1845ae1b8c
Daniel Stenberg
2026-09-25
Subject
RELEASE-NOTES: synced
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
RELEASE-NOTES+86 -10
| @@ -5,7 +5,7 @@ curl and libcurl 8.23.0 | |
| curl_easy_setopt() options: 312 | |
| Public functions in libcurl: 100 | |
| Authors: 1536 | |
| - | Contributors: 3819 |
| + | Contributors: 3823 |
| This release includes the following changes: | |
| @@ -21,6 +21,11 @@ This release includes the following bugfixes: | |
| o build: convert HAS_TIME_T_UNSIGNED to a compile-time check [65] | |
| o build: drop `HTTP_ONLY` option [23] | |
| o capsule: reject a capsule that can never be buffered [84] | |
| + | o cf-h1-proxy: reset chunk state on new request [146] |
| + | o cf-h1-proxy: stricter status line parsing [145] |
| + | o cf-ngtcp2-proxy: check for stream close on rx win update [159] |
| + | o cf-ngtcp2-proxy: fix rx flow control [174] |
| + | o cf-socket: clamp keepalive seconds-to-milliseconds conversions [167] |
| o clang-tidy: merge nested `if()`s [39] | |
| o config2setopts: always set the security options for SCP/SFTP [67] | |
| o conncache: avoid evicting connect-only connections [79] | |
| @@ -30,13 +35,16 @@ This release includes the following bugfixes: | |
| o cookie: ignore individual cookie errors when loading [6] | |
| o cshutdown: make it smaller [60] | |
| o curl_addrinfo: drop redundant parentheses [41] | |
| + | o curl_easy_send/recv: check pointer arg [175] |
| o curl_fopen: restore the uid and gid checks [70] | |
| o curl_formadd.md: mention the strlen() for names as well [29] | |
| o CURLINFO_EFFECTIVE_URL.md: mention a short lifetime [116] | |
| o CURLOPT*ISSUERCERT*: not verified cryptographically [28] | |
| + | o CURLOPT_POSTFIELDSIZE.md: improve wording [144] |
| o CURLOPT_SHARE.md: remove bad explanation for cookie sharing [7] | |
| o CURLOPT_SSL_CTX_FUNCTION.md: client cert caveats [87] | |
| o cw-out: avoid O(n^2) work while buffering paused output [74] | |
| + | o cw-out: recheck callbacks for each call [134] |
| o cw-pause: fix O(N^2) list traversal in cw_pause_flush [137] | |
| o digest: check peer equality for staleness [24] | |
| o digest: fix maximum length quoted value parsing [22] | |
| @@ -48,6 +56,7 @@ This release includes the following bugfixes: | |
| o dynhds: grow header array geometrically [73] | |
| o easy: duplicating a zero byte memory area needs no malloc [91] | |
| o easy: make ca_cache_timeout standalone [51] | |
| + | o easy: validate buffer pointer in curl_easy_recv and curl_easy_send [152] |
| o escape: polish encoding and decoding for speed [37] | |
| o escape: use hex-pair lookup in curl_easy_escape [77] | |
| o examples: clean up crawler link parsing resources [119] | |
| @@ -57,11 +66,13 @@ This release includes the following bugfixes: | |
| o ftp: tighten use_ssl check for conn reuse [19] | |
| o ftp: URL encode file names when wildcarding [61] | |
| o ftplistparser: no more overwriting set.write_func [100] | |
| + | o ftplistparser: when wildcarding, skip files with slashes [125] |
| o getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds [107] | |
| o getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds [94] | |
| o getparam: switch off CONNECT headers when using -J [4] | |
| o glob: reduce the number of allocations for URLs that don't need globbing. [109] | |
| o global_init: tidy up, simplify, fix issues [43] | |
| + | o gtls: no early return on verify fail [149] |
| o happy eyeballs: bound work from many duplicate/failing addresses [80] | |
| o hash: change key arguments to const [14] | |
| o hash: vary bucket placement across process runs [108] | |
| @@ -78,7 +89,10 @@ This release includes the following bugfixes: | |
| o http: only enable Negotiate/NTLM to allowed origins [99] | |
| o http: reject resumed uploads [16] | |
| o httpsig-key.md: correct the generating Ed25519 keys commands [97] | |
| + | o httpsrr+ech: check target and port [133] |
| + | o if2ip: check interface name case sensitive [158] |
| o imap: compare selected mailbox names case-sensitively [57] | |
| + | o inet_pton: reject a colon that ends an IPv6 address [179] |
| o KNOWN_BUGS: drop the empty error buffer entry, it no longer happens [66] | |
| o ldap: base64-encode a non-SAFE DN and reject a control-byte type name [55] | |
| o lib: connection shutdown, cleanup code [92] | |
| @@ -86,12 +100,17 @@ This release includes the following bugfixes: | |
| o lib: reject internal handles in the multi/easy public API [103] | |
| o libssh2: match hashed known_hosts entries by host [30] | |
| o libssh2: skip repeat checkp() for already-absent hashed key types [82] | |
| + | o libssh: work with empty priv_key [143] |
| o mbedtls: fix ticket handling [52] | |
| + | o mbedtls: resend length check [140] |
| + | o mime: bound Curl_mime_duppart() recursion depth [164] |
| o mime: bound Curl_mime_prepare_headers() recursion depth [76] | |
| o mime: do curl_mime_free() non-recursively [48] | |
| o mprintf: avoid scanning strings twice for unbounded %s [110] | |
| o mprintf: stage output and emit it in runs [38] | |
| + | o mprintf: use size_t width for the bare Windows %I modifier [178] |
| o mqtt: drain queued output before advancing the state machine [118] | |
| + | o mqtt: remaininglength check for 32-bit systems [150] |
| o mulit_ev: remove socket references on forget [89] | |
| o multi-event: fix timeout of pending transfers [111] | |
| o multi: reduce struct size with small cleanups [25] | |
| @@ -103,26 +122,37 @@ This release includes the following bugfixes: | |
| o netrc: empty quoted values now produce a valid empty string [62] | |
| o netrc: survive comment-only .netrc file [93] | |
| o ngtcp2: shrink max sendbuf [13] | |
| + | o openldap: hand it a dup'd socket, not curl's own |
| o openssl/gtls: reject CRLfile with native CA store, matching rustls [27] | |
| o openssl: use non-deprecated API for MD5/MD4 [69] | |
| o os400: document curl_formadd_CCSID multi-chunk peculiarity [5] | |
| + | o os400: restore HAVE_FCHMOD [181] |
| o ossl_verifyhost: remove assumption of null termination of ASN1_STRING. [26] | |
| + | o output-dir.md: expand on its behavior [151] |
| o parsedate: find day names, months and time zones faster [68] | |
| o parsedate: remove the unused leading three letters [106] | |
| + | o peer: parsing a zoneid as number fix [139] |
| + | o peer: preserve ipv6 props from "connect-to" [155] |
| o perf-tests: output two-digital decimals always [96] | |
| o pingpong: add a max loop counter for Curl_pp_readresp [113] | |
| + | o pytest: check server status without ssl verify [154] |
| o rtsp: accept a Content-Length body on methods that expected none [115] | |
| o rtsp: do not send a learned session id to another origin [10] | |
| o runtests: Added runnernums in order to have O(1) lookup [45] | |
| o schannel: auto_client_cert conn matching [17] | |
| o schannel: clear borrowed sslContext on close [15] | |
| o socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH [124] | |
| + | o socks: track SOCKS5 authentication per socket, not per connection [171] |
| + | o socksd: count connections per test, widen the method2 sentinel |
| o ssl: dedup ssl_fsslctx [35] | |
| + | o ssls: validate input arguments in import, export, and unpack [136] |
| o strparse: speed up number parsing [129] | |
| + | o sws: fix connection-monitor for connections closed before a request [153] |
| o telnet: make it work through proxy tunnels [112] | |
| o test 1605: move from unit to libtest [49] | |
| o test1399: improve reliability [9] | |
| o test1679: unset `SSL_CERT_FILE`, use `TESTNUMBER` [58] | |
| + | o test: restore the old test 1609 as 3271 [162] |
| o tftp: verify direction in a few places [101] | |
| o tool: (re)set SSL verification in --libcurl output [1] | |
| o tool: buffer headers before remote filename selection [98] | |
| @@ -132,17 +162,25 @@ This release includes the following bugfixes: | |
| o tool_help: guard category[2] access when category is bare "-" [59] | |
| o tool_ipfs: keep the path percent-encoded when rewriting to the gateway [138] | |
| o tool_operate: clear the retry flag when the output file fails [122] | |
| + | o tool_operate: set stdin non-blocking unconditionally [130] |
| o u8_strset, u32_ptrset: fix boundaries handling [131] | |
| o uint-bset: skip unused slots when counting | |
| + | o uint-table: add remove-max precaution [165] |
| o url: match connections without force reuse and candidates [95] | |
| o url: ntlm/negotiate, prohibit connection reuse on follows [18] | |
| + | o urlapi: make curl_url_dup() copy the guessed_scheme flag [166] |
| + | o urlapi: normalize legacy numeric IPv4 hosts set via CURLUPART_HOST [180] |
| + | o urlapi: return NULL from curl_url_dup() when given a NULL handle [160] |
| o urlapi: run the urlparser perf test faster [54] | |
| o urldata: remove conn->given [40] | |
| o urldata: remove ssl_primary_config from easy handle [78] | |
| + | o vdns: announce resolver start before the HTTPS RR query is sent [173] |
| o vquic: fix preprocessor check for old Darwin versions [8] | |
| o vssh: do not busy-loop in blocking state machine without a timeout [121] | |
| o vtls: fix Curl_cert_hostcheck when the pattern is not a C string [12] | |
| o warnless: dedupe Intel compiler warning suppression pragmas [42] | |
| + | o wolfssl: remove BIO destroy callback [157] |
| + | o ws: do not auto-pong in raw mode [123] |
| o x509: stricter parsing [2] | |
| This release includes the following known bugs: | |
| @@ -164,18 +202,20 @@ Planned upcoming removals include: | |
| This release would not have looked like this without help, code, reports and | |
| advice from friends like these: | |
| - | 1rhino2 on hackerone, Adam Shirt, Artem Prilutskiy, Aviv Engelberg, |
| - | Axel Mierczuk, Bobbeh Rhino, Christian Hesse, Christian Ullrich, Claude, |
| + | 1rhino2 on hackerone, Adam Shirt, Andreas Westin, Artem Prilutskiy, |
| + | Aviv Engelberg, Axel Mierczuk, Bobbeh Rhino, bupt-Yy-young on github, |
| + | Charles Muehlberger, Christian Hesse, Christian Ullrich, Claude, |
| Dan Fandrich, Daniel Lang, Daniel Stenberg, David Benjamin, | |
| - | Fengxiaoxx on github, Filippo Tedeschi, Florent Castelli, Fredrik Blau, |
| - | Huang Yiheng, Ilias Aberkane, Jorge Rocamora, Joshua Rogers, ldm0, Luna Tong, |
| - | Martin Dukek, Max Dymond, Mihai-Gabriel Marin, minnnjuuu, |
| + | Fengxiaoxx on github, Fernando Gallardo, Filippo Tedeschi, Florent Castelli, |
| + | Fredrik Blau, Huang Yiheng, Ilias Aberkane, Jorge Rocamora, Joshua Rogers, |
| + | ldm0, Luna Tong, Martin Dukek, Max Dymond, Mihai-Gabriel Marin, minnnjuuu, |
| Muhamad Arga Reksapati, OSS-Fuzz, Paolo Ganci, Patrick Monnerat, rawsun007, | |
| Ray Satiro, renovate[bot], Rhino, Richard Payne, Ron Kuper, Roshan Ramani, | |
| - | Rudolf Polzer, Samuel Henrique, Skye Soss, Stanislav Fort, Stefan Eissing, |
| - | Stephen Psaradellis, szedenik-adam on github, Thanniru Sai Teja, |
| - | Tyler Yankee, Un1q32, Viktor Szakats, xhon-pelushi, Yechan Bae |
| - | (51 contributors) |
| + | Rudolf Polzer, Samuel Henrique, Sebastian Raase, Skye Soss, Stanislav Fort, |
| + | Stefan Eissing, Stephen Psaradellis, szedenik-adam on github, |
| + | Thanniru Sai Teja, Tyler Yankee, Un1q32, Viktor Szakats, xhon-pelushi, |
| + | Yechan Bae |
| + | (56 contributors) |
| References to bug reports and discussions on issues: | |
| @@ -301,12 +341,48 @@ References to bug reports and discussions on issues: | |
| [120] = https://curl.se/bug/?i=23002 | |
| [121] = https://curl.se/bug/?i=23005 | |
| [122] = https://curl.se/bug/?i=23001 | |
| + | [123] = https://curl.se/bug/?i=23040 |
| [124] = https://curl.se/bug/?i=23003 | |
| + | [125] = https://curl.se/bug/?i=23089 |
| [126] = https://curl.se/bug/?i=22995 | |
| [127] = https://curl.se/bug/?i=22997 | |
| [128] = https://curl.se/bug/?i=22996 | |
| [129] = https://curl.se/bug/?i=22993 | |
| + | [130] = https://curl.se/bug/?i=23081 |
| [131] = https://curl.se/bug/?i=22991 | |
| [132] = https://curl.se/bug/?i=22950 | |
| + | [133] = https://curl.se/bug/?i=23086 |
| + | [134] = https://curl.se/bug/?i=23085 |
| + | [136] = https://curl.se/bug/?i=23062 |
| [137] = https://curl.se/bug/?i=22968 | |
| [138] = https://curl.se/bug/?i=22944 | |
| + | [139] = https://curl.se/bug/?i=23060 |
| + | [140] = https://curl.se/bug/?i=23083 |
| + | [143] = https://curl.se/bug/?i=23080 |
| + | [144] = https://curl.se/bug/?i=23078 |
| + | [145] = https://curl.se/bug/?i=23068 |
| + | [146] = https://curl.se/bug/?i=23069 |
| + | [149] = https://curl.se/bug/?i=23061 |
| + | [150] = https://curl.se/bug/?i=23071 |
| + | [151] = https://curl.se/bug/?i=23067 |
| + | [152] = https://curl.se/bug/?i=23063 |
| + | [153] = https://curl.se/bug/?i=23072 |
| + | [154] = https://curl.se/bug/?i=23064 |
| + | [155] = https://curl.se/bug/?i=23055 |
| + | [157] = https://curl.se/bug/?i=23058 |
| + | [158] = https://curl.se/bug/?i=23056 |
| + | [159] = https://curl.se/bug/?i=23054 |
| + | [160] = https://curl.se/bug/?i=23051 |
| + | [162] = https://curl.se/bug/?i=23052 |
| + | [164] = https://curl.se/bug/?i=23023 |
| + | [165] = https://curl.se/bug/?i=23034 |
| + | [166] = https://curl.se/bug/?i=23043 |
| + | [167] = https://curl.se/bug/?i=23045 |
| + | [171] = https://curl.se/bug/?i=23014 |
| + | [173] = https://curl.se/bug/?i=23037 |
| + | [174] = https://curl.se/bug/?i=23038 |
| + | [175] = https://curl.se/bug/?i=23035 |
| + | [178] = https://curl.se/bug/?i=23030 |
| + | [179] = https://curl.se/bug/?i=23028 |
| + | [180] = https://curl.se/bug/?i=23027 |
| + | [181] = https://curl.se/bug/?i=23026 |