curl / Development / Pending Release Notes
Pending RELEASE-NOTES for the upcoming release
This is work in progress and seeing changes before the release goes public on 2026-10-14.
Changes:
- lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK
- SMB: drop support
- tool_cb_wrt: inject the no-clobber number before the extension
- tool_cb_wrt: try up to .9999 when no-clobbering
Bugfixes:
- base64: avoid repeated input loads when encoding
- base64: optimize decode lookup table and quantum loop
- build: convert HAS_TIME_T_UNSIGNED to a compile-time check
- build: drop `HTTP_ONLY` option
- capsule: reject a capsule that can never be buffered
- clang-tidy: merge nested `if()`s
- config2setopts: always set the security options for SCP/SFTP
- conncache: avoid evicting connect-only connections
- conncache: remove bundle dest
- connectdata: use less curltime
- cookie: accept slightly longer lines in cookie jars
- cookie: ignore individual cookie errors when loading
- cshutdown: make it smaller
- curl_addrinfo: drop redundant parentheses
- curl_fopen: restore the uid and gid checks
- curl_formadd.md: mention the strlen() for names as well
- CURLINFO_EFFECTIVE_URL.md: mention a short lifetime
- CURLOPT*ISSUERCERT*: not verified cryptographically
- CURLOPT_SHARE.md: remove bad explanation for cookie sharing
- CURLOPT_SSL_CTX_FUNCTION.md: client cert caveats
- cw-out: avoid O(n^2) work while buffering paused output
- cw-pause: fix O(N^2) list traversal in cw_pause_flush
- digest: check peer equality for staleness
- digest: fix maximum length quoted value parsing
- digest: parse without storing 'value' in local buffer
- digest: quote the digest-uri param as well
- dnscache/conncache tweaks
- docs: add the missing .html to the url-encode book link
- doh: reject undersized HTTPS RDATA
- dynhds: grow header array geometrically
- easy: duplicating a zero byte memory area needs no malloc
- easy: make ca_cache_timeout standalone
- escape: polish encoding and decoding for speed
- escape: use hex-pair lookup in curl_easy_escape
- examples: clean up crawler link parsing resources
- fnmatch: replace recursive matcher with iterative greedy algorithm
- formdata: reject a negative content length in curl_formadd
- ftp: require TLS on the data connection for implicit FTPS
- ftp: tighten use_ssl check for conn reuse
- ftp: URL encode file names when wildcarding
- ftplistparser: no more overwriting set.write_func
- getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds
- getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds
- getparam: switch off CONNECT headers when using -J
- glob: reduce the number of allocations for URLs that don't need globbing.
- global_init: tidy up, simplify, fix issues
- happy eyeballs: bound work from many duplicate/failing addresses
- hash: change key arguments to const
- hash: vary bucket placement across process runs
- headers: avoid O(n^2) rescans in curl_easy_nextheader()
- hsts: cap max-age to two years
- hsts: on load, only remove exact duplicates
- HTTP-CONNECT: do not react to 401 responses
- http2: changes in error handling
- http2: don't send a CURLE_SEND_ERROR after a valid http2 response
- http2: initialize URL handle for server pushes
- http2: update a refused stream's error after GOAWAY
- http: abide to close-rules when transfer-encoding off
- http: ignore Proxy-Authenticate unless the response comes from a proxy
- http: only enable Negotiate/NTLM to allowed origins
- http: reject resumed uploads
- httpsig-key.md: correct the generating Ed25519 keys commands
- imap: compare selected mailbox names case-sensitively
- KNOWN_BUGS: drop the empty error buffer entry, it no longer happens
- ldap: base64-encode a non-SAFE DN and reject a control-byte type name
- lib: connection shutdown, cleanup code
- lib: make private functions static and remove unused code
- lib: reject internal handles in the multi/easy public API
- libssh2: match hashed known_hosts entries by host
- libssh2: skip repeat checkp() for already-absent hashed key types
- mbedtls: fix ticket handling
- mime: bound Curl_mime_prepare_headers() recursion depth
- mime: do curl_mime_free() non-recursively
- mprintf: avoid scanning strings twice for unbounded %s
- mprintf: stage output and emit it in runs
- mqtt: drain queued output before advancing the state machine
- mulit_ev: remove socket references on forget
- multi-event: fix timeout of pending transfers
- multi: reduce struct size with small cleanups
- multi: remove redundant completion message list
- multi: store timeout epoch as whole seconds
- multi_ntfy: fix handling of more than 128 notifications in a batch
- multi_ntfy: replace enabled bitset with inline flags
- multihandle: some easy shrinks
- netrc: empty quoted values now produce a valid empty string
- netrc: survive comment-only .netrc file
- ngtcp2: shrink max sendbuf
- openssl/gtls: reject CRLfile with native CA store, matching rustls
- openssl: use non-deprecated API for MD5/MD4
- os400: document curl_formadd_CCSID multi-chunk peculiarity
- ossl_verifyhost: remove assumption of null termination of ASN1_STRING.
- parsedate: find day names, months and time zones faster
- parsedate: remove the unused leading three letters
- perf-tests: output two-digital decimals always
- pingpong: add a max loop counter for Curl_pp_readresp
- rtsp: accept a Content-Length body on methods that expected none
- rtsp: do not send a learned session id to another origin
- runtests: Added runnernums in order to have O(1) lookup
- schannel: auto_client_cert conn matching
- schannel: clear borrowed sslContext on close
- socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH
- ssl: dedup ssl_fsslctx
- strparse: speed up number parsing
- telnet: make it work through proxy tunnels
- test 1605: move from unit to libtest
- test1399: improve reliability
- test1679: unset `SSL_CERT_FILE`, use `TESTNUMBER`
- tftp: verify direction in a few places
- tool: (re)set SSL verification in --libcurl output
- tool: buffer headers before remote filename selection
- tool_doswin: recognize superscript numbers as reserved
- tool_easysrc: reset the handle between --next operations
- tool_getparam: do not print the value of a redacted argument
- tool_help: guard category[2] access when category is bare "-"
- tool_ipfs: keep the path percent-encoded when rewriting to the gateway
- tool_operate: clear the retry flag when the output file fails
- u8_strset, u32_ptrset: fix boundaries handling
- uint-bset: skip unused slots when counting
- url: match connections without force reuse and candidates
- url: ntlm/negotiate, prohibit connection reuse on follows
- urlapi: run the urlparser perf test faster
- urldata: remove conn->given
- urldata: remove ssl_primary_config from easy handle
- vquic: fix preprocessor check for old Darwin versions
- vssh: do not busy-loop in blocking state machine without a timeout
- vtls: fix Curl_cert_hostcheck when the pattern is not a C string
- warnless: dedupe Intel compiler warning suppression pragmas
- x509: stricter parsing
Contributors:
1rhino2 on hackerone, Adam Shirt, Artem Prilutskiy, Aviv Engelberg, Axel Mierczuk, Bobbeh Rhino, Christian Hesse, Christian Ullrich, Claude, Dan Fandrich, Daniel Lang, Daniel Stenberg, David Benjamin, Fengxiaoxx on github, Filippo Tedeschi, Florent Castelli, Fredrik Blau, Huang Yiheng, Ilias Aberkane, Jorge Rocamora, Joshua Rogers, ldm0, Luna Tong, Martin Dukek, Max Dymond, Mihai-Gabriel Marin, minnnjuuu, Muhamad Arga Reksapati, OSS-Fuzz, Paolo Ganci, Patrick Monnerat, rawsun007, Ray Satiro, renovate[bot], Rhino, Richard Payne, Ron Kuper, Roshan Ramani, Rudolf Polzer, Samuel Henrique, Skye Soss, Stanislav Fort, Stefan Eissing, Stephen Psaradellis, szedenik-adam on github, Thanniru Sai Teja, Tyler Yankee, Un1q32, Viktor Szakats, xhon-pelushi, Yechan Bae