (2013)     - LDAP (build-time, deprecated), OCSP (runtime)
+# - 10.11  El Capitan (2015)    - connectx() (runtime)
+# - 10.12  Sierra (2016)        - clock_gettime() (build-time, runtime)
+# - 10.14  Mojave (2018)        - SecTrustEvaluateWithError() (runtime)

 env:
  CURL_CI: github
@ -100,7 +103,7 @@ jobs:

      - name: 'cache libressl'
        if: ${{ contains(matrix.build.install_steps, 'libressl') }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-libressl
        env:
          cache-name: cache-libressl
@ -198,7 +201,7 @@ jobs:

  macos:
    name: "${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.compiler }} ${{ matrix.build.name }}"
-    runs-on: macos-15
+    runs-on: ${{ matrix.build.image || 'macos-15' }}
    timeout-minutes: 15
    env:
      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
@ -237,7 +240,7 @@ jobs:
              -DCURL_ENABLE_SSL=OFF -DHTTP_ONLY=ON
              -DCURL_DISABLE_NTLM=ON -DCURL_DISABLE_ALTSVC=ON -DENABLE_UNIX_SOCKETS=OFF
              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_NGHTTP2=OFF
-              -DCURL_USE_GSSAPI=OFF -DUSE_LIBIDN2=OFF -DCURL_USE_LIBPSL=OFF -DUSE_LIBRTMP=OFF
+              -DCURL_USE_GSSAPI=OFF -DUSE_LIBIDN2=OFF -DCURL_USE_LIBPSL=OFF
              -DCURL_BROTLI=OFF -DCURL_ZLIB=OFF -DCURL_ZSTD=OFF
              -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF

@ -262,18 +265,19 @@ jobs:
            compiler: clang
            generate: -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF -DCURL_USE_LIBSSH2=OFF
            tflags: '--test-event --min=1300'
-          - name: 'OpenSSL gsasl rtmp AppleIDN SecTrust +examples'
+          - name: 'OpenSSL gsasl AppleIDN SecTrust +examples'
            compiler: clang
-            install: libnghttp3 libngtcp2 gsasl rtmpdump
-            generate: -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_USE_GSASL=ON -DUSE_LIBRTMP=ON -DUSE_APPLE_IDN=ON -DUSE_NGTCP2=ON -DCURL_DISABLE_VERBOSE_STRINGS=ON -DUSE_APPLE_SECTRUST=ON
+            install: libnghttp3 libngtcp2 gsasl
+            generate: -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_USE_GSASL=ON -DUSE_APPLE_IDN=ON -DUSE_NGTCP2=ON -DCURL_DISABLE_VERBOSE_STRINGS=ON -DUSE_APPLE_SECTRUST=ON
          - name: 'MultiSSL AppleIDN clang-tidy +examples'
+            image: macos-26
            compiler: clang
-            install: llvm gnutls nettle libressl krb5 mbedtls gsasl rustls-ffi rtmpdump libssh fish
-            install_steps: clang-tidy skiprun
+            install: llvm gnutls nettle libressl krb5 mbedtls gsasl rustls-ffi libssh fish
+            install_steps: skiprun
            chkprefill: _chkprefill
            generate: >-
              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DCURL_DEFAULT_SSL_BACKEND=openssl
-              -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DENABLE_ARES=ON -DCURL_USE_GSASL=ON -DUSE_LIBRTMP=ON
+              -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DENABLE_ARES=ON -DCURL_USE_GSASL=ON
              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DUSE_APPLE_IDN=ON -DUSE_SSLS_EXPORT=ON
              -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
              -DCURL_BROTLI=ON -DCURL_ZSTD=ON
@ -281,9 +285,10 @@ jobs:
              -DCURL_COMPLETION_FISH=ON -DCURL_COMPLETION_ZSH=ON

          - name: 'HTTP/3 clang-tidy'
+            image: macos-26
            compiler: clang
            install: llvm libnghttp3 libngtcp2 openldap krb5
-            install_steps: clang-tidy skipall
+            install_steps: skipall
            generate: >-
              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DUSE_NGTCP2=ON
              -DLDAP_INCLUDE_DIR=/opt/homebrew/opt/openldap/include -DLDAP_LIBRARY=/opt/homebrew/opt/openldap/lib/libldap.dylib -DLDAP_LBER_LIBRARY=/opt/homebrew/opt/openldap/lib/liblber.dylib
--- a/.github/workflows/non-native.yml
+++ b/.github/workflows/non-native.yml
@ -349,7 +349,7 @@ jobs:
        run: sudo apt-get -o Dpkg::Use-Pty=0 install libfl2

      - name: 'cache compiler (djgpp)'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-compiler
        with:
          path: ~/djgpp
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@ -46,7 +46,7 @@ jobs:
        image: [windows-11-arm, windows-2022]  # Cannot share cache between arm and intel: https://github.com/actions/cache/issues/1622
    steps:
      - name: 'cache test prereqs (stunnel)'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-stunnel
        with:
          path: C:\my-stunnel
@ -181,7 +181,7 @@ jobs:

      - name: 'cache test prereqs (stunnel)'
        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-stunnel
        with:
          path: C:\my-stunnel
@ -403,7 +403,7 @@ jobs:

      - name: 'cache test prereqs (stunnel)'
        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-stunnel
        with:
          path: C:\my-stunnel
@ -539,7 +539,7 @@ jobs:
            ${{ matrix.install }}

      - name: 'cache compiler (gcc ${{ matrix.ver }}-${{ matrix.env }})'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-compiler
        with:
          path: D:\my-cache
@ -623,7 +623,7 @@ jobs:

      - name: 'cache test prereqs (stunnel)'
        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-stunnel
        with:
          path: C:\my-stunnel
@ -677,10 +677,12 @@ jobs:
        include:
          - { build: 'autotools', compiler: 'gcc' }
          - { build: 'cmake'    , compiler: 'gcc' }
-          - { build: 'cmake'    , compiler: 'clang-tidy' }
+          - { build: 'cmake'    , compiler: 'clang-tidy', install_packages: 'clang-20 clang-tidy-20' }
    steps:
      - name: 'install packages'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 install gcc-mingw-w64-x86-64-win32
+        env:
+          MATRIX_INSTALL_PACKAGES: '${{ matrix.install_packages }}'
+        run: sudo apt-get -o Dpkg::Use-Pty=0 install gcc-mingw-w64-x86-64-win32 ${MATRIX_INSTALL_PACKAGES}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
@ -694,17 +696,17 @@ jobs:
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            if [ "${MATRIX_COMPILER}" = 'clang-tidy' ]; then
-              options+=' -DCURL_CLANG_TIDY=ON'
+              options+=' -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/usr/bin/clang-tidy-20'
              options+=' -DENABLE_UNICODE=ON -DUSE_SSLS_EXPORT=ON'
-              options+=' -DCMAKE_C_COMPILER=clang'
-              options+=" -DCMAKE_RC_COMPILER=llvm-windres-$(clang -dumpversion | cut -d '.' -f 1)"
+              options+=' -DCMAKE_C_COMPILER=clang-20'
+              options+=" -DCMAKE_RC_COMPILER=llvm-windres-$(clang-20 -dumpversion | cut -d '.' -f 1)"
            else
              options+=" -DCMAKE_C_COMPILER=${TRIPLET}-gcc"
            fi
            cmake -B bld -G Ninja \
              -DCMAKE_SYSTEM_NAME=Windows \
              -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
-              -DCMAKE_UNITY_BUILD=ON \
+              -DCMAKE_UNITY_BUILD=ON -D_CURL_TESTS_CONCAT=ON \
              -DCURL_WERROR=ON \
              -DCURL_USE_SCHANNEL=ON -DUSE_WIN32_IDN=ON \
              -DCURL_USE_LIBPSL=OFF \
@ -741,7 +743,7 @@ jobs:
          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -print0 | grep -z curl | xargs -0 stat -c '%10s bytes: %n' --

      - name: 'build tests'
-        if: ${{ matrix.build == 'cmake' && matrix.compiler != 'clang-tidy' }}  # Save time by skipping this for autotools and clang-tidy
+        if: ${{ matrix.build == 'cmake' }}  # Save time by skipping this for autotools and clang-tidy
        run: |
          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
            cmake --build bld --target testdeps
@ -1002,7 +1004,7 @@ jobs:

      - name: 'cache test prereqs (stunnel)'
        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        id: cache-stunnel
        with:
          path: C:\my-stunnel
--- a/.mailmap
+++ b/.mailmap
@ -120,3 +120,4 @@ Sinkevich Artem <artsin666@gmail.com>
 Andrew Kirillov <akirillo@uk.ibm.com>
 Stephen Farrell <stephen.farrell@cs.tcd.ie>
 Calvin Ruocco <calvin.ruocco@vector.com>
+Hamza Bensliman <benslimanhamza99@gmail.com>
--- a/CMake/CurlTests.c
+++ b/CMake/CurlTests.c
@ -27,7 +27,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 #include <fcntl.h>
-/* */
+
 #if defined(sun) || defined(__sun__) || \
  defined(__SUNPRO_C) || defined(__SUNPRO_CC)
 #  if defined(__SVR4) || defined(__srv4__)
@ -39,7 +39,7 @@
 #if (defined(_AIX) || defined(__xlC__)) && !defined(_AIX41)
 #  define PLATFORM_AIX_V3
 #endif
-/* */
+
 #if defined(PLATFORM_SUNOS4) || defined(PLATFORM_AIX_V3)
 #error "O_NONBLOCK does not work on this platform"
 #endif
--- a/CMake/FindLibrtmp.cmake
+++ b/CMake/FindLibrtmp.cmake
@ -1,116 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the librtmp library
-#
-# Input variables:
-#
-# - `LIBRTMP_INCLUDE_DIR`:  Absolute path to librtmp include directory.
-# - `LIBRTMP_LIBRARY`:      Absolute path to `librtmp` library.
-#
-# Defines:
-#
-# - `LIBRTMP_FOUND`:        System has librtmp.
-# - `LIBRTMP_VERSION`:      Version of librtmp.
-# - `CURL::librtmp`:        librtmp library target.
-
-set(_librtmp_pc_requires "librtmp")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBRTMP_INCLUDE_DIR AND
-   NOT DEFINED LIBRTMP_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(_librtmp ${_librtmp_pc_requires})
-endif()
-
-if(_librtmp_FOUND AND _librtmp_INCLUDE_DIRS)
-  set(Librtmp_FOUND TRUE)
-  set(LIBRTMP_FOUND TRUE)
-  set(LIBRTMP_VERSION ${_librtmp_VERSION})
-  message(STATUS "Found Librtmp (via pkg-config): ${_librtmp_INCLUDE_DIRS} (found version \"${LIBRTMP_VERSION}\")")
-else()
-  find_path(LIBRTMP_INCLUDE_DIR NAMES "librtmp/rtmp.h")
-  find_library(LIBRTMP_LIBRARY NAMES "rtmp")
-
-  unset(LIBRTMP_VERSION CACHE)
-  if(LIBRTMP_INCLUDE_DIR AND EXISTS "${LIBRTMP_INCLUDE_DIR}/librtmp/rtmp.h")
-    set(_version_regex "#[\t ]*define[\t ]+RTMP_LIB_VERSION[\t ]+0x([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F]).*")
-    file(STRINGS "${LIBRTMP_INCLUDE_DIR}/librtmp/rtmp.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str1 "${_version_str}")
-    string(REGEX REPLACE "${_version_regex}" "\\2" _version_str2 "${_version_str}")
-    if(CMAKE_VERSION VERSION_LESS 3.13)
-      # No support for hex version numbers, just strip leading zeroes
-      string(REGEX REPLACE "^0" "" _version_str1 "${_version_str1}")
-      string(REGEX REPLACE "^0" "" _version_str2 "${_version_str2}")
-    else()
-      math(EXPR _version_str1 "0x${_version_str1}" OUTPUT_FORMAT DECIMAL)
-      math(EXPR _version_str2 "0x${_version_str2}" OUTPUT_FORMAT DECIMAL)
-    endif()
-    set(LIBRTMP_VERSION "${_version_str1}.${_version_str2}")
-    unset(_version_regex)
-    unset(_version_str1)
-    unset(_version_str2)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Librtmp
-    REQUIRED_VARS
-      LIBRTMP_INCLUDE_DIR
-      LIBRTMP_LIBRARY
-    VERSION_VAR
-      LIBRTMP_VERSION
-  )
-
-  if(LIBRTMP_FOUND)
-    set(_librtmp_INCLUDE_DIRS ${LIBRTMP_INCLUDE_DIR})
-    set(_librtmp_LIBRARIES    ${LIBRTMP_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBRTMP_INCLUDE_DIR LIBRTMP_LIBRARY)
-
-  # Necessary when linking a static librtmp
-  find_package(OpenSSL)
-  if(OpenSSL_FOUND)
-    list(APPEND _librtmp_LIBRARIES OpenSSL::SSL OpenSSL::Crypto)
-  endif()
-endif()
-
-if(LIBRTMP_FOUND)
-  if(WIN32)
-    list(APPEND _librtmp_LIBRARIES "winmm")
-  endif()
-
-  if(CMAKE_VERSION VERSION_LESS 3.13)
-    link_directories(${_librtmp_LIBRARY_DIRS})
-  endif()
-
-  if(NOT TARGET CURL::librtmp)
-    add_library(CURL::librtmp INTERFACE IMPORTED)
-    set_target_properties(CURL::librtmp PROPERTIES
-      INTERFACE_LIBCURL_PC_MODULES "${_librtmp_pc_requires}"
-      INTERFACE_COMPILE_OPTIONS "${_librtmp_CFLAGS}"
-      INTERFACE_INCLUDE_DIRECTORIES "${_librtmp_INCLUDE_DIRS}"
-      INTERFACE_LINK_DIRECTORIES "${_librtmp_LIBRARY_DIRS}"
-      INTERFACE_LINK_LIBRARIES "${_librtmp_LIBRARIES}")
-  endif()
-endif()
--- a/CMake/Macros.cmake
+++ b/CMake/Macros.cmake
@ -107,14 +107,14 @@ macro(curl_collect_target_options _target)
  if(_val)
    list(APPEND _definitions ${_val})
  endif()
-  get_target_property(_val ${_target} INTERFACE_INCLUDE_DIRECTORIES)
-  if(_val)
-    list(APPEND _includes ${_val})
-  endif()
  get_target_property(_val ${_target} INCLUDE_DIRECTORIES)
  if(_val)
    list(APPEND _includes ${_val})
  endif()
+  get_target_property(_val ${_target} INTERFACE_INCLUDE_DIRECTORIES)
+  if(_val)
+    list(APPEND _incsys ${_val})
+  endif()
  get_target_property(_val ${_target} COMPILE_OPTIONS)
  if(_val)
    list(APPEND _options ${_val})
@ -131,13 +131,26 @@ macro(curl_collect_target_options _target)
 endmacro()

 # Create a clang-tidy target for test targets
-macro(curl_add_clang_tidy_test_target _target_clang_tidy _target)
+function(curl_add_clang_tidy_test_target _target_clang_tidy _target)
  if(CURL_CLANG_TIDY)

    set(_definitions "")
    set(_includes "")
+    set(_incsys "")
    set(_options "")

+    # Make a list of known system include directories
+    set(_sys_incdirs "${CMAKE_C_IMPLICIT_INCLUDE_DIRECTORIES}")
+    foreach(_inc IN LISTS CMAKE_SYSTEM_PREFIX_PATH)
+      if(NOT _inc MATCHES "/$")
+        string(APPEND _inc "/")
+      endif()
+      string(APPEND _inc "include")
+      if(NOT _inc IN_LIST _sys_incdirs AND IS_DIRECTORY "${_inc}")
+        list(APPEND _sys_incdirs "${_inc}")
+      endif()
+    endforeach()
+
    # Collect macro definitions and header directories applying to the directory
    get_directory_property(_val COMPILE_DEFINITIONS)
    if(_val)
@ -161,16 +174,31 @@ macro(curl_add_clang_tidy_test_target _target_clang_tidy _target)
    list(REMOVE_DUPLICATES _definitions)
    list(SORT _definitions)  # Sort like CMake does

-    set(_includes_tmp ${_includes})
-    set(_includes)
-    foreach(_inc IN LISTS _includes_tmp)
-      # Avoid empty and '$<INSTALL_INTERFACE:include>' items. The latter also
-      # evaluates to an empty path in this context.
-      if(_inc AND NOT _inc MATCHES "INSTALL_INTERFACE:")
-        list(APPEND _includes "-I${_inc}")
+    list(REMOVE_ITEM _includes "")
+    string(REPLACE ";" ";-I" _includes ";${_includes}")
+    list(REMOVE_DUPLICATES _includes)
+
+    set(_incsys_tmp ${_incsys})
+    list(REMOVE_DUPLICATES _incsys_tmp)
+    set(_incsys "")
+    set(_incsystop "")
+    foreach(_inc IN LISTS _incsys_tmp)
+      if(_inc IN_LIST _sys_incdirs)
+        list(APPEND _incsystop "${_inc}")  # Save system prefixes to re-add them later to the end of list
+        continue()
+      endif()
+      # Avoid empty and '$<INSTALL_INTERFACE:include>' items. The latter
+      # evaluates to an empty path in this context. Also skip
+      # '$<BUILD_INTERFACE:curl-include>', as already present in '_includes'.
+      if(_inc AND
+         NOT _inc MATCHES "INSTALL_INTERFACE:" AND
+         NOT _inc MATCHES "BUILD_INTERFACE:")
+        list(APPEND _incsys "-isystem" "${_inc}")
      endif()
    endforeach()
-    list(REMOVE_DUPLICATES _includes)
+    foreach(_inc IN LISTS _incsystop)
+      list(APPEND _incsys "-isystem" "${_inc}")
+    endforeach()

    if(CMAKE_C_COMPILER_ID MATCHES "Clang")
      list(REMOVE_DUPLICATES _options)  # Keep the first of duplicates to imitate CMake
@ -202,14 +230,8 @@ macro(curl_add_clang_tidy_test_target _target_clang_tidy _target)
      WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
      COMMAND ${CMAKE_C_CLANG_TIDY}
        "--checks=-clang-diagnostic-unused-function"
-        ${_sources} -- ${_cc} ${_definitions} ${_includes} ${_options}
+        ${_sources} -- ${_cc} ${_definitions} ${_includes} ${_incsys} ${_options}
      DEPENDS ${_sources})
    add_dependencies(tests-clang-tidy ${_target_clang_tidy})
-
-    unset(_cc)
-    unset(_definitions)
-    unset(_includes)
-    unset(_options)
-    unset(_sources)
  endif()
-endmacro()
+endfunction()
--- a/CMake/PickyWarnings.cmake
+++ b/CMake/PickyWarnings.cmake
@ -161,7 +161,7 @@ if(PICKY_COMPILER)
      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.1)
        list(APPEND _picky_enable
          -Wno-covered-switch-default      # clang  3.1            appleclang  3.1  # Annoying to fix or silence
-          -Wno-disabled-macro-expansion    # clang  3.1            appleclang  3.1  # Triggered by standard headers
+          -Wno-disabled-macro-expansion    # clang  3.1            appleclang  3.1  # Triggered by curl/curl.h, standard headers
        )
        if(MSVC)
          list(APPEND _picky_enable
@ -251,20 +251,22 @@ if(PICKY_COMPILER)
          -Wno-format-signedness           # clang 19.1  gcc  5.1  appleclang 17.0  # In clang-cl enums are signed ints by default
        )
      endif()
-      if(CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 21.1)
+      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 21.1) OR
+         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 26.4))
        list(APPEND _picky_enable
-          -Warray-compare                  # clang 20.1  gcc 12.0  appleclang ?
-          -Wc++-hidden-decl                # clang 21.1            appleclang ?
-          -Wno-implicit-void-ptr-cast      # clang 21.1            appleclang ?
-          -Wtentative-definition-compat    # clang 21.1            appleclang ?
+          -Warray-compare                  # clang 20.1  gcc 12.0  appleclang 26.4
+          -Wc++-hidden-decl                # clang 21.1            appleclang 26.4
+          -Wjump-misses-init               # clang 21.1  gcc  4.5  appleclang 26.4
+          -Wno-implicit-void-ptr-cast      # clang 21.1            appleclang 26.4
+          -Wtentative-definition-compat    # clang 21.1            appleclang 26.4
        )
        if(WIN32)
          list(APPEND _picky_enable
-            -Wno-c++-keyword               # clang 21.1            appleclang ?  # `wchar_t` triggers it on Windows
+            -Wno-c++-keyword               # clang 21.1            appleclang 26.4  # `wchar_t` triggers it on Windows
          )
        else()
          list(APPEND _picky_enable
-            -Wc++-keyword                  # clang 21.1            appleclang ?
+            -Wc++-keyword                  # clang 21.1            appleclang 26.4
          )
        endif()
      endif()
@ -283,7 +285,7 @@ if(PICKY_COMPILER)
      endif()
      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 4.5)
        list(APPEND _picky_enable
-          -Wjump-misses-init               #             gcc  4.5
+          -Wjump-misses-init               # clang 21.1  gcc  4.5  appleclang 26.4
        )
        if(MINGW)
          list(APPEND _picky_enable
@ -331,7 +333,7 @@ if(PICKY_COMPILER)
      endif()
      if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 13.0)
        list(APPEND _picky_enable
-          -Warray-compare                  # clang 20.0  gcc 12.0  appleclang ?
+          -Warray-compare                  # clang 20.1  gcc 12.0  appleclang 26.4
          -Wenum-int-mismatch              #             gcc 13.0
          -Wxor-used-as-pow                # clang 10.0  gcc 13.0  appleclang 12.0
        )
@ -404,12 +406,11 @@ if(PICKY_COMPILER)
    list(APPEND _picky "-wd4548")  # expression before comma has no effect; expected expression with side-effect (in FD_SET())
    list(APPEND _picky "-wd4574")  # 'M' is defined to be '0': did you mean to use '#if M'? (in ws2tcpip.h)
    list(APPEND _picky "-wd4668")  # 'M' is not defined as a preprocessor macro, replacing with '0' for '#if/#elif' (in winbase.h)
-    list(APPEND _picky "-wd4710")  # 'snprintf': function not inlined
+    list(APPEND _picky "-wd4710")  # 'fprintf'/'printf'/'sscanf': function not inlined (in tests, with VS2022+ Release)
    list(APPEND _picky "-wd4711")  # function 'A' selected for automatic inline expansion
    # volatile access of '<expression>' is subject to /volatile:<iso|ms> setting;
    #   consider using __iso_volatile_load/store intrinsic functions (ARM64)
    list(APPEND _picky "-wd4746")
-    list(APPEND _picky "-wd4774")  # 'snprintf': format string expected in argument 3 is not a string literal
    list(APPEND _picky "-wd4820")  # 'A': 'N' bytes padding added after data member 'B'
    if(MSVC_VERSION GREATER_EQUAL 1900)
      list(APPEND _picky "-wd5045")  # Compiler will insert Spectre mitigation for memory load if /Qspectre switch specified
--- a/CMake/curl-config.in.cmake
+++ b/CMake/curl-config.in.cmake
@ -93,10 +93,6 @@ if("@USE_LIBPSL@")
  find_dependency(Libpsl)
  list(APPEND _curl_libs CURL::libpsl)
 endif()
-if("@USE_LIBRTMP@")
-  find_dependency(Librtmp)
-  list(APPEND _curl_libs CURL::librtmp)
-endif()
 if("@USE_LIBSSH@")
  find_dependency(Libssh)
  list(APPEND _curl_libs CURL::libssh)
@ -176,9 +172,11 @@ if(TARGET @PROJECT_NAME@::@LIB_STATIC@)
  if(NOT _has_CMP0099 AND CMAKE_VERSION VERSION_GREATER_EQUAL 3.13 AND _curl_libs)
    set(_curl_libdirs "")
    foreach(_curl_lib IN LISTS _curl_libs)
-      get_target_property(_curl_libdir "${_curl_lib}" INTERFACE_LINK_DIRECTORIES)
-      if(_curl_libdir)
-        list(APPEND _curl_libdirs "${_curl_libdir}")
+      if(TARGET "${_curl_lib}")
+        get_target_property(_curl_libdir "${_curl_lib}" INTERFACE_LINK_DIRECTORIES)
+        if(_curl_libdir)
+          list(APPEND _curl_libdirs "${_curl_libdir}")
+        endif()
      endif()
    endforeach()
    if(_curl_libdirs)
--- a/CMake/win32-cache.cmake
+++ b/CMake/win32-cache.cmake
@ -33,7 +33,6 @@ if(MINGW)
  set(HAVE_GETTIMEOFDAY 1)
  set(HAVE_LIBGEN_H 1)
  set(HAVE_OPENDIR 1)
-  set(HAVE_SNPRINTF 1)
  set(HAVE_STDBOOL_H 1)
  set(HAVE_STDDEF_H 1)  # detected by CMake internally in check_type_size()
  set(HAVE_STDINT_H 1)  # detected by CMake internally in check_type_size()
@ -60,11 +59,6 @@ else()
      set(HAVE_STDBOOL_H 0)
    endif()
    set(HAVE_BOOL_T "${HAVE_STDBOOL_H}")
-    if(MSVC_VERSION GREATER_EQUAL 1900)
-      set(HAVE_SNPRINTF 1)
-    else()
-      set(HAVE_SNPRINTF 0)
-    endif()
    set(HAVE_BASENAME 0)
  endif()
 endif()
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -883,6 +883,10 @@ if(CURL_USE_WOLFSSL)
  endif()
  set(_curl_ca_bundle_supported TRUE)

+  if(USE_OPENSSL AND WOLFSSL_VERSION VERSION_LESS 5.7.6)
+    message(FATAL_ERROR "wolfSSL 5.7.6 or newer is required to coexist with OpenSSL.")
+  endif()
+
  set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "WOLFSSL_OPTIONS_IGNORE_SYS")
 endif()

@ -1334,12 +1338,6 @@ if(CURL_USE_LIBUV)
  set(HAVE_UV_H ON)
 endif()

-option(USE_LIBRTMP "Enable librtmp from rtmpdump" OFF)
-if(USE_LIBRTMP)
-  find_package(Librtmp REQUIRED)
-  list(APPEND CURL_LIBS CURL::librtmp)
-endif()
-
 option(ENABLE_UNIX_SOCKETS "Enable Unix domain sockets support" ON)
 if(ENABLE_UNIX_SOCKETS)
  if(WIN32 OR DOS)
@ -1629,6 +1627,7 @@ if(NOT WIN32)
  check_function_exists("if_nametoindex"  HAVE_IF_NAMETOINDEX)  # net/if.h
  check_function_exists("realpath"        HAVE_REALPATH)
  check_function_exists("sched_yield"     HAVE_SCHED_YIELD)
+  check_function_exists("snprintf"        HAVE_SNPRINTF)  # to match detection method in ./configure
  check_symbol_exists("strcasecmp"        "string.h" HAVE_STRCASECMP)
  check_symbol_exists("stricmp"           "string.h" HAVE_STRICMP)
  check_symbol_exists("strcmpi"           "string.h" HAVE_STRCMPI)
@ -1642,11 +1641,6 @@ if(NOT _ssl_enabled)
  check_symbol_exists("arc4random" "${CURL_INCLUDES};stdlib.h" HAVE_ARC4RANDOM)
 endif()

-if(NOT MSVC)
-  check_function_exists("snprintf" HAVE_SNPRINTF)  # to match detection method in ./configure
-elseif(MSVC_VERSION GREATER_EQUAL 1900)  # Earlier MSVC compilers had faulty snprintf implementations
-  check_symbol_exists("snprintf" "stdio.h" HAVE_SNPRINTF)  # snprintf may be a compatibility macro, not an exported function
-endif()
 if(APPLE)
  check_function_exists("mach_absolute_time" HAVE_MACH_ABSOLUTE_TIME)
 endif()
@ -1982,7 +1976,6 @@ curl_add_if("SFTP"          USE_LIBSSH2 OR USE_LIBSSH)
 curl_add_if("IPFS"          NOT CURL_DISABLE_IPFS)
 curl_add_if("IPNS"          NOT CURL_DISABLE_IPFS)
 curl_add_if("RTSP"          NOT CURL_DISABLE_RTSP)
-curl_add_if("RTMP"          USE_LIBRTMP)
 curl_add_if("MQTT"          NOT CURL_DISABLE_MQTT)
 curl_add_if("MQTTS"         NOT CURL_DISABLE_MQTT AND _ssl_enabled)
 curl_add_if("WS"            NOT CURL_DISABLE_WEBSOCKETS)
@ -2200,8 +2193,7 @@ if(NOT CURL_DISABLE_INSTALL)
            if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
              cmake_path(SET _libdir NORMALIZE "${_libdir}")
            endif()
-            list(FIND _sys_libdirs "${_libdir}" _libdir_index)
-            if(_libdir_index LESS 0)
+            if(NOT _libdir IN_LIST _sys_libdirs)
              list(APPEND _ldflags "-L${_libdir}")
            endif()
            string(REGEX REPLACE "^lib" "" _libname "${_libname}")
@ -2229,8 +2221,7 @@ if(NOT CURL_DISABLE_INSTALL)
    if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
      cmake_path(SET _libdir NORMALIZE "${_libdir}")
    endif()
-    list(FIND _sys_libdirs "${_libdir}" _libdir_index)
-    if(_libdir_index LESS 0)
+    if(NOT _libdir IN_LIST _sys_libdirs)
      list(APPEND _ldflags "-L${_libdir}")
    endif()
  endforeach()
@ -2335,8 +2326,7 @@ if(NOT CURL_DISABLE_INSTALL)
    FILES_MATCHING PATTERN "*.h")

  include(CMakePackageConfigHelpers)
-  write_basic_package_version_file(
-    "${_version_config}"
+  write_basic_package_version_file("${_version_config}"
    VERSION ${_curl_version}
    COMPATIBILITY SameMajorVersion)
  file(READ "${_version_config}" _generated_version_config)
@ -2368,7 +2358,6 @@ if(NOT CURL_DISABLE_INSTALL)
  #   USE_GNUTLS
  #   USE_GSASL
  #   USE_LIBPSL
-  #   USE_LIBRTMP
  #   USE_LIBSSH
  #   USE_LIBSSH2
  #   USE_LIBUV
@ -2405,7 +2394,6 @@ if(NOT CURL_DISABLE_INSTALL)
      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibgsasl.cmake"
      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibidn2.cmake"
      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibpsl.cmake"
-      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibrtmp.cmake"
      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibssh.cmake"
      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibssh2.cmake"
      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/FindLibuv.cmake"
--- a/2
+++ b/2
@ -24,7 +24,7 @@
 #   $ ./scripts/maketgz 8.7.1

 # To update, get the latest digest e.g. from https://hub.docker.com/_/debian/tags
-FROM debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe
+FROM debian:bookworm-slim@sha256:74d56e3931e0d5a1dd51f8c8a2466d21de84a271cd3b5a733b803aa91abf4421

 RUN apt-get update -qq && apt-get install -qq -y --no-install-recommends \
    build-essential make autoconf automake libtool git perl zip zlib1g-dev gawk && \
--- a/Makefile.am
+++ b/Makefile.am
@ -40,7 +40,6 @@ CMAKE_DIST =                                     \
  CMake/FindLibgsasl.cmake                       \
  CMake/FindLibidn2.cmake                        \
  CMake/FindLibpsl.cmake                         \
-  CMake/FindLibrtmp.cmake                        \
  CMake/FindLibssh.cmake                         \
  CMake/FindLibssh2.cmake                        \
  CMake/FindLibuv.cmake                          \
@ -62,6 +61,7 @@ CMAKE_DIST =                                     \
  CMakeLists.txt                                 \
  tests/cmake/CMakeLists.txt                     \
  tests/cmake/test.c                             \
+  tests/cmake/test.cpp                           \
  tests/cmake/test.sh

 EXTRA_DIST = CHANGES.md COPYING RELEASE-NOTES Dockerfile .clang-tidy.yml .editorconfig $(CMAKE_DIST)
--- a/README.md
+++ b/README.md
@ -8,8 +8,8 @@ SPDX-License-Identifier: curl

 curl is a command-line tool for transferring data from or to a server using
 URLs. It supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS,
-HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTMP, RTMPS,
-RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP,
+SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.

 Learn how to use curl by reading [the
 man page](https://curl.se/docs/manpage.html) or [everything
--- a/113
+++ b/113
@ -4,7 +4,7 @@ curl and libcurl 8.19.0
 Command line options:         273
 curl_easy_setopt() options:   308
 Public functions in libcurl:  100
- Contributors:                 3601
+ Contributors:                 3609

 This release includes the following changes:

@ -21,12 +21,16 @@ This release includes the following bugfixes:

 o altsvc: only accept 17 byte dates from files [22]
 o asyn-ares: abort with OOM error when Curl_dnscache_mk_entry fails [107]
+ o build: add missing `GENERATEDCERTS` files [210]
+ o build: adjust minimum version for some clang picky warnings [211]
 o build: check `MSG_NOSIGNAL` directly, drop detection and interim macro [26]
 o build: constify `memchr()`/`strchr()`/etc result variables (cont.) [85]
 o build: detect and include `inttypes.h` again [13]
+ o build: do not include wolfSSL header in `curl_setup.h` [215]
 o build: drop duplicate C includes [54]
 o build: drop global suppression of `-Wformat-nonliteral`, fix fallouts [19]
 o build: fix `-Wunused-macros` warnings, and related tidy-ups [176]
+ o build: fix building rare combinations [109]
 o build: fully omit verbose strings and code when disabled [113]
 o build: globally suppress DJGPP warnings in `FD_SET()` [56]
 o build: merge TrackMemory (`CURLDEBUG`) into debug-enabled option [46]
@ -38,13 +42,29 @@ This release includes the following bugfixes:
 o checksrc-all.pl: skip non-repository files [144]
 o checksrc: do not apply `BANNEDFUNC` to struct member functions [35]
 o checksrc: warn for leading spaces before the preprocessor hash [72]
+ o clang-tidy: add missing and delete redundant parentheses [155]
+ o clang-tidy: add more missing parentheses in macro values [224]
+ o clang-tidy: avoid/silence `bugprone-not-null-terminated-result` [222]
+ o clang-tidy: check `bugprone-macro-parentheses`, fix fallouts [212]
+ o clang-tidy: drop redundant conditions reported by `misc-redundant-expression` [217]
+ o clang-tidy: enable `bugprone-signed-char-misuse`, fix fallouts [227]
+ o clang-tidy: enable more checks [225]
+ o clang-tidy: enable scanning headers [205]
 o cmake/FindMbedTLS: add workaround for missing static MSVC `mbedcrypto.lib` 4.0.0 [174]
 o cmake: add `CURL_DROP_UNUSED` option to reduce binary sizes [105]
+ o cmake: add native clang-tidy support for tests, with concatenated sources [223]
+ o cmake: always build curlu and curltool test libs in unity mode [190]
 o cmake: always define `CURL::win32_winsock` on Windows in `curl-config.cmake` [104]
 o cmake: enable binutils ld workaround for all toolchains at build-time [57]
+ o cmake: fix confusing error when a dependency is undetected in `curl-config.cmake` [169]
 o cmake: fix logic for openssl/zlib binutils ld workaround [71]
+ o cmake: fix passing system header directories to clang-tidy for tests [221]
+ o cmake: minor fixes to test targets after prev [214]
 o cmake: normalize uppercase hex winver (for display) [191]
+ o cmake: omit `curl.rc` from curltool lib [209]
 o cmake: reference OpenSSL and ZLIB imported targets only when enabled [41]
+ o cmake: replace internal option with a new `tt` (test tools) target [220]
+ o cmake: silence potential unused var warnings in C++ test snippet [201]
 o cmake: silence silly Apple clang warnings in C89 mode, test in CI [14]
 o cmake: silence useless compiler warnings triggered by the FASTBuild generator [43]
 o cmake: skip binutils ld hack if zlib/openssl target is not `IMPORTED` [90]
@ -70,16 +90,20 @@ This release includes the following bugfixes:
 o docs/INSTALL: update configure details [45]
 o docs/libcurl: unify WARNING use [89]
 o docs: add LibreELEC to DISTROS.md
+ o docs: add reproducible example for generating man page [95]
 o docs: clarify --ipv4 and --ipv6 [149]
 o docs: document the need for a 64-bit type and stdint.h [118]
 o docs: explicitly call out Slowloris as not a security flaw [6]
 o docs: fix grammar nitpicks [128]
 o docs: reword explanation of --variable option [150]
+ o docs: use dot instead of comma at end of sentences [168]
 o easy: reset errorbuf on eyeballing success [179]
+ o easy: reset pausing when resetting request [218]
 o examples/usercertinmem: use modern OpenSSL API, drop mentions of RSA [188]
 o examples: omit forward declarations, apply misc fixes [60]
 o fopen.h: simplify curl memory macro mappings [160]
 o ftp: replace a `curlx_free()` with `curlx_dyn_free()` [86]
+ o ftp: split ftp_state_use_port into sub functions [172]
 o GOVERNANCE.md: Post-Daniel BDFL [31]
 o gss: exclude verbose error logic from non-verbose builds [122]
 o h2+h3: align stream close handling [131]
@ -113,8 +137,10 @@ This release includes the following bugfixes:
 o libtests: drop two redundant `memset()`s [110]
 o Makefile.am: delete RPM targets referencing non-existent files [9]
 o Makefile.am: drop stray VC project files from dist [5]
+ o managen: silence Perl warnings [141]
 o mbedtls: no pinnedpubkey wo MBEDTLS_SSL_KEEP_PEER_CERTIFICATE [29]
 o mbedtls: remove newline from failf() call [25]
+ o mbedtls: split mbed_connect_step1 into sub functions [166]
 o md4, md5: drop redundant forward declarations [64]
 o md4, md5: replace custom types with `uint32_t` [111]
 o memdebug: include `backtrace.h` as system header [148]
@ -128,6 +154,7 @@ This release includes the following bugfixes:
 o mqtt: verify Remaining Length for CONNACK and PUBACK [153]
 o msvc: drop exception, make `BIT()` a bitfield with Visual Studio [2]
 o msvc: VS2026: unlock picky warning in cmake, test in CI [198]
+ o multi: avoid a theoretical 32-bit wrap [186]
 o multi: probe for IPv6 functionality in multi_init() [114]
 o multi: split multi_runsingle into sub functions [197]
 o multi: update timer unconditionally in multi_remove_handle [158]
@ -136,17 +163,24 @@ This release includes the following bugfixes:
 o openldap: avoid forward declarations in ldaps code [62]
 o OpenSSL: check reuse of sessions for verify status [142]
 o openssl: disable local keylog feature if built-in upstream [178]
+ o openssl: fix compiler warning with OpenSSL master [193]
+ o openssl: fix potential NULL dereference when loading certs (Windows) [165]
+ o openssl: fix potential OOB read in debug/verbose logging [216]
 o plan9: drop special build and orphaned references [33]
 o pytest: remove 03_02 [127]
 o ratelimit: download finetune [16]
+ o request.h: rename parameter 'buf' to 'req' in Curl_req_send [219]
 o REUSE: drop broken reference to `MAIL-ETIQUETTE` [59]
+ o rtsp: fix assertion failure on zero-length RTP payload [180]
 o rtspd: fix to check `realloc()` result [173]
 o runtests: pass config filename to stunnel in native format (Windows) [94]
 o schannel: refactor: reduce variable scopes, fix comment, fix indent [196]
 o send: drop `CURL_UNCONST()` from buffer argument on most platforms [116]
 o setopt: fix checking range for CURLOPT_MAXCONNECTS [92]
+ o setopt: refuse blobs with zero length [167]
 o setup-os400.h: drop no longer used custom type `u_int32_t` [112]
 o sigpipe: unset SA_SIGINFO since it is using sa_handler [40]
+ o silent.md: also mention it shuts off warning messages [213]
 o smb: include arpa/inet.h for NonStop [195]
 o socket: check result of SO_NOSIGPIPE [124]
 o socketpair: set SO_NOSIGPIPE where possible [103]
@ -154,6 +188,7 @@ This release includes the following bugfixes:
 o ssh: dedupe state change function [99]
 o sws: prevent "connection monitor" to say disconnect twice
 o tests/server/sockfilt: avoid possible endless loop on Windows [101]
+ o tests/server: fix to clear the complete `srvr_sockaddr_union_t` variable [207]
 o tests/server: tidy-up error messages (Windows) [102]
 o tests: avoid assignment in `if` conditions in `first.h` [126]
 o tests: convert base64 data to %b64[] [87]
@ -162,6 +197,7 @@ This release includes the following bugfixes:
 o tls: add new SSLSUPP flags for several options [32]
 o tls: remove checks for DEFAULT [136]
 o tool: enable header separation for HTTPS proxies [106]
+ o tool: improve config error messaging [208]
 o tool: improve error/warning messages when output filename sanitization fails [36]
 o tool: rename curl handle and result variable in `--libcurl`-generated code [146]
 o tool: return code variable consistency [84]
@ -174,6 +210,8 @@ This release includes the following bugfixes:
 o tool_getparam: avoid `-Wcomma` with Apple clang in C89 mode [38]
 o tool_operate: remove 'else' for VMS [3]
 o typos: silence false positives found in C code [164]
+ o unit3205: suppress two clang-tidy false positives [206]
+ o URL-SYNTAX.md: fix port number mistakes for IMAP and LDAP [200]
 o url.c: code/comment cleanup around conn creation [132]
 o url.h: fix `-Wdocumentation` [61]
 o url: fix reuse of connections using HTTP Negotiate [100]
@ -182,10 +220,12 @@ This release includes the following bugfixes:
 o urldata: convert 'long' fields to fixed variable types [47]
 o urldata: switch to uint* types [1]
 o verbose.md: explain the { and } prefixes [96]
+ o vquic: fix unused variable warning reported by clang-tidy [152]
 o vquic: handle SOCKEMSGSIZE correctly [129]
 o vtls: dedupe common on-session-reuse logic [98]
 o vtls: use ALPN http/1.0 & http/1.1 for HTTP/1.0 requests [123]
 o VULN-DISCLOSURE-POLICY.md: push reports to the web form [154]
+ o VULN-DISCLOSURE-POLICY.md: use hackerone [202]
 o winapi: use FormatMessageA instead of FormatMessageW [115]
 o windows: `USE_WINSOCK` to guard winsock2 code (where missing) [133]
 o windows: tidy up `wincrypt.h` / BoringSSL/AWS-LC coexist workaround [203]
@ -205,26 +245,29 @@ Planned upcoming removals include:
 o RTMP support
 o Support for c-ares versions before 1.16.0
 o Support for Windows XP/2003
+ o TLS-SRP support

 See https://curl.se/dev/deprecate.html

 This release would not have looked like this without help, code, reports and
 advice from friends like these:

-  Andrew Kvalheim, Anna Liberty, Arnav Purushotam, Arnav-Purushotam-CUBoulder,
-  Billy O'Neal, calm329, Christian Schmitz, Christian Schmitza,
-  cooldadpresident on github, Dag Haavi Finstad, Dan Fandrich,
-  Daniel Gustafsson, Daniel Lublin, Daniel Stenberg, Daniil Gentili, dEajL3kA,
-  dependabot[bot], Frank Buss, gudyuu on hackerone, Itay Bookstein,
-  Jacek Migacz, James Fuller, Jan Macku, jhauga, Joshua Vandaële, Juan Belon,
-  Kai Pastor, Maksim Ściepanienka, Marcel Raad, Megamouse on github,
-  Michał Antoniak, nono303 on github, Nuno Goncalves, Patrick Monnerat,
-  Paul Howarth, programmerlexi on github, Randall S. Becker, Ray Satiro,
-  renovate[bot], Rudi Heitbaum, Sascha Frinken, Spenser Black, Stefan Eissing,
-  tawmoto on github, Tenant HellTower, Thibault de Villèle,
-  Tim Friedrich Brüggemann, Tomáš Malý, tommy, Viktor Szakats, Wyuer on github,
-  z2_, Zhicheng Chen, Йоте
-  (54 contributors)
+  aisle-research-bot, Andrew Kvalheim, Anna Liberty, Arnav Purushotam,
+  Arnav-Purushotam-CUBoulder, Augment code, Billy O'Neal, calm329,
+  Christian Schmitz, Christian Schmitza, cooldadpresident on github,
+  Dag Haavi Finstad, dahmono on github, Dan Fandrich, Daniel Gustafsson,
+  Daniel Lublin, Daniel Stenberg, Daniil Gentili, David Korczynski, dEajL3kA,
+  dependabot[bot], Diogo Correia, Frank Buss, gudyuu on hackerone,
+  Hamza Bensliman, Itay Bookstein, Jacek Migacz, James Fuller, Jan Macku,
+  jhauga, Joshua Vandaële, Juan Belon, Kai Pastor, Maksim Ściepanienka,
+  Marcel Raad, Megamouse on github, Michał Antoniak, Natris on github,
+  nono303 on github, Nuno Goncalves, Patrick Monnerat, Paul Howarth,
+  programmerlexi on github, Randall S. Becker, Ray Satiro, renovate[bot],
+  Rudi Heitbaum, sammydono on github, Samuel Henrique, Sascha Frinken,
+  Spenser Black, Stefan Eissing, tawmoto on github, Tenant HellTower,
+  Thibault de Villèle, Tim Friedrich Brüggemann, Tomáš Malý, tommy, Val S.,
+  Viktor Szakats, Wyuer on github, z2_, Zhicheng Chen, Йоте
+  (64 contributors)

 References to bug reports and discussions on issues:

@ -322,6 +365,7 @@ References to bug reports and discussions on issues:
 [92] = https://curl.se/bug/?i=20414
 [93] = https://curl.se/bug/?i=20542
 [94] = https://curl.se/bug/?i=20413
+ [95] = https://curl.se/bug/?i=20699
 [96] = https://curl.se/bug/?i=20386
 [97] = https://curl.se/mail/lib-2026-01/0033.html
 [98] = https://curl.se/bug/?i=20475
@ -335,6 +379,7 @@ References to bug reports and discussions on issues:
 [106] = https://curl.se/bug/?i=20398
 [107] = https://curl.se/bug/?i=20385
 [108] = https://curl.se/bug/?i=20387
+ [109] = https://curl.se/bug/?i=20712
 [110] = https://curl.se/bug/?i=20649
 [111] = https://curl.se/bug/?i=20469
 [112] = https://curl.se/bug/?i=20470
@ -365,6 +410,7 @@ References to bug reports and discussions on issues:
 [138] = https://curl.se/bug/?i=20527
 [139] = https://curl.se/bug/?i=20452
 [140] = https://curl.se/bug/?i=20526
+ [141] = https://curl.se/bug/?i=20707
 [142] = https://curl.se/bug/?i=20435
 [143] = https://curl.se/bug/?i=20444
 [144] = https://curl.se/bug/?i=20439
@ -374,8 +420,10 @@ References to bug reports and discussions on issues:
 [148] = https://curl.se/bug/?i=20642
 [149] = https://curl.se/bug/?i=20585
 [150] = https://curl.se/bug/?i=20636
+ [152] = https://curl.se/bug/?i=20752
 [153] = https://curl.se/bug/?i=20513
 [154] = https://curl.se/bug/?i=20515
+ [155] = https://curl.se/bug/?i=20749
 [156] = https://curl.se/bug/?i=20508
 [157] = https://curl.se/bug/?i=20510
 [158] = https://curl.se/bug/?i=20498
@ -385,23 +433,58 @@ References to bug reports and discussions on issues:
 [162] = https://curl.se/bug/?i=20497
 [163] = https://curl.se/bug/?i=20499
 [164] = https://curl.se/bug/?i=20500
+ [165] = https://curl.se/bug/?i=20634
+ [166] = https://curl.se/bug/?i=20689
+ [167] = https://curl.se/bug/?i=20705
+ [168] = https://curl.se/bug/?i=20700
+ [169] = https://curl.se/bug/?i=20737
+ [172] = https://curl.se/bug/?i=20685
 [173] = https://curl.se/bug/?i=20621
 [174] = https://curl.se/bug/?i=20616
 [176] = https://curl.se/bug/?i=20593
 [177] = https://curl.se/bug/?i=20620
 [178] = https://curl.se/bug/?i=20611
 [179] = https://curl.se/bug/?i=20608
+ [180] = https://curl.se/bug/?i=20735
 [181] = https://curl.se/bug/?i=20607
 [182] = https://curl.se/bug/?i=20597
 [183] = https://curl.se/bug/?i=20584
 [185] = https://curl.se/bug/?i=20601
+ [186] = https://curl.se/bug/?i=20742
 [188] = https://curl.se/bug/?i=20595
 [189] = https://curl.se/bug/?i=20587
+ [190] = https://curl.se/bug/?i=20677
 [191] = https://curl.se/bug/?i=20586
 [192] = https://curl.se/bug/?i=20582
+ [193] = https://curl.se/bug/?i=20681
 [194] = https://curl.se/bug/?i=20568
 [195] = https://curl.se/bug/?i=20579
 [196] = https://curl.se/bug/?i=20569
 [197] = https://curl.se/bug/?i=20573
 [198] = https://curl.se/bug/?i=20577
+ [200] = https://curl.se/bug/?i=20679
+ [201] = https://curl.se/bug/?i=20736
+ [202] = https://curl.se/bug/?i=20683
 [203] = https://curl.se/bug/?i=20567
+ [205] = https://curl.se/bug/?i=20720
+ [206] = https://curl.se/bug/?i=20731
+ [207] = https://curl.se/bug/?i=20730
+ [208] = https://curl.se/bug/?i=20598
+ [209] = https://curl.se/bug/?i=20671
+ [210] = https://curl.se/bug/?i=20728
+ [211] = https://curl.se/bug/?i=20665
+ [212] = https://curl.se/bug/?i=20647
+ [213] = https://curl.se/bug/?i=20664
+ [214] = https://curl.se/bug/?i=20727
+ [215] = https://curl.se/bug/?i=20726
+ [216] = https://curl.se/bug/?i=20654
+ [217] = https://curl.se/bug/?i=20644
+ [218] = https://curl.se/bug/?i=20641
+ [219] = https://curl.se/bug/?i=20660
+ [220] = https://curl.se/bug/?i=20708
+ [221] = https://curl.se/bug/?i=20670
+ [222] = https://curl.se/bug/?i=20723
+ [223] = https://curl.se/bug/?i=20667
+ [224] = https://curl.se/bug/?i=20721
+ [225] = https://curl.se/bug/?i=20622
+ [227] = https://curl.se/bug/?i=20654
--- a/appveyor.sh
+++ b/appveyor.sh
@ -88,8 +88,8 @@ if [ -n "${CMAKE_GENERATOR:-}" ]; then
      -DCURL_STATIC_CRT=ON \
      -DCURL_DROP_UNUSED=ON \
      -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF \
-      ${CMAKE_GENERATE:-} \
      ${options} \
+      ${CMAKE_GENERATE:-} \
      || { cat "${root}"/_bld/CMakeFiles/CMake* 2>/dev/null; false; }
    [ "${APPVEYOR_BUILD_WORKER_IMAGE}" = 'Visual Studio 2013' ] && cd ..
  done
--- a/appveyor.yml
+++ b/appveyor.yml
@ -142,3 +142,5 @@ skip_commits:
 #    name: curl
 #  - path: '**/*.dll'
 #    name: libcurl dll
+#  - path: '**/*.lib'
+#    name: libcurl lib
--- a/configure.ac
+++ b/configure.ac
@ -165,7 +165,6 @@ curl_unix_sockets_msg="no       (--enable-unix-sockets)"
       curl_ldaps_msg="no       (--enable-ldaps)"
        curl_ipfs_msg="no       (--enable-ipfs)"
        curl_rtsp_msg="no       (--enable-rtsp)"
-        curl_rtmp_msg="no       (--with-librtmp)"
         curl_psl_msg="no       (--with-libpsl)"
      curl_altsvc_msg="enabled  (--disable-alt-svc)"
     curl_headers_msg="enabled  (--disable-headers-api)"
@ -2691,86 +2690,6 @@ if test "$CURL_DISABLE_LDAPS" != "1"; then
  curl_ldaps_msg="enabled"
 fi

-dnl **********************************************************************
-dnl Check for the presence of LIBRTMP libraries and headers
-dnl **********************************************************************
-
-dnl Default to compiler & linker defaults for LIBRTMP files & libraries.
-OPT_LIBRTMP=off
-AC_ARG_WITH(librtmp,dnl
-AS_HELP_STRING([--with-librtmp=PATH],[Where to look for librtmp, PATH points to the LIBRTMP installation; when possible, set the PKG_CONFIG_PATH environment variable instead of using this option])
-AS_HELP_STRING([--without-librtmp], [disable LIBRTMP]),
-  OPT_LIBRTMP=$withval)
-
-if test "x$OPT_LIBRTMP" != "xno"; then
-  dnl backup the pre-librtmp variables
-  CLEANLDFLAGS="$LDFLAGS"
-  CLEANLDFLAGSPC="$LDFLAGSPC"
-  CLEANCPPFLAGS="$CPPFLAGS"
-  CLEANLIBS="$LIBS"
-
-  case "$OPT_LIBRTMP" in
-    yes)
-      dnl --with-librtmp (without path) used
-      CURL_CHECK_PKGCONFIG(librtmp)
-
-      if test "$PKGCONFIG" != "no"; then
-        LIB_RTMP=`$PKGCONFIG --libs-only-l librtmp`
-        LD_RTMP=`$PKGCONFIG --libs-only-L librtmp`
-        CPP_RTMP=`$PKGCONFIG --cflags-only-I librtmp`
-        version=`$PKGCONFIG --modversion librtmp`
-        DIR_RTMP=`echo $LD_RTMP | $SED -e 's/^-L//'`
-      else
-        dnl To avoid link errors, we do not allow --librtmp without
-        dnl a pkgconfig file
-        AC_MSG_ERROR([--librtmp was specified but could not find librtmp pkgconfig file.])
-      fi
-      ;;
-    off)
-      dnl no --with-librtmp option given, just check default places
-      LIB_RTMP="-lrtmp"
-      ;;
-    *)
-      dnl use the given --with-librtmp spot
-      LIB_RTMP="-lrtmp"
-      PREFIX_RTMP=$OPT_LIBRTMP
-      ;;
-  esac
-
-  dnl if given with a prefix, we set -L and -I based on that
-  if test -n "$PREFIX_RTMP"; then
-    LD_RTMP=-L${PREFIX_RTMP}/lib$libsuff
-    CPP_RTMP=-I${PREFIX_RTMP}/include
-    DIR_RTMP=${PREFIX_RTMP}/lib$libsuff
-  fi
-
-  LDFLAGS="$LDFLAGS $LD_RTMP"
-  LDFLAGSPC="$LDFLAGSPC $LD_RTMP"
-  CPPFLAGS="$CPPFLAGS $CPP_RTMP"
-  LIBS="$LIB_RTMP $LIBS"
-
-  AC_CHECK_LIB(rtmp, RTMP_Init,
-    [
-      AC_CHECK_HEADERS(librtmp/rtmp.h,
-        curl_rtmp_msg="enabled (librtmp)"
-        AC_DEFINE(USE_LIBRTMP, 1, [if librtmp is in use])
-        USE_LIBRTMP=1
-        LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE librtmp"
-      )
-    ],
-      dnl not found, revert back to clean variables
-      LDFLAGS=$CLEANLDFLAGS
-      LDFLAGSPC=$CLEANLDFLAGSPC
-      CPPFLAGS=$CLEANCPPFLAGS
-      LIBS=$CLEANLIBS
-  )
-
-  if test "x$OPT_LIBRTMP" != "xoff" &&
-     test "$USE_LIBRTMP" != "1"; then
-    AC_MSG_ERROR([librtmp libs and/or directories were not found where specified!])
-  fi
-fi
-
 dnl **********************************************************************
 dnl Check for linker switch for versioned symbols
 dnl **********************************************************************
@ -4190,7 +4109,6 @@ AC_CHECK_FUNCS([\
  sendmsg \
  setlocale \
  setrlimit \
-  snprintf \
  utime \
  utimes \
 ])
@ -4200,6 +4118,7 @@ if test "$curl_cv_native_windows" != "yes"; then
    if_nametoindex \
    realpath \
    sched_yield \
+    snprintf \
  ])
  CURL_CHECK_FUNC_INET_NTOP
  CURL_CHECK_FUNC_INET_PTON
@ -5406,9 +5325,6 @@ fi
 if test "$CURL_DISABLE_RTSP" != "1"; then
  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS RTSP"
 fi
-if test "$USE_LIBRTMP" = "1"; then
-  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS RTMP"
-fi
 if test "$CURL_DISABLE_WEBSOCKETS" != "1"; then
  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS WS"
  if test "$SSL_ENABLED" = "1"; then
@ -5520,7 +5436,6 @@ AC_MSG_NOTICE([Configured to build curl/libcurl:
  LDAPS:            ${curl_ldaps_msg}
  IPFS/IPNS:        ${curl_ipfs_msg}
  RTSP:             ${curl_rtsp_msg}
-  RTMP:             ${curl_rtmp_msg}
  PSL:              ${curl_psl_msg}
  Alt-svc:          ${curl_altsvc_msg}
  Headers API:      ${curl_headers_msg}
--- a/docs/BINDINGS.md
+++ b/docs/BINDINGS.md
@ -9,7 +9,7 @@ libcurl bindings

 Creative people have written bindings or interfaces for various environments
 and programming languages. Using one of these allows you to take advantage of
-curl powers from within your favourite language or system.
+curl powers from within your favorite language or system.

 This is a list of all known interfaces as of this writing.

--- a/docs/CIPHERS.md
+++ b/docs/CIPHERS.md
@ -78,6 +78,7 @@ OpenSSL (1.1.1+, curl 7.61.0+), LibreSSL (3.4.1+, curl 8.3.0+),
 wolfSSL (curl 8.10.0+) and mbedTLS (3.6.0+, curl 8.10.0+).

 The list of cipher suites that can be used for the `--tls13-ciphers` option:
+
 ```
 TLS_AES_128_GCM_SHA256
 TLS_AES_256_GCM_SHA384
@ -118,6 +119,7 @@ A shortened list (based on [recommendations by
 Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS)) of cipher suites,
 which are (mostly) supported by all SSL backends, that can be used for the
 `--ciphers` option:
+
 ```
 ECDHE-ECDSA-AES128-GCM-SHA256
 ECDHE-RSA-AES128-GCM-SHA256
@ -180,6 +182,7 @@ curl \
 ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 \
  https://example.com/
 ```
+
 Restrict ciphers to `aes128-gcm` and `chacha20`. Works with OpenSSL, LibreSSL,
 mbedTLS and wolfSSL.

@ -189,6 +192,7 @@ curl \
  --tls13-ciphers TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 \
  https://example.com/
 ```
+
 Restrict to only TLS 1.3 with `aes128-gcm` and `chacha20` ciphers. Works with
 OpenSSL, LibreSSL, mbedTLS, wolfSSL and Schannel.

@ -198,6 +202,7 @@ curl \
 ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 \
  https://example.com/
 ```
+
 Restrict TLS 1.2 ciphers to `aes128-gcm` and `chacha20`, use default TLS 1.3
 ciphers (if TLS 1.3 is available). Works with OpenSSL, LibreSSL, BoringSSL,
 mbedTLS and wolfSSL.
@ -244,6 +249,7 @@ curl \
  --ciphers '-CIPHER_ALL:+AES-128-GCM:+CHACHA20-POLY1305' \
  https://example.com/
 ```
+
 Restrict ciphers to `aes128-gcm` and `chacha20` in GnuTLS.

 ```sh
@ -251,6 +257,7 @@ curl \
  --ciphers 'NORMAL:-VERS-ALL:+TLS1.3:-AES-256-GCM' \
  https://example.com/
 ```
+
 Restrict to only TLS 1.3 without the `aes256-gcm` cipher.

 ```sh
@ -258,9 +265,11 @@ curl \
  --ciphers 'NORMAL:-VERS-ALL:+TLS1.2:-CIPHER_ALL:+CAMELLIA-128-GCM' \
  https://example.com/
 ```
+
 Restrict to only TLS 1.2 with the `CAMELLIA-128-GCM` cipher.

 ## Further reading
+
 - [OpenSSL cipher suite names documentation](https://docs.openssl.org/master/man1/openssl-ciphers/#cipher-suite-names)
 - [wolfSSL cipher support documentation](https://www.wolfssl.com/documentation/manuals/wolfssl/chapter04.html#cipher-support)
 - [mbedTLS cipher suites reference](https://mbed-tls.readthedocs.io/projects/api/en/development/api/file/ssl__ciphersuites_8h/)
--- a/docs/CONTRIBUTE.md
+++ b/docs/CONTRIBUTE.md
@ -48,7 +48,7 @@ By submitting a patch to the curl project, you are assumed to have the right
 to the code and to be allowed by your employer or whatever to hand over that
 patch/code to us. We credit you for your changes as far as possible, to give
 credit but also to keep a trace back to who made what changes. Please always
-provide us with your full real name when contributing,
+provide us with your full real name when contributing.

 ## What To Read

--- a/docs/DEPRECATE.md
+++ b/docs/DEPRECATE.md
@ -16,24 +16,20 @@ how your use case cannot be satisfied properly using a workaround.

 In March 2026, we drop support for all c-ares versions before 1.16.0.

-## RTMP
-
-RTMP in curl is powered by the 3rd party library librtmp.
-
- RTMP is barely used by curl users (2.2% in the 2025 survey)
- librtmp has no test cases, makes no proper releases and has not had a single
-  commit within the last year
- librtmp parses the URL itself and requires non-compliant URLs for this
- we have no RTMP tests
-
-Support for RTMP in libcurl gets removed in April 2026.
-
 ## CMake 3.17 and earlier

 We remove support for CMake <3.18 in April 2026.

 CMake 3.18 was released on 2020-07-15.

+## TLS-SRP Authentication
+
+Transport Layer Security Secure Remote Password is a TLS feature that does not
+work with TLS 1.3 or QUIC and is virtually unused by curl users and in
+general.
+
+TLS-SRP support gets removed in August 2026.
+
 ## Past removals

 - axTLS (removed in 7.63.0)
@ -57,3 +53,4 @@ CMake 3.18 was released on 2020-07-15.
 - OpenSSL 1.1.1 and older (removed in 8.18.0)
 - Support for Windows XP (removed in 8.19.0)
 - OpenSSL-QUIC (removed in 8.19.0)
+- RTMP (removed in 8.20.0)
--- a/docs/ECH.md
+++ b/docs/ECH.md
@ -370,7 +370,7 @@ make
 There are some known issues with the ECH implementation in wolfSSL:

 - The main issue is that the client currently handles HelloRetryRequest
-  incorrectly.  [HRR issue](https://github.com/wolfSSL/wolfssl/issues/6802).)
+  incorrectly. [HRR issue](https://github.com/wolfSSL/wolfssl/issues/6802).)
  The HRR issue means that the client does not work for
  [this ECH test web site](https://tls-ech.dev/) and any other similarly
  configured sites.
@ -461,7 +461,7 @@ In another window:

 ```sh
 cd $HOME/code/curl/
-./src/curl -vvv --insecure  --connect-to foo.example.com:8443:localhost:8443  --ech ecl:AD7+DQA6uwAgACBix2B78sX+EQhEbxMspDOc8Z3xVS5aQpYP0Cxpc2AWPAAEAAEAAQALZXhhbXBsZS5jb20AAA==
+./src/curl -vvv --insecure --connect-to foo.example.com:8443:localhost:8443  --ech ecl:AD7+DQA6uwAgACBix2B78sX+EQhEbxMspDOc8Z3xVS5aQpYP0Cxpc2AWPAAEAAEAAQALZXhhbXBsZS5jb20AAA==
 ```

 ### Automated use of ``retry_configs`` not supported so far...
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@ -21,8 +21,8 @@ The curl project produces two products:
 ### libcurl

 A client-side URL transfer library, supporting DICT, FILE, FTP, FTPS, GOPHER,
-GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTMP,
-RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S,
+RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.

 libcurl supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading,
 Kerberos, SPNEGO, HTTP form based upload, proxies, cookies, user+password
--- a/docs/HISTORY.md
+++ b/docs/HISTORY.md
@ -318,6 +318,8 @@ December: Public Suffix List

 January: the curl tool defaults to HTTP/2 for HTTPS URLs

+June 26: Rafael Sagula, author of the original httpget tool in 1996 died.
+
 December: curl 7.52.0 introduced support for HTTPS-proxy

 First TLS 1.3 support
@ -490,3 +492,7 @@ We drop support for krb-ftp, Heimdal, wolfSSH and the winbuild build system.
 Add support for Apple SecTrust, native CA certs on Apple systems.

 December 15: the website served 78 TB over the last month.
+
+## 2026
+
+April: removed support for RTMP
--- a/docs/INSTALL-CMAKE.md
+++ b/docs/INSTALL-CMAKE.md
@ -380,7 +380,6 @@ Details via CMake
 - `USE_APPLE_IDN`:                          Use Apple built-in IDN support. Default: `OFF`
 - `USE_APPLE_SECTRUST`:                     Use Apple OS-native certificate verification. Default: `OFF`
 - `USE_LIBIDN2`:                            Use libidn2 for IDN support. Default: `ON`
- `USE_LIBRTMP`:                            Enable librtmp from rtmpdump. Default: `OFF`
 - `USE_NGHTTP2`:                            Use nghttp2 library. Default: `ON`
 - `USE_NGTCP2`:                             Use ngtcp2 and nghttp3 libraries for HTTP/3 support. Default: `OFF`
 - `USE_QUICHE`:                             Use quiche library for HTTP/3 support. Default: `OFF`
@ -431,8 +430,6 @@ Details via CMake
 - `LIBIDN2_LIBRARY`:                        Absolute path to `libidn2` library.
 - `LIBPSL_INCLUDE_DIR`:                     Absolute path to libpsl include directory.
 - `LIBPSL_LIBRARY`:                         Absolute path to `libpsl` library.
- `LIBRTMP_INCLUDE_DIR`:                    Absolute path to librtmp include directory.
- `LIBRTMP_LIBRARY`:                        Absolute path to `librtmp` library.
 - `LIBSSH_INCLUDE_DIR`:                     Absolute path to libssh include directory.
 - `LIBSSH_LIBRARY`:                         Absolute path to `libssh` library.
 - `LIBSSH_USE_STATIC_LIBS`:                 Configure for static libssh libraries. (experimental)
@ -552,11 +549,12 @@ Note: These variables are internal and subject to change.

 ## Useful build targets

- `testdeps`:               Build test dependencies (servers, tools, test certificates).
-                            Individual targets: `curlinfo`, `libtests`, `servers`, `tunits`, `units`
-                            Test certificates: `build-certs`, `clean-certs`
+- `testdeps`:               Build test dependencies (test binaries, test certificates).
+                            Test certificates: `build-certs` (clean with `clean-certs`)
 - `tests`:                  Run tests (`runtests.pl`). Customize via the `TFLAGS` environment variable, e.g. `TFLAGS=1621`.
                            Other flavors: `test-am`, `test-ci`, `test-event`, `test-full`, `test-nonflaky`, `test-quiet`, `test-torture`
+- `tt`:                     Build test binaries (servers, tools).
+                            Individual targets: `curlinfo`, `libtests`, `servers`, `tunits`, `units`
 - `curl-pytest`:            Run tests (pytest).
                            Other flavor: `curl-test-ci`
 - `curl-examples`:          Build examples
@ -564,6 +562,7 @@ Note: These variables are internal and subject to change.
                            where <name> is the .c filename without extension.
 - `curl-examples-build`:    Build examples quickly but without the ability to run them. (for build tests)
 - `curl-man`:               Build man pages. (built by default unless disabled)
+- `curl`:                   Build curl tool.
 - `curl_uninstall`:         Uninstall curl.
 - `curl-completion-fish`:   Build shell completions for fish. (built by default if enabled)
 - `curl-completion-zsh`:    Build shell completions for zsh. (built by default if enabled)
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@ -426,7 +426,7 @@ another SSL backend such as OpenSSL.

 # Android

-When building curl for Android you can you CMake or curl's `configure` script.
+When building curl for Android you can either use CMake or `configure`.

 Before you can build curl for Android, you need to install the Android NDK
 first. This can be done using the SDK Manager that is part of Android Studio.
@ -603,11 +603,11 @@ disabling support for some features (run `./configure --help` to see them all):
 - `--disable-libcurl-option` (--libcurl C code generation support)
 - `--disable-manual` (--manual built-in documentation)
 - `--disable-mime` (MIME API)
- `--disable-netrc`  (.netrc file)
+- `--disable-netrc` (.netrc file)
 - `--disable-progress-meter` (graphical progress meter in library)
 - `--disable-proxy` (HTTP and SOCKS proxies)
 - `--disable-socketpair` (socketpair for asynchronous name resolving)
- `--disable-threaded-resolver`  (threaded name resolver)
+- `--disable-threaded-resolver` (threaded name resolver)
 - `--disable-tls-srp` (Secure Remote Password authentication for TLS)
 - `--disable-unix-sockets` (Unix sockets)
 - `--disable-verbose` (eliminates debugging strings and error code strings)
@ -619,7 +619,6 @@ disabling support for some features (run `./configure --help` to see them all):
 - `--without-ngtcp2` (HTTP/2 using ngtcp2)
 - `--without-zstd` (Zstd on-the-fly decompression)
 - `--without-libidn2` (internationalized domain names)
- `--without-librtmp` (RTMP)
 - `--without-ssl` (SSL/TLS)
 - `--without-zlib` (gzip/deflate on-the-fly decompression)

--- a/docs/IPFS.md
+++ b/docs/IPFS.md
@ -5,6 +5,7 @@ SPDX-License-Identifier: curl
 -->

 # IPFS
+
 For an overview about IPFS, visit the [IPFS project site](https://ipfs.tech/).

 In IPFS there are two protocols. IPFS and IPNS (their workings are explained
@ -64,12 +65,12 @@ in this link:
 The IPFS integration in curl hides this gateway logic for you. Instead of
 providing a full URL to a file on IPFS like this:

-```
+```sh
 curl http://127.0.0.1:8080/ipfs/bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi
 ```

 You can provide it with the IPFS protocol instead:
-```
+```sh
 curl ipfs://bafybeigagd5nmnn2iys2f3doro7ydrevyr2mzarwidgadawmamiteydbzi
 ```

--- a/docs/TODO.md
+++ b/docs/TODO.md
@ -331,14 +331,6 @@ line.

 Additionally this should be implemented for proxy base URLs as well.

-## alt-svc should fallback if alt-svc does not work
-
-The `alt-svc:` header provides a set of alternative services for curl to use
-instead of the original. If the first attempted one fails, it should try the
-next etc and if all alternatives fail go back to the original.
-
-See [curl issue 4908](https://github.com/curl/curl/issues/4908)
-
 ## Require HTTP version X or higher

 curl and libcurl provide options for trying higher HTTP versions (for example
--- a/docs/URL-SYNTAX.md
+++ b/docs/URL-SYNTAX.md
@ -141,9 +141,8 @@ curl supports the following schemes on URLs specified to transfer. They are
 matched case insensitively:

 `dict`, `file`, `ftp`, `ftps`, `gopher`, `gophers`, `http`, `https`, `imap`,
-`imaps`, `ldap`, `ldaps`, `mqtt`, `pop3`, `pop3s`, `rtmp`, `rtmpe`, `rtmps`,
-`rtmpt`, `rtmpte`, `rtmpts`, `rtsp`, `smb`, `smbs`, `smtp`, `smtps`, `telnet`,
-`tftp`
+`imaps`, `ldap`, `ldaps`, `mqtt`, `pop3`, `pop3s`, `rtsp`, `smb`, `smbs`,
+`smtp`, `smtps`, `telnet`, `tftp`

 When the URL is specified to identify a proxy, curl recognizes the following
 schemes:
@ -209,10 +208,9 @@ only if the URL starts with a scheme.
 If the port number is not specified in the URL, curl uses a default port
 number based on the provide scheme:

-DICT 2628, FTP 21, FTPS 990, GOPHER 70, GOPHERS 70, HTTP 80, HTTPS 443,
-IMAP 143, IMAPS 993, LDAP 389, LDAPS 636, MQTT 1883, POP3 110, POP3S 995,
-RTMP 1935, RTMPS 443, RTMPT 80, RTSP 554, SCP 22, SFTP 22, SMB 445, SMBS 445,
-SMTP 25, SMTPS 465, TELNET 23, TFTP 69
+DICT 2628, FTP 21, FTPS 990, GOPHER 70, GOPHERS 70, HTTP 80, HTTPS 443, IMAP
+143, IMAPS 993, LDAP 389, LDAPS 636, MQTT 1883, POP3 110, POP3S 995, RTSP 554,
+SCP 22, SFTP 22, SMB 445, SMBS 445, SMTP 25, SMTPS 465, TELNET 23, TFTP 69

 # Scheme specific behaviors

@ -381,15 +379,3 @@ machine's fully qualified domain name, which you might have obtained from an
 external function such as gethostname or getaddrinfo.

 The default smtp port is 25. Some servers use port 587 as an alternative.
-
-## RTMP
-
-There is no official URL spec for RTMP so libcurl uses the URL syntax supported
-by the underlying librtmp library. It has a syntax where it wants a
-traditional URL, followed by a space and a series of space-separated
-`name=value` pairs.
-
-While space is not typically a "legal" letter, libcurl accepts them. When a
-user wants to pass in a `#` (hash) character it is treated as a fragment and
-it gets cut off by libcurl if provided literally. You have to escape it by
-providing it as backslash and its ASCII value in hexadecimal: `\23`.
--- a/docs/VULN-DISCLOSURE-POLICY.md
+++ b/docs/VULN-DISCLOSURE-POLICY.md
@ -29,10 +29,9 @@ mailing lists. Messages associated with any commits should not make any
 reference to the security nature of the commit if done prior to the public
 announcement.

- The person discovering the issue, the reporter, reports the vulnerability to
-  the curl project. Do this [on
-  GitHub](https://github.com/curl/curl/security/advisories). Such submissions
-  reach a handful of selected and trusted people.
+- The person discovering the issue, the reporter, reports the vulnerability on
+  [HackerOne](https://hackerone.com/curl). Issues filed there reach a handful
+  of selected and trusted people.

 - Messages that do not relate to the reporting or managing of an undisclosed
  security vulnerability in curl or libcurl are ignored and no further action
@ -99,23 +98,6 @@ announcement.
 - The security webpage on the website should get the new vulnerability
  mentioned.

-## GitHub Advisories
-
-We receive *advisories* submitted on GitHub but we consider them to be
-*reports*. Since we want to keep the original report as-is and preserved, we
-cannot use this system to author nor publish the actual final advisory for a
-confirmed vulnerability.
-
-The security reports submitted on GitHub are not published, instead they are
-always closed weather confirmed or not.
-
-Confirmed security reports are instead published as security advisories on the
-curl website in sync with the curl release in which the fix is published for
-the vulnerability.
-
-Unfortunately, GitHub does not allow us to disclose the reports. They can only
-be published as "advisories" - and they are not.
-
 ## security (at curl dot se)

 This is a private mailing list for discussions on and about curl security
--- a/docs/cmdline-opts/MANPAGE.md
+++ b/docs/cmdline-opts/MANPAGE.md
@ -101,6 +101,17 @@ There are three different "variables" that can be used when creating the
 output. They need to be written within backticks in the source file (to escape
 getting spellchecked by CI jobs): `%DATE`, `%VERSION` and `%GLOBALS`.

+During rendering, the generator expands them as follows:
+
+- `%VERSION` -- replaced with the curl version string read from
+  `include/curl/curlver.h` (e.g. `8.12.0`). Can be overridden by setting
+  the `CURL_MAKETGZ_VERSION` environment variable.
+- `%DATE` -- replaced with the current date in `YYYY-MM-DD` format, or
+  the date derived from `SOURCE_DATE_EPOCH` if that environment variable
+  is set (for reproducible builds).
+- `%GLOBALS` -- replaced with a comma-separated list of all command line
+  options that have `Scope: global` in their meta-data.
+
 ## Generate

 `managen mainpage [list of markdown option file names]`
@ -116,3 +127,40 @@ curl man page in text format, used to build `tool_hugehelp.c`.
 `managen listhelp`

 Generates a full `curl --help` output for all known command line options.
+
+## Generating the man page
+
+The `curl.1` man page is generated from the source files in this directory
+using the `managen` Perl script located in `scripts/managen`. The build
+system runs this automatically, but it can also be invoked manually.
+
+### Prerequisites
+
+The generator requires Perl. The version string is read from
+`include/curl/curlver.h` (or from the `CURL_MAKETGZ_VERSION` environment
+variable if set). The date defaults to the current date unless
+`SOURCE_DATE_EPOCH` is set.
+
+### Manual invocation
+
+From the `docs/cmdline-opts` directory, run:
+
+    cd docs/cmdline-opts
+    perl ../../scripts/managen -I ../../include mainpage ./*.md > curl.1
+
+This produces the complete `curl.1` nroff man page. To produce a plain-text
+version instead, replace `mainpage` with `ascii`:
+
+    perl ../../scripts/managen -I ../../include ascii ./*.md > curl.txt
+
+The `-d` flag specifies the directory containing `mainpage.idx` and the
+`.md` option files. The `-I` flag specifies the include directory root
+used to locate `curl/curlver.h` for the version string.
+
+### How it works
+
+The generator reads `mainpage.idx`, which lists the documentation source
+files in their intended order. Each line names one `.md` file to render.
+When the generator encounters the `%options` keyword in `mainpage.idx`,
+it inserts the documentation for every command line option (one `.md` file
+per option), sorted alphabetically by long option name.
--- a/docs/cmdline-opts/_DESCRIPTION.md
+++ b/docs/cmdline-opts/_DESCRIPTION.md
@ -4,8 +4,8 @@

 **curl** is a tool for transferring data from or to a server using URLs. It
 supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS,
-IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTMP, RTMPS, RTSP, SCP,
-SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.
+IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB,
+SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS.

 curl is powered by libcurl for all transfer-related features. See
 *libcurl(3)* for details.
--- a/docs/cmdline-opts/_PROTOCOLS.md
+++ b/docs/cmdline-opts/_PROTOCOLS.md
@ -30,9 +30,6 @@ supported (yet).
 ## POP3(S)
 Downloading from a pop3 server means getting an email. With or without using
 TLS.
-## RTMP(S)
-The **Realtime Messaging Protocol** is primarily used to serve streaming media
-and curl can download it.
 ## RTSP
 curl supports RTSP 1.0 downloads.
 ## SCP
--- a/docs/examples/chkspeed.c
+++ b/docs/examples/chkspeed.c
@ -172,7 +172,7 @@ int main(int argc, const char *argv[])
    /* specify URL to get */
    curl_easy_setopt(curl, CURLOPT_URL, url);

-    /* send all data to this function  */
+    /* send all data to this function */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);

    /* some servers do not like requests that are made without a user-agent
--- a/docs/examples/externalsocket.c
+++ b/docs/examples/externalsocket.c
@ -100,7 +100,7 @@ int main(void)
 {
  CURL *curl;
  CURLcode result;
-  struct sockaddr_in servaddr;  /*  socket address structure  */
+  struct sockaddr_in servaddr;  /* socket address structure */
  curl_socket_t sockfd;

  result = curl_global_init(CURL_GLOBAL_ALL);
@ -141,7 +141,7 @@ int main(void)
    /* no progress meter please */
    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);

-    /* send all data to this function  */
+    /* send all data to this function */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);

    /* call this function to get a socket */
--- a/docs/examples/getinmemory.c
+++ b/docs/examples/getinmemory.c
@ -78,7 +78,7 @@ int main(void)
    /* specify URL to get */
    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.com/");

-    /* send all data to this function  */
+    /* send all data to this function */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);

    /* we pass our 'chunk' struct to the callback function */
--- a/docs/examples/htmltidy.c
+++ b/docs/examples/htmltidy.c
@ -35,7 +35,7 @@

 #include <curl/curl.h>

-/* curl write callback, to fill tidy's input buffer...  */
+/* curl write callback, to fill tidy's input buffer... */
 static uint write_cb(char *in, uint size, uint nmemb, TidyBuffer *out)
 {
  uint r;
--- a/docs/examples/http2-pushinmemory.c
+++ b/docs/examples/http2-pushinmemory.c
@ -77,7 +77,7 @@ static void setup(CURL *curl)
  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
  curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);

-  /* write data to a struct  */
+  /* write data to a struct */
  curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
  init_memory(&files[0]);
  curl_easy_setopt(curl, CURLOPT_WRITEDATA, &files[0]);
--- a/docs/examples/imap-append.c
+++ b/docs/examples/imap-append.c
@ -74,7 +74,7 @@ static size_t read_cb(char *ptr, size_t size, size_t nmemb, void *userp)
    size_t len = strlen(data);
    if(room < len)
      len = room;
-    memcpy(ptr, data, len);
+    memcpy(ptr, data, len); /* NOLINT(bugprone-not-null-terminated-result) */
    upload_ctx->bytes_read += len;

    return len;
--- a/docs/examples/imap-search.c
+++ b/docs/examples/imap-search.c
@ -56,7 +56,7 @@ int main(void)
     * this can contain a message sequence set and a number of search criteria
     * keywords including flags such as ANSWERED, DELETED, DRAFT, FLAGGED, NEW,
     * RECENT and SEEN. For more information about the search criteria please
-     * see RFC-3501 section 6.4.4.   */
+     * see RFC-3501 section 6.4.4. */
    curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, "SEARCH NEW");

    /* Perform the custom request */
--- a/docs/examples/maxconnects.c
+++ b/docs/examples/maxconnects.c
@ -47,7 +47,7 @@ int main(void)
    };
    int i = 0;

-    /* Change the maximum number of persistent connection   */
+    /* Change the maximum number of persistent connection */
    curl_easy_setopt(curl, CURLOPT_MAXCONNECTS, 1L);

    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
--- a/docs/examples/postinmemory.c
+++ b/docs/examples/postinmemory.c
@ -74,7 +74,7 @@ int main(void)
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://www.example.org/");

-    /* send all data to this function  */
+    /* send all data to this function */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);

    /* we pass our 'chunk' struct to the callback function */
--- a/docs/examples/sepheaders.c
+++ b/docs/examples/sepheaders.c
@ -64,7 +64,7 @@ int main(void)
    /* no progress meter please */
    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);

-    /* send all data to this function  */
+    /* send all data to this function */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);

    /* open the header file */
--- a/docs/examples/smtp-expn.c
+++ b/docs/examples/smtp-expn.c
@ -53,7 +53,7 @@ int main(void)
    /* This is the URL for your mailserver */
    curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");

-    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array  */
+    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array */
    recipients = curl_slist_append(recipients, "Friends");
    curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);

--- a/docs/examples/smtp-vrfy.c
+++ b/docs/examples/smtp-vrfy.c
@ -56,7 +56,7 @@ int main(void)
    /* This is the URL for your mailserver */
    curl_easy_setopt(curl, CURLOPT_URL, "smtp://mail.example.com");

-    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array  */
+    /* Note that the CURLOPT_MAIL_RCPT takes a list, not a char array */
    recipients = curl_slist_append(recipients, "<recipient@example.com>");
    curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);

--- a/docs/examples/url2file.c
+++ b/docs/examples/url2file.c
@ -74,7 +74,7 @@ int main(int argc, const char *argv[])
    /* disable progress meter, set to 0L to enable it */
    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);

-    /* send all data to this function  */
+    /* send all data to this function */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);

    /* open the file */
--- a/docs/examples/version-check.pl
+++ b/docs/examples/version-check.pl
@ -58,7 +58,6 @@ while(<S>) {
            $rem{$sym}=$a[2];
        }
    }
-
 }

 close(S);
--- a/docs/internals/BUFQ.md
+++ b/docs/internals/BUFQ.md
@ -14,7 +14,7 @@ to and read from. It manages read and write positions and has a maximum size.
 Its basic read/write functions have a similar signature and return code
 handling as many internal curl read and write ones.

-```
+```c
 ssize_t Curl_bufq_write(struct bufq *q, const unsigned char *buf, size_t len, CURLcode *err);

 - returns the length written into `q` or -1 on error.
@ -29,7 +29,7 @@ ssize_t Curl_bufq_read(struct bufq *q, unsigned char *buf, size_t len, CURLcode

 To pass data into a `bufq` without an extra copy, read callbacks can be used.

-```
+```c
 typedef ssize_t Curl_bufq_reader(void *reader_ctx, unsigned char *buf, size_t len,
                                 CURLcode *err);

@ -45,7 +45,7 @@ once or only read in a maximum amount of bytes.

 The analog mechanism for write out buffer data is:

-```
+```c
 typedef ssize_t Curl_bufq_writer(void *writer_ctx, const unsigned char *buf, size_t len,
                                 CURLcode *err);

@ -60,7 +60,7 @@ remove the amount that `writer` reports.

 It is possible to get access to the memory of data stored in a `bufq` with:

-```
+```c
 bool Curl_bufq_peek(const struct bufq *q, const unsigned char **pbuf, size_t *plen);
 ```

@ -69,7 +69,7 @@ may read. This is only valid until another operation on `bufq` is performed.

 Instead of reading `bufq` data, one may simply skip it:

-```
+```c
 void Curl_bufq_skip(struct bufq *q, size_t amount);
 ```

@ -80,7 +80,7 @@ This removes `amount` number of bytes from the `bufq`.
 `bufq` is initialized and freed similar to the `dynbuf` module. Code using
 `bufq` holds a `struct bufq` somewhere. Before it uses it, it invokes:

-```
+```c
 void Curl_bufq_init(struct bufq *q, size_t chunk_size, size_t max_chunks);
 ```

@ -91,12 +91,13 @@ about memory management.

 The user of the `bufq` has the responsibility to call:

-```
+```c
 void Curl_bufq_free(struct bufq *q);
 ```
+
 to free all resources held by `q`. It is possible to reset a `bufq` to empty via:

-```
+```c
 void Curl_bufq_reset(struct bufq *q);
 ```

@ -154,7 +155,7 @@ the `bufq` from growing ever larger and larger.
 A `struct bufc_pool` may be used to create chunks for a `bufq` and keep spare
 ones around. It is initialized and used via:

-```
+```c
 void Curl_bufcp_init(struct bufc_pool *pool, size_t chunk_size, size_t spare_max);

 void Curl_bufq_initp(struct bufq *q, struct bufc_pool *pool, size_t max_chunks, int opts);
--- a/docs/internals/CLIENT-READERS.md
+++ b/docs/internals/CLIENT-READERS.md
@ -28,7 +28,7 @@ The transfer loop that sends and receives, is using `Curl_client_read()` to get
 more data to send for a transfer. If no specific reader has been installed yet,
 the default one that uses `CURLOPT_READFUNCTION` is added. The prototype is

-```
+```c
 CURLcode Curl_client_read(struct Curl_easy *data, char *buf, size_t blen,
                          size_t *nread, bool *eos);
 ```
@ -44,7 +44,7 @@ The chain of readers allows processing of the data to send.

 The definition of a reader is:

-```
+```c
 struct Curl_crtype {
  const char *name;        /* writer name. */
  CURLcode (*do_init)(struct Curl_easy *data, struct Curl_creader *writer);
@ -78,7 +78,7 @@ the order in which they are called is relevant for the outcome. When a reader
 is created, it gets the `phase` property in which it operates. Reader phases
 are defined like:

-```
+```c
 typedef enum {
  CURL_CR_NET,  /* data send to the network (connection filters) */
  CURL_CR_TRANSFER_ENCODE, /* add transfer-encodings */
--- a/docs/internals/CLIENT-WRITERS.md
+++ b/docs/internals/CLIENT-WRITERS.md
@ -29,13 +29,13 @@ All code in `libcurl` that handles response data is ultimately expected to
 forward this data via `Curl_client_write()` to the application. The exact
 prototype of this function is:

-```
+```c
 CURLcode Curl_client_write(struct Curl_easy *data, int type, const char *buf, size_t blen);
 ```

 The `type` argument specifies what the bytes in `buf` actually are.
 The following bits are defined:
-```
+```c
 #define CLIENTWRITE_BODY    (1 << 0) /* non-meta information, BODY */
 #define CLIENTWRITE_INFO    (1 << 1) /* meta information, not a HEADER */
 #define CLIENTWRITE_HEADER  (1 << 2) /* meta information, HEADER */
@ -56,7 +56,7 @@ application callbacks. This is similar to the design of connection filters:
 client writers can be chained to process the bytes written through them. The
 definition is:

-```
+```c
 struct Curl_cwtype {
  const char *name;
  CURLcode (*do_init)(struct Curl_easy *data,
@ -87,7 +87,7 @@ in which the are called is relevant for the outcome. When a writer is created,
 one property it gets is the `phase` in which it operates. Writer phases are
 defined like:

-```
+```c
 typedef enum {
  CURL_CW_RAW,  /* raw data written, before any decoding */
  CURL_CW_TRANSFER_DECODE, /* remove transfer-encodings */
--- a/docs/internals/CONNECTION-FILTERS.md
+++ b/docs/internals/CONNECTION-FILTERS.md
@ -76,7 +76,7 @@ etc.

 Each filter does in principle the following:

-```
+```c
 static CURLcode myfilter_cf_connect(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
                                    bool *done)
@ -109,7 +109,7 @@ transfers.

 The memory footprint of a filter is relatively small:

-```
+```c
 struct Curl_cfilter {
  const struct Curl_cftype *cft; /* the type providing implementation */
  struct Curl_cfilter *next;     /* next filter in chain */
@ -138,13 +138,14 @@ zero cost *if the filter does not transform the data*. An http proxy or socks
 filter, once it is connected, just passes the calls through. Those filters
 implementations look like this:

-```
+```c
 ssize_t Curl_cf_def_send(struct Curl_cfilter *cf, struct Curl_easy *data,
                         const void *buf, size_t len, CURLcode *err)
 {
  return cf->next->cft->do_send(cf->next, data, buf, len, err);
 }
 ```
+
 The `recv` implementation is equivalent.

 ## Filter Types
@ -231,7 +232,7 @@ Users of `curl` may activate them by adding the name of the filter type to the
 `--trace-config` argument. For example, in order to get more detailed tracing
 of an HTTP/2 request, invoke curl with:

-```
+```sh
 > curl -v --trace-config ids,time,http/2 https://curl.se/
 ```

--- a/docs/internals/SCORECARD.md
+++ b/docs/internals/SCORECARD.md
@ -25,7 +25,7 @@ locally build `src/curl` (by default).

 A typical invocation for measuring performance of HTTP/2 downloads would be:

-```
+```sh
 curl> python3 tests/http/scorecard.py -d h2
 ```

@ -35,7 +35,7 @@ JSON instead of text.

 Help for all command line options are available via:

-```
+```sh
 curl> python3 tests/http/scorecard.py -h
 ```

@ -48,7 +48,7 @@ specify these in some way if you are just interested in a particular case.
 For example, to run downloads of a 1 MB resource only, 100 times with at max 6
 parallel transfers, use:

-```
+```sh
 curl> python3 tests/http/scorecard.py -d --download-sizes=1mb --download-count=100 --download-parallel=6 h2
 ```

@ -69,7 +69,7 @@ interactive SVG. Either clone the `Flamegraph` repository next to your `curl`
 project or set the environment variable `FLAMEGRAPH` to the location of your
 clone. Then run scorecard with the `--flame` option, like

-```
+```sh
 curl> FLAMEGRAPH=/Users/sei/projects/FlameGraph python3 tests/http/scorecard.py \
   -r --request-count=50000 --request-parallels=100 --samples=1 --flame h2
 ```
--- a/docs/libcurl/curl_mime_data.md
+++ b/docs/libcurl/curl_mime_data.md
@ -68,7 +68,7 @@ int main(void)
    /* add a part */
    part = curl_mime_addpart(mime);

-    /* add data to the part  */
+    /* add data to the part */
    curl_mime_data(part, "raw contents to send", CURL_ZERO_TERMINATED);
  }
 }
--- a/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.md
+++ b/docs/libcurl/opts/CURLOPT_IOCTLFUNCTION.md
@ -28,7 +28,7 @@ typedef enum {
  CURLIOE_LAST           /* never use */
 } curlioerr;

-typedef enum  {
+typedef enum {
  CURLIOCMD_NOP,         /* no operation */
  CURLIOCMD_RESTARTREAD, /* restart the read stream from start */
  CURLIOCMD_LAST         /* never use */
--- a/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.md
+++ b/docs/libcurl/opts/CURLOPT_OPENSOCKETFUNCTION.md
@ -22,7 +22,7 @@ CURLOPT_OPENSOCKETFUNCTION - callback for opening socket
 ~~~c
 #include <curl/curl.h>

-typedef enum  {
+typedef enum {
  CURLSOCKTYPE_IPCXN,  /* socket created for a specific IP connection */
 } curlsocktype;

--- a/docs/libcurl/opts/CURLOPT_PROGRESSDATA.md
+++ b/docs/libcurl/opts/CURLOPT_PROGRESSDATA.md
@ -63,7 +63,7 @@ int main(void)
  if(curl) {
    struct progress data;

-    /* pass struct to callback  */
+    /* pass struct to callback */
    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, &data);
    curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);

--- a/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.md
+++ b/docs/libcurl/opts/CURLOPT_PROGRESSFUNCTION.md
@ -109,7 +109,7 @@ int main(void)

  CURL *curl = curl_easy_init();
  if(curl) {
-    /* pass struct to callback  */
+    /* pass struct to callback */
    curl_easy_setopt(curl, CURLOPT_PROGRESSDATA, &data);
    curl_easy_setopt(curl, CURLOPT_PROGRESSFUNCTION, progress_callback);

--- a/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.md
+++ b/docs/libcurl/opts/CURLOPT_PROTOCOLS_STR.md
@ -42,8 +42,8 @@ set, it returns error.
 These are the available protocols:

 DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS,
-MQTT, MQTTS, POP3, POP3S, RTMP, RTMPE, RTMPS, RTMPT, RTMPTE, RTMPTS, RTSP,
-SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS, WSS
+MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET,
+TFTP, WS, WSS

 You can set "ALL" as a short-cut to enable all protocols. Note that by setting
 all, you may enable protocols that were not supported the day you write this
@ -81,6 +81,10 @@ int main(int argc, char **argv)
 }
 ~~~

+# HISTORY
+
+RTMP and its related protocol schemes are not supported since curl 8.20.0
+
 # %AVAILABILITY%

 # RETURN VALUE
--- a/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.md
+++ b/docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS_STR.md
@ -46,8 +46,8 @@ By default libcurl allows HTTP, HTTPS, FTP and FTPS on redirects (since
 These are the available protocols:

 DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS,
-MQTT, MQTTS, POP3, POP3S, RTMP, RTMPE, RTMPS, RTMPT, RTMPTE, RTMPTS, RTSP,
-SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS, WSS
+MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET,
+TFTP, WS, WSS

 You can set "ALL" as a short-cut to enable all protocols. Note that by setting
 all, you may enable protocols that were not supported the day you write this
--- a/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.md
+++ b/docs/libcurl/opts/CURLOPT_SOCKOPTFUNCTION.md
@ -22,7 +22,7 @@ CURLOPT_SOCKOPTFUNCTION - callback for setting socket options
 ~~~c
 #include <curl/curl.h>

-typedef enum  {
+typedef enum {
  CURLSOCKTYPE_IPCXN,  /* socket created for a specific IP connection */
  CURLSOCKTYPE_ACCEPT, /* socket created by accept() call */
  CURLSOCKTYPE_LAST    /* never use */
--- a/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md
+++ b/docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md
@ -47,7 +47,7 @@ Subject Alternate Name field in the certificate matches the hostname in the
 URL to which you told curl to connect.

 When the *verify* value is 0, the connection succeeds regardless of the names
-in the certificate. Use that ability with caution,
+in the certificate. Use that ability with caution.

 This option controls checking the server's certificate's claimed identity. The
 separate CURLOPT_SSL_VERIFYPEER(3) options enables/disables verification that
--- a/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md
+++ b/docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md
@ -41,7 +41,7 @@ option.
 Using this option multiple times makes the last set string override the
 previous ones. Set it to NULL to disable its use again.

-This feature relies on TLS SRP which does not work with TLS 1.3.
+This feature relies on TLS-SRP which does not work with TLS 1.3.

 # DEFAULT

--- a/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md
+++ b/docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md
@ -45,7 +45,7 @@ defined in RFC 5054 and provides mutual authentication if both sides have a
 shared secret. To use TLS-SRP, you must also set the
 CURLOPT_TLSAUTH_USERNAME(3) and CURLOPT_TLSAUTH_PASSWORD(3) options.

-TLS SRP does not work with TLS 1.3.
+TLS-SRP does not work with TLS 1.3.

 # DEFAULT

--- a/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md
+++ b/docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md
@ -40,7 +40,7 @@ option.
 Using this option multiple times makes the last set string override the
 previous ones. Set it to NULL to disable its use again.

-This feature relies on TLS SRP which does not work with TLS 1.3.
+This feature relies on TLS-SRP which does not work with TLS 1.3.

 # DEFAULT

--- a/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.md
+++ b/docs/libcurl/opts/CURLOPT_WRITEFUNCTION.md
@ -110,7 +110,7 @@ int main(void)
  CURLcode result;
  CURL *curl = curl_easy_init();
  if(curl) {
-    /* send all data to this function  */
+    /* send all data to this function */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, cb);

    /* we pass our 'chunk' struct to the callback function */
--- a/docs/libcurl/opts/CURLOPT_XFERINFODATA.md
+++ b/docs/libcurl/opts/CURLOPT_XFERINFODATA.md
@ -65,7 +65,7 @@ int main(void)
  if(curl) {
    struct progress data;

-    /* pass struct to callback  */
+    /* pass struct to callback */
    curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &data);
    curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_cb);
  }
--- a/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.md
+++ b/docs/libcurl/opts/CURLOPT_XFERINFOFUNCTION.md
@ -105,7 +105,7 @@ int main(void)
  if(curl) {
    struct progress data;

-    /* pass struct to callback  */
+    /* pass struct to callback */
    curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &data);

    /* enable progress callback getting called */
--- a/docs/libcurl/symbols-in-versions
+++ b/docs/libcurl/symbols-in-versions
@ -971,12 +971,12 @@ CURLPROTO_MQTT                  7.71.0
 CURLPROTO_MQTTS                 8.19.0
 CURLPROTO_POP3                  7.20.0
 CURLPROTO_POP3S                 7.20.0
-CURLPROTO_RTMP                  7.21.0
-CURLPROTO_RTMPE                 7.21.0
-CURLPROTO_RTMPS                 7.21.0
-CURLPROTO_RTMPT                 7.21.0
-CURLPROTO_RTMPTE                7.21.0
-CURLPROTO_RTMPTS                7.21.0
+CURLPROTO_RTMP                  7.21.0        8.20.0
+CURLPROTO_RTMPE                 7.21.0        8.20.0
+CURLPROTO_RTMPS                 7.21.0        8.20.0
+CURLPROTO_RTMPT                 7.21.0        8.20.0
+CURLPROTO_RTMPTE                7.21.0        8.20.0
+CURLPROTO_RTMPTS                7.21.0        8.20.0
 CURLPROTO_RTSP                  7.20.0
 CURLPROTO_SCP                   7.19.4
 CURLPROTO_SFTP                  7.19.4
--- a/docs/libcurl/symbols.pl
+++ b/docs/libcurl/symbols.pl
@ -100,6 +100,5 @@ EOS
 EOS
 ;
        }
-
    }
 }
--- a/docs/tests/HTTP.md
+++ b/docs/tests/HTTP.md
@ -16,7 +16,7 @@ The test cases and necessary files are in `tests/http`. You can invoke
 `pytest` from there or from the top level curl checkout and it finds all
 tests.

-```
+```sh
 curl> pytest test/http
 platform darwin -- Python 3.9.15, pytest-6.2.0, py-1.10.0, pluggy-0.13.1
 rootdir: /Users/sei/projects/curl
@ -30,7 +30,7 @@ times. `-k <expr>` can be used to run only matching test cases. The `expr` can
 be something resembling a python test or just a string that needs to match
 test cases in their names.

-```
+```sh
 curl/tests/http> pytest -vv -k test_01_02
 ```

@ -76,21 +76,21 @@ Several test cases are parameterized, for example with the HTTP version to
 use. If you want to run a test with a particular protocol only, use a command
 line like:

-```
+```sh
 curl/tests/http> pytest -k "test_02_06 and h2"
 ```

 Test cases can be repeated, with the `pytest-repeat` module (`pip install
 pytest-repeat`). Like in:

-```
+```sh
 curl/tests/http> pytest -k "test_02_06 and h2" --count=100
 ```

 which then runs this test case a hundred times. In case of flaky tests, you
 can make pytest stop on the first one with:

-```
+```sh
 curl/tests/http> pytest -k "test_02_06 and h2" --count=100 --maxfail=1
 ```

@ -99,7 +99,7 @@ of log files, the verbosity of pytest is also used to collect curl trace
 output. If you specify `-v` three times, the `curl` command is started with
 `--trace`:

-```
+```sh
 curl/tests/http> pytest -vvv -k "test_02_06 and h2" --count=100 --maxfail=1
 ```

--- a/include/curl/curl.h
+++ b/include/curl/curl.h
@ -59,7 +59,7 @@
 #define CURL_IGNORE_DEPRECATION(statements)     statements
 #endif

-#include "curlver.h"         /* libcurl version defines   */
+#include "curlver.h"         /* libcurl version defines */
 #include "system.h"          /* determine things runtime */

 #include <stdio.h>
@ -1358,7 +1358,7 @@ typedef enum {

  /* Set the krb4/5 security level, this also enables krb4/5 awareness. This
   * is a string, 'clear', 'safe', 'confidential' or 'private'. If the string
-   * is set but does not match one of these, 'private' will be used.  */
+   * is set but does not match one of these, 'private' will be used. */
  CURLOPTDEPRECATED(CURLOPT_KRBLEVEL, CURLOPTTYPE_STRINGPOINT, 63,
                    8.17.0, "removed"),

@ -2203,7 +2203,7 @@ typedef enum {
  CURLOPT(CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256, CURLOPTTYPE_STRINGPOINT, 311),

  /* Function that will be called immediately before the initial request
-     is made on a connection (after any protocol negotiation step).  */
+     is made on a connection (after any protocol negotiation step). */
  CURLOPT(CURLOPT_PREREQFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 312),

  /* Data passed to the CURLOPT_PREREQFUNCTION callback */
@ -2283,7 +2283,6 @@ typedef enum {
 #define CURLOPT_SSLCERTPASSWD CURLOPT_KEYPASSWD
 #define CURLOPT_KRB4LEVEL CURLOPT_KRBLEVEL

-/* */
 #define CURLOPT_FTP_RESPONSE_TIMEOUT CURLOPT_SERVER_RESPONSE_TIMEOUT

 /* Added in 8.2.0 */
@ -3218,7 +3217,7 @@ typedef struct curl_version_info_data curl_version_info_data;
 * This function returns a pointer to a static copy of the version info
 * struct. See above.
 */
-CURL_EXTERN curl_version_info_data *curl_version_info(CURLversion);
+CURL_EXTERN curl_version_info_data *curl_version_info(CURLversion stamp);

 /*
 * NAME curl_easy_strerror()
@ -3229,7 +3228,7 @@ CURL_EXTERN curl_version_info_data *curl_version_info(CURLversion);
 * into the equivalent human readable error string. This is useful
 * for printing meaningful error messages.
 */
-CURL_EXTERN const char *curl_easy_strerror(CURLcode);
+CURL_EXTERN const char *curl_easy_strerror(CURLcode error);

 /*
 * NAME curl_share_strerror()
@ -3240,7 +3239,7 @@ CURL_EXTERN const char *curl_easy_strerror(CURLcode);
 * into the equivalent human readable error string. This is useful
 * for printing meaningful error messages.
 */
-CURL_EXTERN const char *curl_share_strerror(CURLSHcode);
+CURL_EXTERN const char *curl_share_strerror(CURLSHcode error);

 /*
 * NAME curl_easy_pause()
@ -3254,10 +3253,10 @@ CURL_EXTERN const char *curl_share_strerror(CURLSHcode);
 CURL_EXTERN CURLcode curl_easy_pause(CURL *handle, int bitmask);

 #define CURLPAUSE_RECV      (1 << 0)
-#define CURLPAUSE_RECV_CONT (0)
+#define CURLPAUSE_RECV_CONT 0

 #define CURLPAUSE_SEND      (1 << 2)
-#define CURLPAUSE_SEND_CONT (0)
+#define CURLPAUSE_SEND_CONT 0

 #define CURLPAUSE_ALL       (CURLPAUSE_RECV | CURLPAUSE_SEND)
 #define CURLPAUSE_CONT      (CURLPAUSE_RECV_CONT | CURLPAUSE_SEND_CONT)
@ -3310,7 +3309,7 @@ CURL_EXTERN CURLcode curl_easy_ssls_export(CURL *handle,
 #endif

 /* unfortunately, the easy.h and multi.h include files need options and info
-  stuff before they can be included! */
+   stuff before they can be included! */
 #include "easy.h" /* nothing in curl is fun without the easy stuff */
 #include "multi.h"
 #include "urlapi.h"
@ -3329,15 +3328,16 @@ CURL_EXTERN CURLcode curl_easy_ssls_export(CURL *handle,
 #if defined(__STDC__) && (__STDC__ >= 1)
 /* This preprocessor magic that replaces a call with the exact same call is
   only done to make sure application authors pass exactly three arguments
-   to these functions. */
+   to these functions. Use recursive macros to allow using these symbols via
+   the C++ global namespace '::' or reusing them as method names. */
 #define curl_easy_setopt(handle, opt, param) \
-  (curl_easy_setopt)(handle, opt, param)
+  curl_easy_setopt(handle, opt, param)
 #define curl_easy_getinfo(handle, info, arg) \
-  (curl_easy_getinfo)(handle, info, arg)
+  curl_easy_getinfo(handle, info, arg)
 #define curl_share_setopt(share, opt, param) \
-  (curl_share_setopt)(share, opt, param)
-#define curl_multi_setopt(handle,opt,param) \
-  (curl_multi_setopt)(handle, opt, param)
+  curl_share_setopt(share, opt, param)
+#define curl_multi_setopt(handle, opt, param) \
+  curl_multi_setopt(handle, opt, param)
 #endif /* __STDC__ >= 1 */
 #endif /* gcc >= 4.3 && !__cplusplus && !CURL_DISABLE_TYPECHECK */

--- a/include/curl/header.h
+++ b/include/curl/header.h
@ -31,7 +31,7 @@ extern "C" {
 struct curl_header {
  char *name;    /* this might not use the same case */
  char *value;
-  size_t amount; /* number of headers using this name  */
+  size_t amount; /* number of headers using this name */
  size_t index;  /* ... of this instance, 0 or higher */
  unsigned int origin; /* see bits below */
  void *anchor; /* handle privately used by libcurl */
--- a/include/curl/multi.h
+++ b/include/curl/multi.h
@ -269,7 +269,7 @@ CURL_EXTERN CURLMsg *curl_multi_info_read(CURLM *multi_handle,
 *
 * Returns: A pointer to a null-terminated error message.
 */
-CURL_EXTERN const char *curl_multi_strerror(CURLMcode);
+CURL_EXTERN const char *curl_multi_strerror(CURLMcode error);

 /*
 * Name:    curl_multi_socket() and
@ -329,7 +329,7 @@ curl_multi_socket_all(CURLM *multi_handle, int *running_handles);
 /* This macro below was added in 7.16.3 to push users who recompile to use
 * the new curl_multi_socket_action() instead of the old curl_multi_socket()
 */
-#define curl_multi_socket(x,y,z) curl_multi_socket_action(x,y,0,z)
+#define curl_multi_socket(x, y, z) curl_multi_socket_action(x, y, 0, z)
 #endif

 /*
--- a/include/curl/system.h
+++ b/include/curl/system.h
@ -367,20 +367,20 @@
 #define CURL_PULL_SYS_POLL_H
 #endif

-/* CURL_PULL_SYS_TYPES_H is defined above when inclusion of header file  */
-/* sys/types.h is required here to properly make type definitions below. */
+/* CURL_PULL_SYS_TYPES_H is defined above when inclusion of header file
+   sys/types.h is required here to properly make type definitions below. */
 #ifdef CURL_PULL_SYS_TYPES_H
 #  include <sys/types.h>
 #endif

-/* CURL_PULL_SYS_SOCKET_H is defined above when inclusion of header file  */
-/* sys/socket.h is required here to properly make type definitions below. */
+/* CURL_PULL_SYS_SOCKET_H is defined above when inclusion of header file
+   sys/socket.h is required here to properly make type definitions below. */
 #ifdef CURL_PULL_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif

-/* CURL_PULL_SYS_POLL_H is defined above when inclusion of header file    */
-/* sys/poll.h is required here to properly make type definitions below.   */
+/* CURL_PULL_SYS_POLL_H is defined above when inclusion of header file
+   sys/poll.h is required here to properly make type definitions below. */
 #ifdef CURL_PULL_SYS_POLL_H
 #  include <sys/poll.h>
 #endif
--- a/include/curl/typecheck-gcc.h
+++ b/include/curl/typecheck-gcc.h
@ -43,186 +43,186 @@

 #define curl_easy_setopt(handle, option, value)                         \
  __extension__({                                                       \
-      if(__builtin_constant_p(option)) {                                \
-        CURL_IGNORE_DEPRECATION(                                        \
-          if(curlcheck_long_option(option))                             \
-            if(!curlcheck_long(value))                                  \
-              Wcurl_easy_setopt_err_long();                             \
-          if(curlcheck_off_t_option(option))                            \
-            if(!curlcheck_off_t(value))                                 \
-              Wcurl_easy_setopt_err_curl_off_t();                       \
-          if(curlcheck_string_option(option))                           \
-            if(!curlcheck_string(value))                                \
-              Wcurl_easy_setopt_err_string();                           \
-          if((option) == CURLOPT_PRIVATE) { }                           \
-          if(curlcheck_write_cb_option(option))                         \
-            if(!curlcheck_write_cb(value))                              \
-              Wcurl_easy_setopt_err_write_callback();                   \
-          if(curlcheck_curl_option(option))                             \
-            if(!curlcheck_curl(value))                                  \
-              Wcurl_easy_setopt_err_curl();                             \
-          if((option) == CURLOPT_RESOLVER_START_FUNCTION)               \
-            if(!curlcheck_resolver_start_callback(value))               \
-              Wcurl_easy_setopt_err_resolver_start_callback();          \
-          if((option) == CURLOPT_READFUNCTION)                          \
-            if(!curlcheck_read_cb(value))                               \
-              Wcurl_easy_setopt_err_read_cb();                          \
-          if((option) == CURLOPT_IOCTLFUNCTION)                         \
-            if(!curlcheck_ioctl_cb(value))                              \
-              Wcurl_easy_setopt_err_ioctl_cb();                         \
-          if((option) == CURLOPT_SOCKOPTFUNCTION)                       \
-            if(!curlcheck_sockopt_cb(value))                            \
-              Wcurl_easy_setopt_err_sockopt_cb();                       \
-          if((option) == CURLOPT_OPENSOCKETFUNCTION)                    \
-            if(!curlcheck_opensocket_cb(value))                         \
-              Wcurl_easy_setopt_err_opensocket_cb();                    \
-          if((option) == CURLOPT_PROGRESSFUNCTION)                      \
-            if(!curlcheck_progress_cb(value))                           \
-              Wcurl_easy_setopt_err_progress_cb();                      \
-          if((option) == CURLOPT_XFERINFOFUNCTION)                      \
-            if(!curlcheck_xferinfo_cb(value))                           \
-              Wcurl_easy_setopt_err_xferinfo_cb();                      \
-          if((option) == CURLOPT_DEBUGFUNCTION)                         \
-            if(!curlcheck_debug_cb(value))                              \
-              Wcurl_easy_setopt_err_debug_cb();                         \
-          if((option) == CURLOPT_SSL_CTX_FUNCTION)                      \
-            if(!curlcheck_ssl_ctx_cb(value))                            \
-              Wcurl_easy_setopt_err_ssl_ctx_cb();                       \
-          if(curlcheck_conv_cb_option(option))                          \
-            if(!curlcheck_conv_cb(value))                               \
-              Wcurl_easy_setopt_err_conv_cb();                          \
-          if((option) == CURLOPT_SEEKFUNCTION)                          \
-            if(!curlcheck_seek_cb(value))                               \
-              Wcurl_easy_setopt_err_seek_cb();                          \
-          if((option) == CURLOPT_CHUNK_BGN_FUNCTION)                    \
-            if(!curlcheck_chunk_bgn_cb(value))                          \
-              Wcurl_easy_setopt_err_chunk_bgn_cb();                     \
-          if((option) == CURLOPT_CHUNK_END_FUNCTION)                    \
-            if(!curlcheck_chunk_end_cb(value))                          \
-              Wcurl_easy_setopt_err_chunk_end_cb();                     \
-          if((option) == CURLOPT_CLOSESOCKETFUNCTION)                   \
-            if(!curlcheck_close_socket_cb(value))                       \
-              Wcurl_easy_setopt_err_close_socket_cb();                  \
-          if((option) == CURLOPT_FNMATCH_FUNCTION)                      \
-            if(!curlcheck_fnmatch_cb(value))                            \
-              Wcurl_easy_setopt_err_fnmatch_cb();                       \
-          if((option) == CURLOPT_HSTSREADFUNCTION)                      \
-            if(!curlcheck_hstsread_cb(value))                           \
-              Wcurl_easy_setopt_err_hstsread_cb();                      \
-          if((option) == CURLOPT_HSTSWRITEFUNCTION)                     \
-            if(!curlcheck_hstswrite_cb(value))                          \
-              Wcurl_easy_setopt_err_hstswrite_cb();                     \
-          if((option) == CURLOPT_SSH_HOSTKEYFUNCTION)                   \
-            if(!curlcheck_ssh_hostkey_cb(value))                        \
-              Wcurl_easy_setopt_err_ssh_hostkey_cb();                   \
-          if((option) == CURLOPT_SSH_KEYFUNCTION)                       \
-            if(!curlcheck_ssh_key_cb(value))                            \
-              Wcurl_easy_setopt_err_ssh_key_cb();                       \
-          if((option) == CURLOPT_INTERLEAVEFUNCTION)                    \
-            if(!curlcheck_interleave_cb(value))                         \
-              Wcurl_easy_setopt_err_interleave_cb();                    \
-          if((option) == CURLOPT_PREREQFUNCTION)                        \
-            if(!curlcheck_prereq_cb(value))                             \
-              Wcurl_easy_setopt_err_prereq_cb();                        \
-          if((option) == CURLOPT_TRAILERFUNCTION)                       \
-            if(!curlcheck_trailer_cb(value))                            \
-              Wcurl_easy_setopt_err_trailer_cb();                       \
-          if(curlcheck_cb_data_option(option))                          \
-            if(!curlcheck_cb_data(value))                               \
-              Wcurl_easy_setopt_err_cb_data();                          \
-          if((option) == CURLOPT_ERRORBUFFER)                           \
-            if(!curlcheck_error_buffer(value))                          \
-              Wcurl_easy_setopt_err_error_buffer();                     \
-          if((option) == CURLOPT_CURLU)                                 \
-            if(!curlcheck_ptr((value), CURLU))                          \
-              Wcurl_easy_setopt_err_curlu();                            \
-          if((option) == CURLOPT_STDERR)                                \
-            if(!curlcheck_FILE(value))                                  \
-              Wcurl_easy_setopt_err_FILE();                             \
-          if(curlcheck_postfields_option(option))                       \
-            if(!curlcheck_postfields(value))                            \
-              Wcurl_easy_setopt_err_postfields();                       \
-          if((option) == CURLOPT_HTTPPOST)                              \
-            if(!curlcheck_arr((value), struct curl_httppost))           \
-              Wcurl_easy_setopt_err_curl_httpost();                     \
-          if((option) == CURLOPT_MIMEPOST)                              \
-            if(!curlcheck_ptr((value), curl_mime))                      \
-              Wcurl_easy_setopt_err_curl_mimepost();                    \
-          if(curlcheck_slist_option(option))                            \
-            if(!curlcheck_arr((value), struct curl_slist))              \
-              Wcurl_easy_setopt_err_curl_slist();                       \
-          if((option) == CURLOPT_SHARE)                                 \
-            if(!curlcheck_ptr((value), CURLSH))                         \
-              Wcurl_easy_setopt_err_CURLSH();                           \
-          )                                                             \
-          }                                                             \
-      (curl_easy_setopt)(handle, option, value);                        \
-    })
+    if(__builtin_constant_p(option)) {                                  \
+      CURL_IGNORE_DEPRECATION(                                          \
+        if(curlcheck_long_option(option))                               \
+          if(!curlcheck_long(value))                                    \
+            Wcurl_easy_setopt_err_long();                               \
+        if(curlcheck_off_t_option(option))                              \
+          if(!curlcheck_off_t(value))                                   \
+            Wcurl_easy_setopt_err_curl_off_t();                         \
+        if(curlcheck_string_option(option))                             \
+          if(!curlcheck_string(value))                                  \
+            Wcurl_easy_setopt_err_string();                             \
+        if((option) == CURLOPT_PRIVATE) { }                             \
+        if(curlcheck_write_cb_option(option))                           \
+          if(!curlcheck_write_cb(value))                                \
+            Wcurl_easy_setopt_err_write_callback();                     \
+        if(curlcheck_curl_option(option))                               \
+          if(!curlcheck_curl(value))                                    \
+            Wcurl_easy_setopt_err_curl();                               \
+        if((option) == CURLOPT_RESOLVER_START_FUNCTION)                 \
+          if(!curlcheck_resolver_start_callback(value))                 \
+            Wcurl_easy_setopt_err_resolver_start_callback();            \
+        if((option) == CURLOPT_READFUNCTION)                            \
+          if(!curlcheck_read_cb(value))                                 \
+            Wcurl_easy_setopt_err_read_cb();                            \
+        if((option) == CURLOPT_IOCTLFUNCTION)                           \
+          if(!curlcheck_ioctl_cb(value))                                \
+            Wcurl_easy_setopt_err_ioctl_cb();                           \
+        if((option) == CURLOPT_SOCKOPTFUNCTION)                         \
+          if(!curlcheck_sockopt_cb(value))                              \
+            Wcurl_easy_setopt_err_sockopt_cb();                         \
+        if((option) == CURLOPT_OPENSOCKETFUNCTION)                      \
+          if(!curlcheck_opensocket_cb(value))                           \
+            Wcurl_easy_setopt_err_opensocket_cb();                      \
+        if((option) == CURLOPT_PROGRESSFUNCTION)                        \
+          if(!curlcheck_progress_cb(value))                             \
+            Wcurl_easy_setopt_err_progress_cb();                        \
+        if((option) == CURLOPT_XFERINFOFUNCTION)                        \
+          if(!curlcheck_xferinfo_cb(value))                             \
+            Wcurl_easy_setopt_err_xferinfo_cb();                        \
+        if((option) == CURLOPT_DEBUGFUNCTION)                           \
+          if(!curlcheck_debug_cb(value))                                \
+            Wcurl_easy_setopt_err_debug_cb();                           \
+        if((option) == CURLOPT_SSL_CTX_FUNCTION)                        \
+          if(!curlcheck_ssl_ctx_cb(value))                              \
+            Wcurl_easy_setopt_err_ssl_ctx_cb();                         \
+        if(curlcheck_conv_cb_option(option))                            \
+          if(!curlcheck_conv_cb(value))                                 \
+            Wcurl_easy_setopt_err_conv_cb();                            \
+        if((option) == CURLOPT_SEEKFUNCTION)                            \
+          if(!curlcheck_seek_cb(value))                                 \
+            Wcurl_easy_setopt_err_seek_cb();                            \
+        if((option) == CURLOPT_CHUNK_BGN_FUNCTION)                      \
+          if(!curlcheck_chunk_bgn_cb(value))                            \
+            Wcurl_easy_setopt_err_chunk_bgn_cb();                       \
+        if((option) == CURLOPT_CHUNK_END_FUNCTION)                      \
+          if(!curlcheck_chunk_end_cb(value))                            \
+            Wcurl_easy_setopt_err_chunk_end_cb();                       \
+        if((option) == CURLOPT_CLOSESOCKETFUNCTION)                     \
+          if(!curlcheck_close_socket_cb(value))                         \
+            Wcurl_easy_setopt_err_close_socket_cb();                    \
+        if((option) == CURLOPT_FNMATCH_FUNCTION)                        \
+          if(!curlcheck_fnmatch_cb(value))                              \
+            Wcurl_easy_setopt_err_fnmatch_cb();                         \
+        if((option) == CURLOPT_HSTSREADFUNCTION)                        \
+          if(!curlcheck_hstsread_cb(value))                             \
+            Wcurl_easy_setopt_err_hstsread_cb();                        \
+        if((option) == CURLOPT_HSTSWRITEFUNCTION)                       \
+          if(!curlcheck_hstswrite_cb(value))                            \
+            Wcurl_easy_setopt_err_hstswrite_cb();                       \
+        if((option) == CURLOPT_SSH_HOSTKEYFUNCTION)                     \
+          if(!curlcheck_ssh_hostkey_cb(value))                          \
+            Wcurl_easy_setopt_err_ssh_hostkey_cb();                     \
+        if((option) == CURLOPT_SSH_KEYFUNCTION)                         \
+          if(!curlcheck_ssh_key_cb(value))                              \
+            Wcurl_easy_setopt_err_ssh_key_cb();                         \
+        if((option) == CURLOPT_INTERLEAVEFUNCTION)                      \
+          if(!curlcheck_interleave_cb(value))                           \
+            Wcurl_easy_setopt_err_interleave_cb();                      \
+        if((option) == CURLOPT_PREREQFUNCTION)                          \
+          if(!curlcheck_prereq_cb(value))                               \
+            Wcurl_easy_setopt_err_prereq_cb();                          \
+        if((option) == CURLOPT_TRAILERFUNCTION)                         \
+          if(!curlcheck_trailer_cb(value))                              \
+            Wcurl_easy_setopt_err_trailer_cb();                         \
+        if(curlcheck_cb_data_option(option))                            \
+          if(!curlcheck_cb_data(value))                                 \
+            Wcurl_easy_setopt_err_cb_data();                            \
+        if((option) == CURLOPT_ERRORBUFFER)                             \
+          if(!curlcheck_error_buffer(value))                            \
+            Wcurl_easy_setopt_err_error_buffer();                       \
+        if((option) == CURLOPT_CURLU)                                   \
+          if(!curlcheck_ptr((value), CURLU))                            \
+            Wcurl_easy_setopt_err_curlu();                              \
+        if((option) == CURLOPT_STDERR)                                  \
+          if(!curlcheck_FILE(value))                                    \
+            Wcurl_easy_setopt_err_FILE();                               \
+        if(curlcheck_postfields_option(option))                         \
+          if(!curlcheck_postfields(value))                              \
+            Wcurl_easy_setopt_err_postfields();                         \
+        if((option) == CURLOPT_HTTPPOST)                                \
+          if(!curlcheck_arr((value), struct curl_httppost))             \
+            Wcurl_easy_setopt_err_curl_httpost();                       \
+        if((option) == CURLOPT_MIMEPOST)                                \
+          if(!curlcheck_ptr((value), curl_mime))                        \
+            Wcurl_easy_setopt_err_curl_mimepost();                      \
+        if(curlcheck_slist_option(option))                              \
+          if(!curlcheck_arr((value), struct curl_slist))                \
+            Wcurl_easy_setopt_err_curl_slist();                         \
+        if((option) == CURLOPT_SHARE)                                   \
+          if(!curlcheck_ptr((value), CURLSH))                           \
+            Wcurl_easy_setopt_err_CURLSH();                             \
+      )                                                                 \
+    }                                                                   \
+    (curl_easy_setopt)(handle, option, value);                          \
+  })

 /* wraps curl_easy_getinfo() with type checking */
 #define curl_easy_getinfo(handle, info, arg)                            \
  __extension__({                                                       \
-      if(__builtin_constant_p(info)) {                                  \
-        CURL_IGNORE_DEPRECATION(                                        \
-          if(curlcheck_string_info(info))                               \
-            if(!curlcheck_arr((arg), char *))                           \
-              Wcurl_easy_getinfo_err_string();                          \
-          if(curlcheck_long_info(info))                                 \
-            if(!curlcheck_arr((arg), long))                             \
-              Wcurl_easy_getinfo_err_long();                            \
-          if(curlcheck_double_info(info))                               \
-            if(!curlcheck_arr((arg), double))                           \
-              Wcurl_easy_getinfo_err_double();                          \
-          if(curlcheck_slist_info(info))                                \
-            if(!curlcheck_arr((arg), struct curl_slist *))              \
-              Wcurl_easy_getinfo_err_curl_slist();                      \
-          if(curlcheck_tlssessioninfo_info(info))                       \
-            if(!curlcheck_arr((arg), struct curl_tlssessioninfo *))     \
-              Wcurl_easy_getinfo_err_curl_tlssessioninfo();             \
-          if(curlcheck_certinfo_info(info))                             \
-            if(!curlcheck_arr((arg), struct curl_certinfo *))           \
-              Wcurl_easy_getinfo_err_curl_certinfo();                   \
-          if(curlcheck_socket_info(info))                               \
-            if(!curlcheck_arr((arg), curl_socket_t))                    \
-              Wcurl_easy_getinfo_err_curl_socket();                     \
-          if(curlcheck_off_t_info(info))                                \
-            if(!curlcheck_arr((arg), curl_off_t))                       \
-              Wcurl_easy_getinfo_err_curl_off_t();                      \
-          )                                                             \
-          }                                                             \
-      (curl_easy_getinfo)(handle, info, arg);                           \
-    })
+    if(__builtin_constant_p(info)) {                                    \
+      CURL_IGNORE_DEPRECATION(                                          \
+        if(curlcheck_string_info(info))                                 \
+          if(!curlcheck_arr((arg), char *))                             \
+            Wcurl_easy_getinfo_err_string();                            \
+        if(curlcheck_long_info(info))                                   \
+          if(!curlcheck_arr((arg), long))                               \
+            Wcurl_easy_getinfo_err_long();                              \
+        if(curlcheck_double_info(info))                                 \
+          if(!curlcheck_arr((arg), double))                             \
+            Wcurl_easy_getinfo_err_double();                            \
+        if(curlcheck_slist_info(info))                                  \
+          if(!curlcheck_arr((arg), struct curl_slist *))                \
+            Wcurl_easy_getinfo_err_curl_slist();                        \
+        if(curlcheck_tlssessioninfo_info(info))                         \
+          if(!curlcheck_arr((arg), struct curl_tlssessioninfo *))       \
+            Wcurl_easy_getinfo_err_curl_tlssessioninfo();               \
+        if(curlcheck_certinfo_info(info))                               \
+          if(!curlcheck_arr((arg), struct curl_certinfo *))             \
+            Wcurl_easy_getinfo_err_curl_certinfo();                     \
+        if(curlcheck_socket_info(info))                                 \
+          if(!curlcheck_arr((arg), curl_socket_t))                      \
+            Wcurl_easy_getinfo_err_curl_socket();                       \
+        if(curlcheck_off_t_info(info))                                  \
+          if(!curlcheck_arr((arg), curl_off_t))                         \
+            Wcurl_easy_getinfo_err_curl_off_t();                        \
+      )                                                                 \
+    }                                                                   \
+    (curl_easy_getinfo)(handle, info, arg);                             \
+  })

 #define curl_multi_setopt(handle, option, value)                        \
  __extension__({                                                       \
-      if(__builtin_constant_p(option)) {                                \
-        if(curlcheck_long_option(option))                               \
-          if(!curlcheck_long(value))                                    \
-            Wcurl_multi_setopt_err_long();                              \
-        if(curlcheck_off_t_option(option))                              \
-          if(!curlcheck_off_t(value))                                   \
-            Wcurl_multi_setopt_err_curl_off_t();                        \
-        if(curlcheck_multicb_data_option(option))                       \
-          if(!curlcheck_cb_data(value))                                 \
-            Wcurl_multi_setopt_err_cb_data();                           \
-        if(curlcheck_charpp_option(option))                             \
-          if(!curlcheck_ptrptr(value, char))                            \
-            Wcurl_multi_setopt_err_charpp();                            \
-        if((option) == CURLMOPT_NOTIFYFUNCTION)                         \
-          if(!curlcheck_multinotify_cb(value))                          \
-            Wcurl_multi_setopt_err_notifycb();                          \
-        if((option) == CURLMOPT_PUSHFUNCTION)                           \
-          if(!curlcheck_multipush_cb(value))                            \
-            Wcurl_multi_setopt_err_pushcb();                            \
-        if((option) == CURLMOPT_SOCKETFUNCTION)                         \
-          if(!curlcheck_multisocket_cb(value))                          \
-            Wcurl_multi_setopt_err_socketcb();                          \
-        if((option) == CURLMOPT_TIMERFUNCTION)                          \
-          if(!curlcheck_multitimer_cb(value))                           \
-            Wcurl_multi_setopt_err_timercb();                           \
-      }                                                                 \
-      (curl_multi_setopt)(handle, option, value);                       \
-    })
+    if(__builtin_constant_p(option)) {                                  \
+      if(curlcheck_long_option(option))                                 \
+        if(!curlcheck_long(value))                                      \
+          Wcurl_multi_setopt_err_long();                                \
+      if(curlcheck_off_t_option(option))                                \
+        if(!curlcheck_off_t(value))                                     \
+          Wcurl_multi_setopt_err_curl_off_t();                          \
+      if(curlcheck_multicb_data_option(option))                         \
+        if(!curlcheck_cb_data(value))                                   \
+          Wcurl_multi_setopt_err_cb_data();                             \
+      if(curlcheck_charpp_option(option))                               \
+        if(!curlcheck_ptrptr(value, char))                              \
+          Wcurl_multi_setopt_err_charpp();                              \
+      if((option) == CURLMOPT_NOTIFYFUNCTION)                           \
+        if(!curlcheck_multinotify_cb(value))                            \
+          Wcurl_multi_setopt_err_notifycb();                            \
+      if((option) == CURLMOPT_PUSHFUNCTION)                             \
+        if(!curlcheck_multipush_cb(value))                              \
+          Wcurl_multi_setopt_err_pushcb();                              \
+      if((option) == CURLMOPT_SOCKETFUNCTION)                           \
+        if(!curlcheck_multisocket_cb(value))                            \
+          Wcurl_multi_setopt_err_socketcb();                            \
+      if((option) == CURLMOPT_TIMERFUNCTION)                            \
+        if(!curlcheck_multitimer_cb(value))                             \
+          Wcurl_multi_setopt_err_timercb();                             \
+    }                                                                   \
+    (curl_multi_setopt)(handle, option, value);                         \
+  })

 /* evaluates to true if the option takes a data argument to pass to a
   callback */
@ -512,82 +512,84 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
   (option) == CURLOPT_CONV_FROM_UTF8_FUNCTION)

 /* evaluates to true if option takes a data argument to pass to a callback */
-#define curlcheck_cb_data_option(option)                                      \
-  ((option) == CURLOPT_CHUNK_DATA ||                                          \
-   (option) == CURLOPT_CLOSESOCKETDATA ||                                     \
-   (option) == CURLOPT_DEBUGDATA ||                                           \
-   (option) == CURLOPT_FNMATCH_DATA ||                                        \
-   (option) == CURLOPT_HEADERDATA ||                                          \
-   (option) == CURLOPT_HSTSREADDATA ||                                        \
-   (option) == CURLOPT_HSTSWRITEDATA ||                                       \
-   (option) == CURLOPT_INTERLEAVEDATA ||                                      \
-   (option) == CURLOPT_IOCTLDATA ||                                           \
-   (option) == CURLOPT_OPENSOCKETDATA ||                                      \
-   (option) == CURLOPT_PREREQDATA ||                                          \
-   (option) == CURLOPT_XFERINFODATA ||                                        \
-   (option) == CURLOPT_READDATA ||                                            \
-   (option) == CURLOPT_SEEKDATA ||                                            \
-   (option) == CURLOPT_SOCKOPTDATA ||                                         \
-   (option) == CURLOPT_SSH_KEYDATA ||                                         \
-   (option) == CURLOPT_SSL_CTX_DATA ||                                        \
-   (option) == CURLOPT_WRITEDATA ||                                           \
-   (option) == CURLOPT_RESOLVER_START_DATA ||                                 \
-   (option) == CURLOPT_TRAILERDATA ||                                         \
-   (option) == CURLOPT_SSH_HOSTKEYDATA ||                                     \
+#define curlcheck_cb_data_option(option)                                \
+  ((option) == CURLOPT_CHUNK_DATA ||                                    \
+   (option) == CURLOPT_CLOSESOCKETDATA ||                               \
+   (option) == CURLOPT_DEBUGDATA ||                                     \
+   (option) == CURLOPT_FNMATCH_DATA ||                                  \
+   (option) == CURLOPT_HEADERDATA ||                                    \
+   (option) == CURLOPT_HSTSREADDATA ||                                  \
+   (option) == CURLOPT_HSTSWRITEDATA ||                                 \
+   (option) == CURLOPT_INTERLEAVEDATA ||                                \
+   (option) == CURLOPT_IOCTLDATA ||                                     \
+   (option) == CURLOPT_OPENSOCKETDATA ||                                \
+   (option) == CURLOPT_PREREQDATA ||                                    \
+   (option) == CURLOPT_XFERINFODATA ||                                  \
+   (option) == CURLOPT_READDATA ||                                      \
+   (option) == CURLOPT_SEEKDATA ||                                      \
+   (option) == CURLOPT_SOCKOPTDATA ||                                   \
+   (option) == CURLOPT_SSH_KEYDATA ||                                   \
+   (option) == CURLOPT_SSL_CTX_DATA ||                                  \
+   (option) == CURLOPT_WRITEDATA ||                                     \
+   (option) == CURLOPT_RESOLVER_START_DATA ||                           \
+   (option) == CURLOPT_TRAILERDATA ||                                   \
+   (option) == CURLOPT_SSH_HOSTKEYDATA ||                               \
   0)

 /* evaluates to true if option takes a POST data argument (void* or char*) */
-#define curlcheck_postfields_option(option)                                   \
-  ((option) == CURLOPT_POSTFIELDS ||                                          \
-   (option) == CURLOPT_COPYPOSTFIELDS ||                                      \
+#define curlcheck_postfields_option(option)                             \
+  ((option) == CURLOPT_POSTFIELDS ||                                    \
+   (option) == CURLOPT_COPYPOSTFIELDS ||                                \
   0)

 /* evaluates to true if option takes a struct curl_slist * argument */
-#define curlcheck_slist_option(option)                                        \
-  ((option) == CURLOPT_HTTP200ALIASES ||                                      \
-   (option) == CURLOPT_HTTPHEADER ||                                          \
-   (option) == CURLOPT_MAIL_RCPT ||                                           \
-   (option) == CURLOPT_POSTQUOTE ||                                           \
-   (option) == CURLOPT_PREQUOTE ||                                            \
-   (option) == CURLOPT_PROXYHEADER ||                                         \
-   (option) == CURLOPT_QUOTE ||                                               \
-   (option) == CURLOPT_RESOLVE ||                                             \
-   (option) == CURLOPT_TELNETOPTIONS ||                                       \
-   (option) == CURLOPT_CONNECT_TO ||                                          \
+#define curlcheck_slist_option(option)                                  \
+  ((option) == CURLOPT_HTTP200ALIASES ||                                \
+   (option) == CURLOPT_HTTPHEADER ||                                    \
+   (option) == CURLOPT_MAIL_RCPT ||                                     \
+   (option) == CURLOPT_POSTQUOTE ||                                     \
+   (option) == CURLOPT_PREQUOTE ||                                      \
+   (option) == CURLOPT_PROXYHEADER ||                                   \
+   (option) == CURLOPT_QUOTE ||                                         \
+   (option) == CURLOPT_RESOLVE ||                                       \
+   (option) == CURLOPT_TELNETOPTIONS ||                                 \
+   (option) == CURLOPT_CONNECT_TO ||                                    \
   0)

 /* groups of curl_easy_getinfo infos that take the same type of argument */

 /* evaluates to true if info expects a pointer to char * argument */
-#define curlcheck_string_info(info)                             \
-  (CURLINFO_STRING < (info) && (info) < CURLINFO_LONG &&        \
+#define curlcheck_string_info(info)                                     \
+  (CURLINFO_STRING < (info) && (info) < CURLINFO_LONG &&                \
   (info) != CURLINFO_PRIVATE)

 /* evaluates to true if info expects a pointer to long argument */
-#define curlcheck_long_info(info)                       \
+#define curlcheck_long_info(info)                                       \
  (CURLINFO_LONG < (info) && (info) < CURLINFO_DOUBLE)

 /* evaluates to true if info expects a pointer to double argument */
-#define curlcheck_double_info(info)                     \
+#define curlcheck_double_info(info)                                     \
  (CURLINFO_DOUBLE < (info) && (info) < CURLINFO_SLIST)

 /* true if info expects a pointer to struct curl_slist * argument */
 #define curlcheck_slist_info(info)                                      \
-  (((info) == CURLINFO_SSL_ENGINES) || ((info) == CURLINFO_COOKIELIST))
+  (((info) == CURLINFO_SSL_ENGINES) ||                                  \
+   ((info) == CURLINFO_COOKIELIST))

 /* true if info expects a pointer to struct curl_tlssessioninfo * argument */
-#define curlcheck_tlssessioninfo_info(info)                              \
-  (((info) == CURLINFO_TLS_SSL_PTR) || ((info) == CURLINFO_TLS_SESSION))
+#define curlcheck_tlssessioninfo_info(info)                             \
+  (((info) == CURLINFO_TLS_SSL_PTR) ||                                  \
+   ((info) == CURLINFO_TLS_SESSION))

 /* true if info expects a pointer to struct curl_certinfo * argument */
 #define curlcheck_certinfo_info(info) ((info) == CURLINFO_CERTINFO)

 /* true if info expects a pointer to struct curl_socket_t argument */
-#define curlcheck_socket_info(info)                     \
+#define curlcheck_socket_info(info)                                     \
  (CURLINFO_SOCKET < (info) && (info) < CURLINFO_OFF_T)

 /* true if info expects a pointer to curl_off_t argument */
-#define curlcheck_off_t_info(info)              \
+#define curlcheck_off_t_info(info)                                      \
  (CURLINFO_OFF_T < (info))

 /*
@ -604,7 +606,7 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
 */

 /* XXX: should evaluate to true if expr is a pointer */
-#define curlcheck_any_ptr(expr)                 \
+#define curlcheck_any_ptr(expr)                                         \
  (sizeof(expr) == sizeof(void *))

 /* evaluates to true if expr is NULL */
@ -668,7 +670,7 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
                                                                  )

 /* evaluates to true if expr is of type curl_off_t */
-#define curlcheck_off_t(expr)                                   \
+#define curlcheck_off_t(expr)                                           \
  (__builtin_types_compatible_p(__typeof__(expr), curl_off_t))

 /* evaluates to true if expr is abuffer suitable for CURLOPT_ERRORBUFFER */
@ -706,8 +708,8 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
   __builtin_types_compatible_p(__typeof__(func) *, type))

 /* evaluates to true if expr is of type curl_resolver_start_callback */
-#define curlcheck_resolver_start_callback(expr)       \
-  (curlcheck_NULL(expr) || \
+#define curlcheck_resolver_start_callback(expr)                         \
+  (curlcheck_NULL(expr) ||                                              \
   curlcheck_cb_compatible((expr), curl_resolver_start_callback))

 /* evaluates to true if expr is of type curl_read_callback or "similar" */
@ -741,11 +743,11 @@ typedef size_t (*Wcurl_read_callback6)(void *, size_t, size_t, FILE *);
   curlcheck_cb_compatible((expr), Wcurl_write_callback6))
 typedef size_t (*Wcurl_write_callback1)(const char *, size_t, size_t, void *);
 typedef size_t (*Wcurl_write_callback2)(const char *, size_t, size_t,
-                                       const void *);
+                                        const void *);
 typedef size_t (*Wcurl_write_callback3)(const char *, size_t, size_t, FILE *);
 typedef size_t (*Wcurl_write_callback4)(const void *, size_t, size_t, void *);
 typedef size_t (*Wcurl_write_callback5)(const void *, size_t, size_t,
-                                       const void *);
+                                        const void *);
 typedef size_t (*Wcurl_write_callback6)(const void *, size_t, size_t, FILE *);

 /* evaluates to true if expr is of type curl_ioctl_callback or "similar" */
@ -769,7 +771,7 @@ typedef curlioerr (*Wcurl_ioctl_callback4)(CURL *, curliocmd, const void *);
   curlcheck_cb_compatible((expr), Wcurl_sockopt_callback2))
 typedef int (*Wcurl_sockopt_callback1)(void *, curl_socket_t, curlsocktype);
 typedef int (*Wcurl_sockopt_callback2)(const void *, curl_socket_t,
-                                      curlsocktype);
+                                       curlsocktype);

 /* evaluates to true if expr is of type curl_opensocket_callback or
   "similar" */
@ -817,21 +819,21 @@ typedef int (*Wcurl_progress_callback2)(const void *,
   curlcheck_cb_compatible((expr), Wcurl_debug_callback6) ||            \
   curlcheck_cb_compatible((expr), Wcurl_debug_callback7) ||            \
   curlcheck_cb_compatible((expr), Wcurl_debug_callback8))
-typedef int (*Wcurl_debug_callback1) (CURL *,
+typedef int (*Wcurl_debug_callback1)(CURL *,
    curl_infotype, char *, size_t, void *);
-typedef int (*Wcurl_debug_callback2) (CURL *,
+typedef int (*Wcurl_debug_callback2)(CURL *,
    curl_infotype, char *, size_t, const void *);
-typedef int (*Wcurl_debug_callback3) (CURL *,
+typedef int (*Wcurl_debug_callback3)(CURL *,
    curl_infotype, const char *, size_t, void *);
-typedef int (*Wcurl_debug_callback4) (CURL *,
+typedef int (*Wcurl_debug_callback4)(CURL *,
    curl_infotype, const char *, size_t, const void *);
-typedef int (*Wcurl_debug_callback5) (CURL *,
+typedef int (*Wcurl_debug_callback5)(CURL *,
    curl_infotype, unsigned char *, size_t, void *);
-typedef int (*Wcurl_debug_callback6) (CURL *,
+typedef int (*Wcurl_debug_callback6)(CURL *,
    curl_infotype, unsigned char *, size_t, const void *);
-typedef int (*Wcurl_debug_callback7) (CURL *,
+typedef int (*Wcurl_debug_callback7)(CURL *,
    curl_infotype, const unsigned char *, size_t, void *);
-typedef int (*Wcurl_debug_callback8) (CURL *,
+typedef int (*Wcurl_debug_callback8)(CURL *,
    curl_infotype, const unsigned char *, size_t, const void *);

 /* evaluates to true if expr is of type curl_ssl_ctx_callback or "similar" */
--- a/include/curl/urlapi.h
+++ b/include/curl/urlapi.h
@ -146,7 +146,7 @@ CURL_EXTERN CURLUcode curl_url_set(CURLU *handle, CURLUPart what,
 * readable error string. This is useful for printing meaningful error
 * messages.
 */
-CURL_EXTERN const char *curl_url_strerror(CURLUcode);
+CURL_EXTERN const char *curl_url_strerror(CURLUcode error);

 #ifdef __cplusplus
 } /* end of extern "C" */
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@ -38,6 +38,7 @@ list(APPEND HHEADERS "${CMAKE_CURRENT_BINARY_DIR}/curl_config.h")

 set_property(DIRECTORY APPEND PROPERTY INCLUDE_DIRECTORIES
  "${PROJECT_BINARY_DIR}/lib"        # for "curl_config.h"
+  "${PROJECT_SOURCE_DIR}/lib"
 )

 if(CURL_BUILD_TESTING)
@ -47,7 +48,7 @@ if(CURL_BUILD_TESTING)
  target_link_libraries(curlu PUBLIC ${CURL_LIBS})
  # There is plenty of parallelism when building the testdeps target.
  # Override the curlu batch size with the maximum to optimize performance.
-  set_target_properties(curlu PROPERTIES UNITY_BUILD_BATCH_SIZE 0 C_CLANG_TIDY "")
+  set_target_properties(curlu PROPERTIES UNITY_BUILD ON UNITY_BUILD_BATCH_SIZE 0 C_CLANG_TIDY "")

  add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/unitprotos.h"
    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@ -58,6 +58,7 @@ CFLAGS += @CURL_CFLAG_EXTRAS@

 AM_CPPFLAGS = -I$(top_srcdir)/include   \
              -I$(top_builddir)/lib     \
+              -I$(top_srcdir)/lib       \
              -I$(srcdir)

 # Prevent LIBS from being used for all link targets
--- a/lib/Makefile.inc
+++ b/lib/Makefile.inc
@ -32,6 +32,7 @@ LIB_CURLX_CFILES =      \
  curlx/inet_pton.c     \
  curlx/multibyte.c     \
  curlx/nonblock.c      \
+  curlx/snprintf.c      \
  curlx/strcopy.c       \
  curlx/strdup.c        \
  curlx/strerr.c        \
@ -171,7 +172,6 @@ LIB_CFILES =         \
  curl_memrchr.c     \
  curl_ntlm_core.c   \
  curl_range.c       \
-  curl_rtmp.c        \
  curl_sasl.c        \
  curl_sha512_256.c  \
  curl_share.c       \
@ -303,7 +303,6 @@ LIB_HFILES =         \
  curl_ntlm_core.h   \
  curl_printf.h      \
  curl_range.h       \
-  curl_rtmp.h        \
  curl_sasl.h        \
  curl_setup.h       \
  curl_sha256.h      \
--- a/lib/altsvc.c
+++ b/lib/altsvc.c
@ -229,7 +229,6 @@ static CURLcode altsvc_load(struct altsvcinfo *asi, const char *file)
 /*
 * Write this single altsvc entry to a single output line
 */
-
 static CURLcode altsvc_out(struct altsvc *as, FILE *fp)
 {
  struct tm stamp;
--- a/lib/asyn-ares.c
+++ b/lib/asyn-ares.c
@ -600,8 +600,8 @@ async_ares_node2addr(struct ares_addrinfo_node *node)
  for(ai = node; ai != NULL; ai = ai->ai_next) {
    size_t ss_size;
    struct Curl_addrinfo *ca;
-    /* ignore elements with unsupported address family, */
-    /* settle family-specific sockaddr structure size.  */
+    /* ignore elements with unsupported address family,
+       settle family-specific sockaddr structure size. */
    if(ai->ai_family == AF_INET)
      ss_size = sizeof(struct sockaddr_in);
 #ifdef USE_IPV6
@ -625,8 +625,8 @@ async_ares_node2addr(struct ares_addrinfo_node *node)
      break;
    }

-    /* copy each structure member individually, member ordering, */
-    /* size, or padding might be different for each platform.    */
+    /* copy each structure member individually, member ordering,
+       size, or padding might be different for each platform. */

    ca->ai_flags     = ai->ai_flags;
    ca->ai_family    = ai->ai_family;
--- a/lib/cf-h1-proxy.c
+++ b/lib/cf-h1-proxy.c
@ -340,8 +340,8 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
          ISDIGIT(header[9]) && ISDIGIT(header[10]) && ISDIGIT(header[11]) &&
          !ISDIGIT(header[12])) {
    /* store the HTTP code from the proxy */
-    data->info.httpproxycode = k->httpcode = (header[9] - '0') * 100 +
-      (header[10] - '0') * 10 + (header[11] - '0');
+    data->info.httpproxycode = k->httpcode = ((header[9] - '0') * 100) +
+      ((header[10] - '0') * 10) + (header[11] - '0');
  }
  return result;
 }
--- a/lib/cfilters.c
+++ b/lib/cfilters.c
@ -1089,13 +1089,14 @@ CURLcode Curl_conn_send(struct Curl_easy *data, int sockindex,
    const char *p = getenv("CURL_SMALLSENDS");
    if(p) {
      curl_off_t altsize;
-      if(!curlx_str_number(&p, &altsize, write_len))
+      if(!curlx_str_number(&p, &altsize, write_len)) {
        write_len = (size_t)altsize;
+        if(write_len != len)
+          eos = FALSE;
+      }
    }
  }
 #endif
-  if(write_len != len)
-    eos = FALSE;
  if(data && data->conn && data->conn->send[sockindex])
    return data->conn->send[sockindex](data, sockindex, buf, write_len, eos,
                                       pnwritten);
--- a/lib/cfilters.h
+++ b/lib/cfilters.h
@ -117,7 +117,7 @@ typedef CURLcode Curl_cft_conn_keep_alive(struct Curl_cfilter *cf,
 */
 /*      data event                            arg1       arg2     return */
 #define CF_CTRL_DATA_SETUP              4  /* 0          NULL     first fail */
-/* unused now                           5  */
+/* unused now                           5 */
 #define CF_CTRL_DATA_PAUSE              6  /* on/off     NULL     first fail */
 #define CF_CTRL_DATA_DONE               7  /* premature  NULL     ignored */
 #define CF_CTRL_DATA_DONE_SEND          8  /* 0          NULL     ignored */
@ -170,7 +170,7 @@ typedef CURLcode Curl_cft_cntrl(struct Curl_cfilter *cf,
 #define CF_QUERY_STREAM_ERROR       6  /* error code - */
 #define CF_QUERY_NEED_FLUSH         7  /* TRUE/FALSE - */
 #define CF_QUERY_IP_INFO            8  /* TRUE/FALSE struct ip_quadruple */
-#define CF_QUERY_HTTP_VERSION       9  /* number (10/11/20/30)   -  */
+#define CF_QUERY_HTTP_VERSION       9  /* number (10/11/20/30)   - */
 /* pass in a `const struct Curl_sockaddr_ex **` as `pres2`. Gets set
 * to NULL when not connected. */
 #define CF_QUERY_REMOTE_ADDR       10  /* -          `Curl_sockaddr_ex *` */
--- a/lib/config-riscos.h
+++ b/lib/config-riscos.h
@ -36,36 +36,15 @@
 /* Define if you want the built-in manual */
 #define USE_MANUAL

-/* Define if you have the gethostbyname_r() function with 3 arguments */
-#undef HAVE_GETHOSTBYNAME_R_3
-
-/* Define if you have the gethostbyname_r() function with 5 arguments */
-#undef HAVE_GETHOSTBYNAME_R_5
-
-/* Define if you have the gethostbyname_r() function with 6 arguments */
-#undef HAVE_GETHOSTBYNAME_R_6
-
-/* Define if you need the _REENTRANT define for some functions */
-#undef NEED_REENTRANT
-
-/* Define if you want to enable IPv6 support */
-#undef USE_IPV6
-
 /* Define if struct sockaddr_in6 has the sin6_scope_id member */
 #define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1

-/* Define this to 'int' if ssize_t is not an available typedefed type */
-#undef ssize_t
-
 /* Define if you have the alarm function. */
 #define HAVE_ALARM

 /* Define if you have the <arpa/inet.h> header file. */
 #define HAVE_ARPA_INET_H

-/* Define if you have the `closesocket' function. */
-#undef HAVE_CLOSESOCKET
-
 /* Define if you have the <fcntl.h> header file. */
 #define HAVE_FCNTL_H

@ -75,30 +54,15 @@
 /* Define if getaddrinfo exists and works */
 #define HAVE_GETADDRINFO

-/* Define if you have the `geteuid' function. */
-#undef HAVE_GETEUID
-
-/* Define if you have the `gethostbyname_r' function. */
-#undef HAVE_GETHOSTBYNAME_R
-
 /* Define if you have the `gethostname' function. */
 #define HAVE_GETHOSTNAME

-/* Define if you have the `getpass_r' function. */
-#undef HAVE_GETPASS_R
-
-/* Define if you have the `getpwuid' function. */
-#undef HAVE_GETPWUID
-
 /* Define if you have the `gettimeofday' function. */
 #define HAVE_GETTIMEOFDAY

 /* Define if you have the `timeval' struct. */
 #define HAVE_STRUCT_TIMEVAL

-/* Define if you have the <io.h> header file. */
-#undef HAVE_IO_H
-
 /* Define if you have the <netdb.h> header file. */
 #define HAVE_NETDB_H

@ -108,51 +72,24 @@
 /* Define if you have the <net/if.h> header file. */
 #define HAVE_NET_IF_H

-/* Define if you have the <pwd.h> header file. */
-#undef HAVE_PWD_H
-
 /* Define if you have the `select' function. */
 #define HAVE_SELECT

-/* Define if you have the `sigaction' function. */
-#undef HAVE_SIGACTION
-
 /* Define if you have the `signal' function. */
 #define HAVE_SIGNAL

 /* Define if you have the `socket' function. */
 #define HAVE_SOCKET

-/* Define if you have the `strcasecmp' function. */
-#undef HAVE_STRCASECMP
-
-/* Define if you have the `strcmpi' function. */
-#undef HAVE_STRCMPI
-
 /* Define if you have the `stricmp' function. */
 #define HAVE_STRICMP

-/* Define if you have the <strings.h> header file. */
-#undef HAVE_STRINGS_H
-
-/* Define if you have the <sys/param.h> header file. */
-#undef HAVE_SYS_PARAM_H
-
-/* Define if you have the <sys/select.h> header file. */
-#undef HAVE_SYS_SELECT_H
-
-/* Define if you have the <sys/sockio.h> header file. */
-#undef HAVE_SYS_SOCKIO_H
-
 /* Define if you have the <sys/types.h> header file. */
 #define HAVE_SYS_TYPES_H

 /* Define if you have the <termios.h> header file. */
 #define HAVE_TERMIOS_H

-/* Define if you have the <termio.h> header file. */
-#undef HAVE_TERMIO_H
-
 /* Define if you have the <unistd.h> header file. */
 #define HAVE_UNISTD_H

@ -162,24 +99,6 @@
 /* The size of `size_t', as computed by sizeof. */
 #define SIZEOF_SIZE_T 4

-/* Define if you have the ANSI C header files. */
-#undef STDC_HEADERS
-
-/* Version number of package */
-#undef VERSION
-
-/* Number of bits in a file offset, on hosts where this is settable. */
-#undef _FILE_OFFSET_BITS
-
-/* Define to empty if `const' does not conform to ANSI C. */
-#undef const
-
-/* Define to `unsigned' if <sys/types.h> does not define. */
-#undef size_t
-
-/* Define to `int' if <sys/types.h> does not define. */
-#undef ssize_t
-
 /* Define if you have a working ioctl FIONBIO function. */
 #define HAVE_IOCTL_FIONBIO

--- a/lib/config-win32.h
+++ b/lib/config-win32.h
@ -159,11 +159,6 @@
 /* Define to the function return type for send. */
 #define SEND_TYPE_RETV int

-/* Define to 1 if you have the snprintf function. */
-#if (defined(_MSC_VER) && (_MSC_VER >= 1900)) || defined(__MINGW32__)
-#define HAVE_SNPRINTF 1
-#endif
-
 /* Must always use local implementations on Windows. */
 /* Define to 1 if you have an IPv6 capable working inet_ntop function. */
 /* #undef HAVE_INET_NTOP */
@ -284,7 +279,6 @@
 /* ---------------------------------------------------------------- */

 #ifndef CURL_WINDOWS_UWP
-#undef HAVE_LDAP_URL_PARSE
 #define HAVE_LDAP_SSL 1
 #define USE_WIN32_LDAP 1
 #endif
--- a/lib/connect.c
+++ b/lib/connect.c
@ -61,7 +61,7 @@
 #include "multiif.h"
 #include "curlx/inet_ntop.h"
 #include "curlx/strparse.h"
-#include "vtls/vtls.h" /* for vtsl cfilters */
+#include "vtls/vtls.h" /* for vtls cfilters */
 #include "progress.h"
 #include "conncache.h"
 #include "multihandle.h"
--- a/lib/curl_addrinfo.c
+++ b/lib/curl_addrinfo.c
@ -115,8 +115,8 @@ int Curl_getaddrinfo_ex(const char *nodename,

  for(ai = aihead; ai != NULL; ai = ai->ai_next) {
    size_t namelen = ai->ai_canonname ? strlen(ai->ai_canonname) + 1 : 0;
-    /* ignore elements with unsupported address family, */
-    /* settle family-specific sockaddr structure size.  */
+    /* ignore elements with unsupported address family,
+       settle family-specific sockaddr structure size. */
    if(ai->ai_family == AF_INET)
      ss_size = sizeof(struct sockaddr_in);
 #ifdef USE_IPV6
@ -140,8 +140,8 @@ int Curl_getaddrinfo_ex(const char *nodename,
      break;
    }

-    /* copy each structure member individually, member ordering, */
-    /* size, or padding might be different for each platform.    */
+    /* copy each structure member individually, member ordering,
+       size, or padding might be different for each platform. */

    ca->ai_flags     = ai->ai_flags;
    ca->ai_family    = ai->ai_family;
--- a/Show more
+++ b/Show more