curl and libcurl 8.12.0 Public curl releases: 264 Command line options: 266 curl_easy_setopt() options: 306 Public functions in libcurl: 94 Contributors: 3309 This release includes the following changes: o curl: add byte range support to --variable reading from file [56] o curl: make --etag-save acknowledge --create-dirs [31] o getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var [55] o getinfo: provide info which auth was used for HTTP and proxy [40] o hyper: drop support [57] o QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA [61] This release includes the following bugfixes: o altsvc: avoid integer overflow in expire calculation [16] o async-thread: avoid closing eventfd twice [9] o binmode: convert to macro and use it from tests [44] o build: drop `-Winline` picky warning [53] o build: drop unused feature macros, update exception list [51] o build: fix the tidy targets for autotools [52] o cd2nroff: support "none" as a TLS backend [29] o cf-socket: error if address can't be copied [72] o checksrc: ban use of sscanf() [7] o checksrc: fix the return() checker [35] o cmake/FindLDAP: avoid empty 'Requires' item when omitting `pkg-config` module [90] o cmake/FindLibpsl: protect against `pkg-config` "half-detection" [89] o cmake/FindLibssh: sync header comment with other modules o cmake/FindMbedTLS: drop lib duplicates early [17] o cmake: add `librtmp` Find module [86] o cmake: add LDAP Find module [46] o cmake: add native `pkg-config` detection for remaining Find modules [37] o cmake: allow `CURL_LTO` regardless of `CURL_BUILD_TYPE`, enable in CI [88] o cmake: clang-cl improvements [42] o cmake: delete accidental debug message o cmake: drop duplicate Windows cache value [81] o cmake: drop redundant FOUND checks (libgsasl, libssh, libuv) [49] o cmake: drop redundant opening/closing `.*` from `MATCH` expressions [64] o cmake: drop unused `HAVE_SYS_XATTR_H` detection [79] o cmake: extend zlib's `AUTO` option to brotli, zstd and enable if found [36] o cmake: improve `curl_dumpvars()` and move to `Utilities.cmake` [50] o cmake: make libpsl required by default [45] o cmake: move `pkg-config` names to Find modules [87] o cmake: move GSS init before feature detections [93] o cmake: namespace functions and macros [41] o cmake: optimize out 4 picky warning option detections with gcc [78] o cmake: replace `unset(VAR)` with `set(VAR "")` for init [43] o cmake: use `CMAKE_REQUIRED_LINK_DIRECTORIES` [48] o cmake: use `STREQUAL` to detect Linux [68] o config-mac: drop `MACOS_SSL_SUPPORT` macro [63] o conncache: result_cb comment removed from function docs [1] o cookie: fix crash in netscape cookie parsing [84] o cookie: parse only the exact expire date [3] o curl: return error if etag options are used with multiple URLs [5] o curl_multibyte: support Windows paths longer than MAX_PATH [76] o curl_url_set.md: adjust the added-in to 7.62.0 [94] o curl_ws_recv.md: fix typo o CURLOPT_PROXY.md: clarify the crendential support in proxy URLs [66] o CURLOPT_RESOLVE.md: fix wording [30] o docs/BUGS.md: remove leading space from a link o examples/block-ip: show how to block IP addresses [74] o examples/complicated: fix warnings, bump deprecated callback, tidy up [59] o examples/synctime.c: remove references to dead URLs and functionality [62] o examples: make them compile with compatibility functions disabled (Windows) [58] o http2: fix value stored to 'result' is never read [71] o http: fix build with `CURL_DISABLE_COOKIES` [95] o http_aws_sigv4: Fix invalid compare function handling zero-length pairs [24] o lib517: extend the getdate test with quotes and leading "junk" [4] o lib: replace `inline` redefine with `CURL_INLINE` macro [47] o lib: supress deprecation warnings in apple builds [32] o lib: TLS session ticket caching reworked [60] o Makefile.mk: drop in favour of autotools and cmake (MS-DOS, AmigaOS3) [38] o multi: fix curl_multi_waitfds reporting of fd_count [73] o multissl: make openssl + wolfssl builds work [34] o netrc: fix password-only entries [28] o netrc: restore _netrc fallback logic [6] o ngtcp2: fix two cases of value stored never read [65] o openssl: fix ECH logic [67] o projects/Windows: remove wolfSSL from legacy projects [75] o RELEASE-PROCEDURE.md: mention how to publish security advisories [2] o scripts/mdlinkcheck: markdown link checker [19] o sectransp: free certificate on error [12] o src: add `CURL_STRICMP()` macro, use `_stricmp()` on Windows [54] o strparse: string parsing helper functions [8] o system.h: add 64-bit curl_off_t definitions for NonStop [11] o tests/http/clients: use proper sleep() call on NonStop [10] o tool_formparse.c: make curlx_uztoso a static in here [39] o tool_formparse: accept digits in --form type= strings [33] o tool_getparam: fix "Ignored Return Value" [21] o tool_getparam: fix memory leak on error in parse_ech [14] o tool_getparam: fix the ECH parser [20] o tool_operate: make --etag-compare always accept a non-existing file [22] o variable.md: mention --expand-variable for variables to variables [13] o variable.md: show function use with examples [18] o vquic: fix 4th function call argument is an uninitialized value [70] o vquic: make vquic_send_packets not return without setting psent [69] o vtls: remove 'detach/attach' functions from TLS handler struct [25] o vtls: remove unusued 'check_cxn' from TLS handler struct [26] o vtls: replace "none"-functions with NULL pointers [27] o VULN-DISCLOSURE-POLICY.md: mention the not setting CVSS [23] o ws-docs: remove the outdated texts saying ws support is experimental [15] This release includes the following known bugs: See docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html) For all changes ever done in curl: See https://curl.se/changes.html Planned upcoming removals include: o TLS libraries not supporting TLS 1.3 See https://curl.se/dev/deprecate.html for details This release would not have looked like this without help, code, reports and advice from friends like these: Andy Pan, Ben Zanin, Christian Heusel, Christian Schmitz, Christopher Dannemiller, Daniel Stenberg, Darren Banfi, dwickr, Ganesh Viswanathan, Hermes Zhang, IcedCoffeee on github, Jeroen Ooms, Kai Pastor, Kevin Sun, Kuan-Wei Chiu, Manuel Einfalt, Marcel Raad, Mohammed Sadiq, Randall S. Becker, Ray Satiro, renovate[bot], Rudi Heitbaum, Samuel Henrique, Stefan Eissing, Tamir Duberstein, Viktor Szakats (26 contributors) References to bug reports and discussions on issues: [1] = https://curl.se/bug/?i=15720 [2] = https://curl.se/bug/?i=15714 [3] = https://curl.se/bug/?i=15709 [4] = https://curl.se/bug/?i=15708 [5] = https://curl.se/bug/?i=15729 [6] = https://curl.se/bug/?i=15734 [7] = https://curl.se/bug/?i=15687 [8] = https://curl.se/bug/?i=15692 [9] = https://curl.se/bug/?i=15725 [10] = https://curl.se/bug/?i=15711 [11] = https://curl.se/bug/?i=15723 [12] = https://curl.se/bug/?i=15721 [13] = https://curl.se/bug/?i=15752 [14] = https://curl.se/bug/?i=15753 [15] = https://curl.se/bug/?i=15749 [16] = https://issues.oss-fuzz.com/issues/383911309 [17] = https://curl.se/bug/?i=15495 [18] = https://curl.se/bug/?i=15743 [19] = https://curl.se/bug/?i=15742 [20] = https://curl.se/bug/?i=15741 [21] = https://curl.se/bug/?i=15740 [22] = https://curl.se/bug/?i=15737 [23] = https://curl.se/bug/?i=15779 [24] = https://curl.se/bug/?i=15778 [25] = https://curl.se/bug/?i=15776 [26] = https://curl.se/bug/?i=15775 [27] = https://curl.se/bug/?i=15772 [28] = https://curl.se/bug/?i=15767 [29] = https://curl.se/bug/?i=15769 [30] = https://curl.se/bug/?i=15770 [31] = https://curl.se/bug/?i=15730 [32] = https://curl.se/bug/?i=15763 [33] = https://curl.se/bug/?i=15761 [34] = https://curl.se/bug/?i=15596 [35] = https://curl.se/bug/?i=15764 [36] = https://curl.se/bug/?i=15431 [37] = https://curl.se/bug/?i=15408 [38] = https://curl.se/bug/?i=15543 [39] = https://curl.se/bug/?i=15796 [40] = https://curl.se/bug/?i=15450 [41] = https://curl.se/bug/?i=15498 [42] = https://curl.se/bug/?i=15478 [43] = https://curl.se/bug/?i=15255 [44] = https://curl.se/bug/?i=15787 [45] = https://curl.se/bug/?i=15464 [46] = https://curl.se/bug/?i=15273 [47] = https://curl.se/bug/?i=15523 [48] = https://curl.se/bug/?i=15280 [49] = https://curl.se/bug/?i=15465 [50] = https://curl.se/bug/?i=15562 [51] = https://curl.se/bug/?i=15577 [52] = https://curl.se/bug/?i=15813 [53] = https://curl.se/bug/?i=15815 [54] = https://curl.se/bug/?i=15788 [55] = https://curl.se/bug/?i=15512 [56] = https://curl.se/bug/?i=15739 [57] = https://curl.se/bug/?i=15120 [58] = https://curl.se/bug/?i=15789 [59] = https://curl.se/bug/?i=15785 [60] = https://curl.se/bug/?i=15774 [61] = https://curl.se/bug/?i=15667 [62] = https://curl.se/bug/?i=15786 [63] = https://curl.se/bug/?i=15777 [64] = https://curl.se/bug/?i=15773 [65] = https://curl.se/bug/?i=15812 [66] = https://curl.se/bug/?i=15805 [67] = https://curl.se/bug/?i=15814 [68] = https://curl.se/bug/?i=15855 [69] = https://curl.se/bug/?i=15807 [70] = https://curl.se/bug/?i=15808 [71] = https://curl.se/bug/?i=15806 [72] = https://curl.se/bug/?i=15784 [73] = https://curl.se/bug/?i=15146 [74] = https://curl.se/bug/?i=15748 [75] = https://curl.se/bug/?i=15468 [76] = https://curl.se/bug/?i=13522 [78] = https://curl.se/bug/?i=15850 [79] = https://curl.se/bug/?i=15845 [81] = https://curl.se/bug/?i=15840 [84] = https://curl.se/bug/?i=15826 [86] = https://curl.se/bug/?i=15832 [87] = https://curl.se/bug/?i=15800 [88] = https://curl.se/bug/?i=15829 [89] = https://curl.se/bug/?i=15827 [90] = https://curl.se/bug/?i=15828 [93] = https://curl.se/bug/?i=15809 [94] = https://curl.se/bug/?i=15822 [95] = https://curl.se/bug/?i=15820