-
-
Notifications
You must be signed in to change notification settings - Fork 7.4k
Expand file tree
/
Copy pathRELEASE-NOTES
More file actions
312 lines (296 loc) · 13.9 KB
/
Copy pathRELEASE-NOTES
File metadata and controls
312 lines (296 loc) · 13.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
curl and libcurl 8.23.0
Public curl releases: 276
Command line options: 278
curl_easy_setopt() options: 312
Public functions in libcurl: 100
Authors: 1536
Contributors: 3819
This release includes the following changes:
o lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK [64]
o SMB: drop support [63]
o tool_cb_wrt: inject the no-clobber number before the extension [21]
o tool_cb_wrt: try up to .9999 when no-clobbering [46]
This release includes the following bugfixes:
o base64: avoid repeated input loads when encoding [114]
o base64: optimize decode lookup table and quantum loop [88]
o build: convert HAS_TIME_T_UNSIGNED to a compile-time check [65]
o build: drop `HTTP_ONLY` option [23]
o capsule: reject a capsule that can never be buffered [84]
o clang-tidy: merge nested `if()`s [39]
o config2setopts: always set the security options for SCP/SFTP [67]
o conncache: avoid evicting connect-only connections [79]
o conncache: remove bundle dest [50]
o connectdata: use less curltime [34]
o cookie: accept slightly longer lines in cookie jars [105]
o cookie: ignore individual cookie errors when loading [6]
o cshutdown: make it smaller [60]
o curl_addrinfo: drop redundant parentheses [41]
o curl_fopen: restore the uid and gid checks [70]
o curl_formadd.md: mention the strlen() for names as well [29]
o CURLINFO_EFFECTIVE_URL.md: mention a short lifetime [116]
o CURLOPT*ISSUERCERT*: not verified cryptographically [28]
o CURLOPT_SHARE.md: remove bad explanation for cookie sharing [7]
o CURLOPT_SSL_CTX_FUNCTION.md: client cert caveats [87]
o cw-out: avoid O(n^2) work while buffering paused output [74]
o cw-pause: fix O(N^2) list traversal in cw_pause_flush [137]
o digest: check peer equality for staleness [24]
o digest: fix maximum length quoted value parsing [22]
o digest: parse without storing 'value' in local buffer [20]
o digest: quote the digest-uri param as well [85]
o dnscache/conncache tweaks [75]
o docs: add the missing .html to the url-encode book link [3]
o doh: reject undersized HTTPS RDATA [11]
o dynhds: grow header array geometrically [73]
o easy: duplicating a zero byte memory area needs no malloc [91]
o easy: make ca_cache_timeout standalone [51]
o escape: polish encoding and decoding for speed [37]
o escape: use hex-pair lookup in curl_easy_escape [77]
o examples: clean up crawler link parsing resources [119]
o fnmatch: replace recursive matcher with iterative greedy algorithm [72]
o formdata: reject a negative content length in curl_formadd [128]
o ftp: require TLS on the data connection for implicit FTPS [126]
o ftp: tighten use_ssl check for conn reuse [19]
o ftp: URL encode file names when wildcarding [61]
o ftplistparser: no more overwriting set.write_func [100]
o getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds [107]
o getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds [94]
o getparam: switch off CONNECT headers when using -J [4]
o glob: reduce the number of allocations for URLs that don't need globbing. [109]
o global_init: tidy up, simplify, fix issues [43]
o happy eyeballs: bound work from many duplicate/failing addresses [80]
o hash: change key arguments to const [14]
o hash: vary bucket placement across process runs [108]
o headers: avoid O(n^2) rescans in curl_easy_nextheader() [81]
o hsts: cap max-age to two years [47]
o hsts: on load, only remove exact duplicates [56]
o HTTP-CONNECT: do not react to 401 responses [31]
o http2: changes in error handling [53]
o http2: don't send a CURLE_SEND_ERROR after a valid http2 response [71]
o http2: initialize URL handle for server pushes [104]
o http2: update a refused stream's error after GOAWAY [102]
o http: abide to close-rules when transfer-encoding off [132]
o http: ignore Proxy-Authenticate unless the response comes from a proxy [120]
o http: only enable Negotiate/NTLM to allowed origins [99]
o http: reject resumed uploads [16]
o httpsig-key.md: correct the generating Ed25519 keys commands [97]
o imap: compare selected mailbox names case-sensitively [57]
o KNOWN_BUGS: drop the empty error buffer entry, it no longer happens [66]
o ldap: base64-encode a non-SAFE DN and reject a control-byte type name [55]
o lib: connection shutdown, cleanup code [92]
o lib: make private functions static and remove unused code [83]
o lib: reject internal handles in the multi/easy public API [103]
o libssh2: match hashed known_hosts entries by host [30]
o libssh2: skip repeat checkp() for already-absent hashed key types [82]
o mbedtls: fix ticket handling [52]
o mime: bound Curl_mime_prepare_headers() recursion depth [76]
o mime: do curl_mime_free() non-recursively [48]
o mprintf: avoid scanning strings twice for unbounded %s [110]
o mprintf: stage output and emit it in runs [38]
o mqtt: drain queued output before advancing the state machine [118]
o mulit_ev: remove socket references on forget [89]
o multi-event: fix timeout of pending transfers [111]
o multi: reduce struct size with small cleanups [25]
o multi: remove redundant completion message list [32]
o multi: store timeout epoch as whole seconds [36]
o multi_ntfy: fix handling of more than 128 notifications in a batch [86]
o multi_ntfy: replace enabled bitset with inline flags [44]
o multihandle: some easy shrinks [33]
o netrc: empty quoted values now produce a valid empty string [62]
o netrc: survive comment-only .netrc file [93]
o ngtcp2: shrink max sendbuf [13]
o openssl/gtls: reject CRLfile with native CA store, matching rustls [27]
o openssl: use non-deprecated API for MD5/MD4 [69]
o os400: document curl_formadd_CCSID multi-chunk peculiarity [5]
o ossl_verifyhost: remove assumption of null termination of ASN1_STRING. [26]
o parsedate: find day names, months and time zones faster [68]
o parsedate: remove the unused leading three letters [106]
o perf-tests: output two-digital decimals always [96]
o pingpong: add a max loop counter for Curl_pp_readresp [113]
o rtsp: accept a Content-Length body on methods that expected none [115]
o rtsp: do not send a learned session id to another origin [10]
o runtests: Added runnernums in order to have O(1) lookup [45]
o schannel: auto_client_cert conn matching [17]
o schannel: clear borrowed sslContext on close [15]
o socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH [124]
o ssl: dedup ssl_fsslctx [35]
o strparse: speed up number parsing [129]
o telnet: make it work through proxy tunnels [112]
o test 1605: move from unit to libtest [49]
o test1399: improve reliability [9]
o test1679: unset `SSL_CERT_FILE`, use `TESTNUMBER` [58]
o tftp: verify direction in a few places [101]
o tool: (re)set SSL verification in --libcurl output [1]
o tool: buffer headers before remote filename selection [98]
o tool_doswin: recognize superscript numbers as reserved [117]
o tool_easysrc: reset the handle between --next operations [90]
o tool_getparam: do not print the value of a redacted argument [127]
o tool_help: guard category[2] access when category is bare "-" [59]
o tool_ipfs: keep the path percent-encoded when rewriting to the gateway [138]
o tool_operate: clear the retry flag when the output file fails [122]
o u8_strset, u32_ptrset: fix boundaries handling [131]
o uint-bset: skip unused slots when counting
o url: match connections without force reuse and candidates [95]
o url: ntlm/negotiate, prohibit connection reuse on follows [18]
o urlapi: run the urlparser perf test faster [54]
o urldata: remove conn->given [40]
o urldata: remove ssl_primary_config from easy handle [78]
o vquic: fix preprocessor check for old Darwin versions [8]
o vssh: do not busy-loop in blocking state machine without a timeout [121]
o vtls: fix Curl_cert_hostcheck when the pattern is not a C string [12]
o warnless: dedupe Intel compiler warning suppression pragmas [42]
o x509: stricter parsing [2]
This release includes the following known bugs:
See https://curl.se/docs/knownbugs.html
For all changes ever done in curl:
See https://curl.se/changes.html
Planned upcoming removals include:
o HTTP/2 Server Push
o local crypto implementations
o NTLM
See https://curl.se/dev/deprecate.html
This release would not have looked like this without help, code, reports and
advice from friends like these:
1rhino2 on hackerone, Adam Shirt, Artem Prilutskiy, Aviv Engelberg,
Axel Mierczuk, Bobbeh Rhino, Christian Hesse, Christian Ullrich, Claude,
Dan Fandrich, Daniel Lang, Daniel Stenberg, David Benjamin,
Fengxiaoxx on github, Filippo Tedeschi, Florent Castelli, Fredrik Blau,
Huang Yiheng, Ilias Aberkane, Jorge Rocamora, Joshua Rogers, ldm0, Luna Tong,
Martin Dukek, Max Dymond, Mihai-Gabriel Marin, minnnjuuu,
Muhamad Arga Reksapati, OSS-Fuzz, Paolo Ganci, Patrick Monnerat, rawsun007,
Ray Satiro, renovate[bot], Rhino, Richard Payne, Ron Kuper, Roshan Ramani,
Rudolf Polzer, Samuel Henrique, Skye Soss, Stanislav Fort, Stefan Eissing,
Stephen Psaradellis, szedenik-adam on github, Thanniru Sai Teja,
Tyler Yankee, Un1q32, Viktor Szakats, xhon-pelushi, Yechan Bae
(51 contributors)
References to bug reports and discussions on issues:
[1] = https://curl.se/bug/?i=22701
[2] = https://curl.se/bug/?i=22799
[3] = https://curl.se/bug/?i=22811
[4] = https://curl.se/bug/?i=22838
[5] = https://curl.se/bug/?i=22887
[6] = https://curl.se/bug/?i=22840
[7] = https://curl.se/bug/?i=22788
[8] = https://curl.se/bug/?i=22797
[9] = https://curl.se/bug/?i=22798
[10] = https://curl.se/bug/?i=22920
[11] = https://curl.se/bug/?i=22791
[12] = https://curl.se/bug/?i=22795
[13] = https://curl.se/bug/?i=22786
[14] = https://curl.se/bug/?i=22886
[15] = https://curl.se/bug/?i=22720
[16] = https://curl.se/bug/?i=22703
[17] = https://curl.se/bug/?i=22827
[18] = https://curl.se/bug/?i=22884
[19] = https://curl.se/bug/?i=22823
[20] = https://curl.se/bug/?i=22831
[21] = https://curl.se/bug/?i=22787
[22] = https://curl.se/bug/?i=22830
[23] = https://curl.se/bug/?i=22740
[24] = https://curl.se/bug/?i=22828
[25] = https://curl.se/bug/?i=22807
[26] = https://curl.se/bug/?i=22822
[27] = https://curl.se/bug/?i=22826
[28] = https://curl.se/bug/?i=22825
[29] = https://curl.se/bug/?i=22926
[30] = https://curl.se/bug/?i=22874
[31] = https://curl.se/bug/?i=22817
[32] = https://curl.se/bug/?i=22805
[33] = https://curl.se/bug/?i=22801
[34] = https://curl.se/bug/?i=22815
[35] = https://curl.se/bug/?i=22876
[36] = https://curl.se/bug/?i=22806
[37] = https://curl.se/bug/?i=22780
[38] = https://curl.se/bug/?i=22766
[39] = https://curl.se/bug/?i=22793
[40] = https://curl.se/bug/?i=22875
[41] = https://curl.se/bug/?i=22810
[42] = https://curl.se/bug/?i=22796
[43] = https://curl.se/bug/?i=22746
[44] = https://curl.se/bug/?i=22804
[45] = https://curl.se/bug/?i=22753
[46] = https://curl.se/bug/?i=22784
[47] = https://curl.se/bug/?i=22878
[48] = https://curl.se/bug/?i=22927
[49] = https://curl.se/bug/?i=22928
[50] = https://curl.se/bug/?i=22873
[51] = https://curl.se/bug/?i=22877
[52] = https://curl.se/bug/?i=22871
[53] = https://curl.se/bug/?i=22870
[54] = https://curl.se/bug/?i=22924
[55] = https://curl.se/bug/?i=22945
[56] = https://curl.se/bug/?i=22869
[57] = https://curl.se/bug/?i=22868
[58] = https://curl.se/bug/?i=22866
[59] = https://curl.se/bug/?i=22957
[60] = https://curl.se/bug/?i=22862
[61] = https://curl.se/bug/?i=22860
[62] = https://issues.oss-fuzz.com/issues/560352522
[63] = https://curl.se/bug/?i=22652
[64] = https://curl.se/bug/?i=22819
[65] = https://curl.se/bug/?i=22849
[66] = https://curl.se/bug/?i=544
[67] = https://curl.se/bug/?i=22839
[68] = https://curl.se/bug/?i=22981
[69] = https://curl.se/bug/?i=22221
[70] = https://curl.se/bug/?i=22843
[71] = https://curl.se/bug/?i=22984
[72] = https://curl.se/bug/?i=22911
[73] = https://curl.se/bug/?i=22910
[74] = https://curl.se/bug/?i=22896
[75] = https://curl.se/bug/?i=22900
[76] = https://curl.se/bug/?i=22971
[77] = https://curl.se/bug/?i=23021
[78] = https://curl.se/bug/?i=22901
[79] = https://curl.se/bug/?i=22902
[80] = https://curl.se/bug/?i=22897
[81] = https://curl.se/bug/?i=22898
[82] = https://curl.se/bug/?i=22905
[83] = https://curl.se/bug/?i=22906
[84] = https://curl.se/bug/?i=22998
[85] = https://curl.se/bug/?i=23018
[86] = https://curl.se/bug/?i=22963
[87] = https://curl.se/bug/?i=22899
[88] = https://curl.se/bug/?i=22903
[89] = https://curl.se/bug/?i=22895
[90] = https://curl.se/bug/?i=22890
[91] = https://curl.se/bug/?i=22893
[92] = https://curl.se/bug/?i=22888
[93] = https://curl.se/bug/?i=22889
[94] = https://curl.se/bug/?i=23020
[95] = https://curl.se/bug/?i=22857
[96] = https://curl.se/bug/?i=22982
[97] = https://curl.se/bug/?i=22961
[98] = https://curl.se/bug/?i=22977
[99] = https://curl.se/bug/?i=23012
[100] = https://curl.se/bug/?i=22969
[101] = https://curl.se/bug/?i=22974
[102] = https://curl.se/bug/?i=22923
[103] = https://curl.se/bug/?i=22917
[104] = https://curl.se/bug/?i=22970
[105] = https://curl.se/bug/?i=22964
[106] = https://curl.se/bug/?i=23013
[107] = https://curl.se/bug/?i=23016
[108] = https://curl.se/bug/?i=22916
[109] = https://curl.se/bug/?i=22947
[110] = https://curl.se/bug/?i=23019
[111] = https://curl.se/bug/?i=22942
[112] = https://curl.se/bug/?i=22941
[113] = https://curl.se/bug/?i=22932
[114] = https://curl.se/bug/?i=23017
[115] = https://curl.se/bug/?i=12414
[116] = https://curl.se/bug/?i=23015
[117] = https://curl.se/bug/?i=23011
[118] = https://issues.oss-fuzz.com/issues/563679840, https://issues.oss-fuzz.com/issues/559825608
[119] = https://curl.se/bug/?i=23008
[120] = https://curl.se/bug/?i=23002
[121] = https://curl.se/bug/?i=23005
[122] = https://curl.se/bug/?i=23001
[124] = https://curl.se/bug/?i=23003
[126] = https://curl.se/bug/?i=22995
[127] = https://curl.se/bug/?i=22997
[128] = https://curl.se/bug/?i=22996
[129] = https://curl.se/bug/?i=22993
[131] = https://curl.se/bug/?i=22991
[132] = https://curl.se/bug/?i=22950
[137] = https://curl.se/bug/?i=22968
[138] = https://curl.se/bug/?i=22944