e825e55867
Daniel Stenberg
2026-08-14
Subject
RELEASE-NOTES: synced
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
RELEASE-NOTES+66 -10
| @@ -4,8 +4,8 @@ curl and libcurl 8.22.0 | |
| Command line options: 278 | |
| curl_easy_setopt() options: 312 | |
| Public functions in libcurl: 100 | |
| - | Authors: 1503 |
| - | Contributors: 3761 |
| + | Authors: 1506 |
| + | Contributors: 3765 |
| This release includes the following changes: | |
| @@ -22,8 +22,13 @@ This release includes the following bugfixes: | |
| o autotools: minor fixes and improvements [33] | |
| o build: always use local `inet_pton()`/`inet_ntop()` implementations [56] | |
| o build: assume POSIX `select()` is available [166] | |
| + | o build: clear `Require.private` for static-only builds in `libcurl.pc` [188] |
| o build: drop superfluous `STDC_HEADERS` macro [51] | |
| o build: enable thread-safe `getaddrinfo()` for OpenBSD [35] | |
| + | o build: minor debug option message fixes/improvements [200] |
| + | o build: require `!NDEBUG` for debug-enabled (aka development) builds [202] |
| + | o build: strip duplicate spaces after `Libs.private:` in `libcurl.pc` [191] |
| + | o build: strip trailing spaces from `libcurl.pc` [194] |
| o cd2nroff: fix backslashes for 4-space indent lines [104] | |
| o cd2nroff: stricter checks for asterisks for italics [73] | |
| o cf-ngtcp2-cmn: de-duplicate `ngtcp2_conn_client_new()` call code [156] | |
| @@ -37,6 +42,7 @@ This release includes the following bugfixes: | |
| o cmake: replace `remove` command with `rm` and pass arg safely [11] | |
| o cmake: robustify base path in local file reference [15] | |
| o cmake: stop probing unused `float.h` for `STDC_HEADERS` [10] | |
| + | o cmake: use built-in variable and target property dump functions with CMake 4.5+ [155] |
| o configure: clarify --enable-debug option [133] | |
| o configure: fix misleading error messages [42] | |
| o configure: link `-lcrypt32` instead of `-lm` for wolfSSL on Windows [79] | |
| @@ -46,7 +52,9 @@ This release includes the following bugfixes: | |
| o conncache: apply multi limits to transfers using a shared pool [41] | |
| o conncache: conn upkeep/alive: move and enhance [152] | |
| o conncache: connection alive checks intervals [20] | |
| + | o conncache: don't assume curl_off_t increment wrap-around [138] |
| o connect: connection close tweaks [112] | |
| + | o content_encoding: exact-match the identity transfer-coding token [189] |
| o content_encoding: give a clear error on multi-member gzip [46] | |
| o cookie: refuse to load cookies set against a PSL domain [139] | |
| o CREDENTIALS.md: remove comment about empty user/pass [50] | |
| @@ -61,14 +69,17 @@ This release includes the following bugfixes: | |
| o CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization', not 'Authentication' [74] | |
| o CURLSHOPT_(UN)SHARE.md: do not modify shares while in use [44] | |
| o DEPRECATE.md: HTTP/2 Server Push gets removed in March 2027 [174] | |
| + | o dict: avoid busy-loop in sendf() when the socket is not writable [99] |
| o dnsd: fix bounds check in `read_https_alpn_part()` [143] | |
| o docs/INTERNALS.md -> docs/DEPENDENCIES.md [127] | |
| + | o DoH: improvements [203] |
| o FTP: fix TLS session reuse on the data connection [80] | |
| o ftp: reject control bytes in ACCT and alternative-to-user [26] | |
| o gitignore: maintenance updates [170] | |
| o gopher: reject CR and LF in the selector [1] | |
| o h2: bootstrap max streams from multi handle if in use [132] | |
| o h3-proxy: fix NULL deref when non-:status header arrives before :status [167] | |
| + | o header api: add guards [168] |
| o HISTORY: add when c-ares support was introduced (2004) | |
| o hostip: only cache negative resolves for authoritative answers [16] | |
| o http2: make server push transfers inherit share from parent [81] | |
| @@ -80,6 +91,8 @@ This release includes the following bugfixes: | |
| o idn: restore `MultiByteToWideChar()` `MB_ERR_INVALID_CHARS` flag [103] | |
| o INSTALL.md: add building-from-source overview section [29] | |
| o INTERNALS.md: require quiche 0.20.0+ [101] | |
| + | o keylog: add a random size argument to Curl_tls_keylog_write() [180] |
| + | o ldap: reject control characters in URL-decoded filter values [196] |
| o ldap: support empty username and password [106] | |
| o ldap: support insecure mode for Windows native LDAP [3] | |
| o lib1587: fix gcc `-Wconversion` with LibreSSL on Windows, test in CI [6] | |
| @@ -89,6 +102,10 @@ This release includes the following bugfixes: | |
| o lib: fix 'ns' -> 'us' in trace messages [57] | |
| o lib: ratelimit timestamps [14] | |
| o lib: update mentions of the legacy "sessionhandle" [157] | |
| + | o libcurl.pc: add `License` tag [190] |
| + | o libcurl.pc: add Copyright tag to the pkgconf file |
| + | o libcurl.pc: add the Link.ABI and Source tags [210] |
| + | o mbedtls: enforce verifyhost when verifypeer is disabled [208] |
| o mbedtls: replace `memset()` with `psa_hash_operation_init()` [28] | |
| o md5: replace magic numbers with `MD5_DIGEST_LEN` [122] | |
| o mime.c: avoid integer overflow in base64 size calculation [105] | |
| @@ -96,7 +113,10 @@ This release includes the following bugfixes: | |
| o mod_curltest: fix compiler warnings [49] | |
| o mqtt: reject control bytes in the topic [43] | |
| o multi: forbid curl_easy_pause from within multi socket callback [22] | |
| + | o multi: hold timeout values in 'int' instead of 'long' [165] |
| o multi: remove #if 0'ed code that uses old struct [150] | |
| + | o multi: use index list for expire timeouts [197] |
| + | o multihandle: move two struct fields [163] |
| o ngtcp2: clean up after ngtcp2 in `curl_global_cleanup` [126] | |
| o ngtcp2: let verify failures win over expiry processing errors [98] | |
| o openldap: handle Curl_sasl_continue() returns better [45] | |
| @@ -105,6 +125,7 @@ This release includes the following bugfixes: | |
| o openssl: drop unused pre-OpenSSL3 `ctx_option_t` typedef [8] | |
| o openssl: prefer modern API flavors for `EVP_MD_CTX` new/free [47] | |
| o openssl: replace stray legacy API variant with `EVP_DigestInit_ex()` [27] | |
| + | o progress: cleanup, less memory [179] |
| o psl: update a comment to understandable English [162] | |
| o pytest: update two H3 tests for nghttp3 1.18.0+ [158] | |
| o quiche: set the max field section size [100] | |
| @@ -115,6 +136,7 @@ This release includes the following bugfixes: | |
| o runtests: restore `-k` option and actively process as no-op [32] | |
| o sasl: fix zero-length response encoding [36] | |
| o schannel: fix error check logic in `get_client_cert()` file reader [144] | |
| + | o schannel: reuse the send buffer [195] |
| o schannel: shut off experimental TLS 1.3 support for Win 10 [25] | |
| o scorecard: fix `max_upload` init value in `ul_parallel()` [142] | |
| o scripts/badwords.txt: do not recommend using 'will' in rewrites [141] | |
| @@ -149,6 +171,7 @@ This release includes the following bugfixes: | |
| o tests: target Python 3.8 as the minimum Python version | |
| o tests: use simpler constructions in Python code | |
| o thrdpool: retry failed thread starts while items wait [62] | |
| + | o thrdqueue: drop name strdups from Curl_thrdq_create [181] |
| o tidy-up: `TEXT()` vs `_TEXT()` vs `_T()` use (Windows) [102] | |
| o tidy-up: comments, messages, formatting [172] | |
| o tidy-up: drop redundant includes [110] | |
| @@ -163,13 +186,18 @@ This release includes the following bugfixes: | |
| o tool_cb_hdr: de-duplicate filename setter [24] | |
| o tool_cb_prg: avoid integer overflows [93] | |
| o tool_doswin: add stdin relay auth [130] | |
| + | o tool_operate: limit `is_using_schannel()` call to Windows [140] |
| + | o tool_operate: only check for schannel if on windows [187] |
| o tool_operate: remove call to abort() [23] | |
| o tool_xattr: add support for Windows alternate data stream [129] | |
| o typecheck-gcc: allow passing `char[]` as callback data [153] | |
| + | o uint-bset: add slot0 member [173] |
| o uint-spbset: reused empty chunks [67] | |
| o unit3214: fix to pass on systems with >=128-bit pointers [107] | |
| + | o url: fix negotiate/ntlm connection reuse [176] |
| o url: reject control codes in credentials set via CURLOPT [70] | |
| o urlapi: allow URLs to not have userauth (hostname) [92] | |
| + | o urlapi: avoid dedotdotify() if possible [182] |
| o urlapi: clear password buffer on error path [121] | |
| o urlapi: do not keep an internal port string [31] | |
| o urlapi: improved return codes [148] | |
| @@ -205,7 +233,7 @@ Planned upcoming removals include: | |
| This release would not have looked like this without help, code, reports and | |
| advice from friends like these: | |
| - | 11soda11, 1rhino2 on hackerone, AlanKingPL, Alb3e3, Alhuda Khan, |
| + | 11soda11, 1rhino2 on hackerone, AlanKingPL, Alb3e3, Alhuda Khan, anupamme, |
| Bartel Sielski, Bigtang on hackerone, Bill Mill, Bryan Henderson, | |
| Carlos Henrique Lima Melara, CatboxParadox, Christian Ullrich, | |
| Christoph Reiter, claudex on github, Collin Funk, Dan Fandrich, | |
| @@ -213,13 +241,14 @@ advice from friends like these: | |
| ed0d2b2ce19451f2 on github, Emmanuel Ugwu, Eunsoo Kim, firexinghe on github, | |
| Graham Campbell, Hendrik Hübner, HwangRock, itzTanos29, Joel Depooter, | |
| Johannes Schindelin, Keng-Yu Lin, kit-ty-kate on github, Laurent Sabourin, | |
| - | Marcel Jamin, Matthew John Cheetham, Memduh Çelik, Patrick Monnerat, |
| - | Pavel Sobolev, pszemus on github, Ramesh Adhikari, Ray Satiro, renovate[bot], |
| - | Rito Rhymes, RMMoreton on github, Roger Leigh, Ross Burton, Sameeh Jubran, |
| - | Sam James, Samuel Dainard, Sergei Zimmerman, smaeljaish on hackerone, |
| - | Stefan Eissing, Stephan Zeisberg, stze on hackerone, Viktor Szakats, |
| - | xmoezzz on github, Yoshiro Yoneya |
| - | (56 contributors) |
| + | Marcel Jamin, Martin Dukek, Matthew John Cheetham, Max Dymond, Memduh Çelik, |
| + | Patrick Monnerat, Pavel Sobolev, pszemus on github, Ralf Mueller, |
| + | Ramesh Adhikari, Ray Satiro, renovate[bot], Rito Rhymes, RMMoreton on github, |
| + | Roger Leigh, Ross Burton, Sameeh Jubran, Sam James, Samuel Dainard, |
| + | Sergei Zimmerman, smaeljaish on hackerone, Stefan Eissing, Stephan Zeisberg, |
| + | stze on hackerone, Thomas Chauchefoin, Viktor Szakats, xmoezzz on github, |
| + | Yoshiro Yoneya |
| + | (61 contributors) |
| References to bug reports and discussions on issues: | |
| @@ -321,6 +350,7 @@ References to bug reports and discussions on issues: | |
| [96] = https://curl.se/bug/?i=22323 | |
| [97] = https://curl.se/bug/?i=22318 | |
| [98] = https://curl.se/bug/?i=22317 | |
| + | [99] = https://curl.se/bug/?i=22576 |
| [100] = https://curl.se/bug/?i=22331 | |
| [101] = https://curl.se/bug/?i=22333 | |
| [102] = https://curl.se/bug/?i=22334 | |
| @@ -357,7 +387,9 @@ References to bug reports and discussions on issues: | |
| [134] = https://curl.se/bug/?i=22515 | |
| [135] = https://curl.se/bug/?i=22413 | |
| [137] = https://curl.se/bug/?i=22341 | |
| + | [138] = https://curl.se/bug/?i=22569 |
| [139] = https://curl.se/bug/?i=22500 | |
| + | [140] = https://curl.se/bug/?i=22568 |
| [141] = https://curl.se/bug/?i=22422 | |
| [142] = https://curl.se/bug/?i=22421 | |
| [143] = https://curl.se/bug/?i=22420 | |
| @@ -372,6 +404,7 @@ References to bug reports and discussions on issues: | |
| [152] = https://curl.se/bug/?i=21806 | |
| [153] = https://curl.se/bug/?i=22409 | |
| [154] = https://curl.se/bug/?i=22270 | |
| + | [155] = https://curl.se/bug/?i=22566 |
| [156] = https://curl.se/bug/?i=22401 | |
| [157] = https://curl.se/bug/?i=22463 | |
| [158] = https://curl.se/bug/?i=22397 | |
| @@ -379,11 +412,34 @@ References to bug reports and discussions on issues: | |
| [160] = https://curl.se/bug/?i=22460 | |
| [161] = https://curl.se/bug/?i=22505 | |
| [162] = https://curl.se/bug/?i=22502 | |
| + | [163] = https://curl.se/bug/?i=22565 |
| [164] = https://curl.se/bug/?i=22494 | |
| + | [165] = https://curl.se/bug/?i=22564 |
| [166] = https://curl.se/bug/?i=22448 | |
| [167] = https://curl.se/bug/?i=22449 | |
| + | [168] = https://curl.se/bug/?i=22530 |
| [169] = https://curl.se/bug/?i=22447 | |
| [170] = https://curl.se/bug/?i=22445 | |
| [171] = https://curl.se/bug/?i=22444 | |
| [172] = https://curl.se/bug/?i=22443 | |
| + | [173] = https://curl.se/bug/?i=22561 |
| [174] = https://curl.se/bug/?i=22490 | |
| + | [176] = https://curl.se/bug/?i=22528 |
| + | [179] = https://curl.se/bug/?i=22547 |
| + | [180] = https://curl.se/bug/?i=22560 |
| + | [181] = https://curl.se/bug/?i=22555 |
| + | [182] = https://curl.se/bug/?i=22557 |
| + | [187] = https://curl.se/bug/?i=22552 |
| + | [188] = https://curl.se/bug/?i=22548 |
| + | [189] = https://curl.se/bug/?i=22541 |
| + | [190] = https://curl.se/bug/?i=22545 |
| + | [191] = https://curl.se/bug/?i=22544 |
| + | [194] = https://curl.se/bug/?i=22536 |
| + | [195] = https://curl.se/bug/?i=22540 |
| + | [196] = https://curl.se/bug/?i=22524 |
| + | [197] = https://curl.se/bug/?i=22473 |
| + | [200] = https://curl.se/bug/?i=22532 |
| + | [202] = https://curl.se/bug/?i=22484 |
| + | [203] = https://curl.se/bug/?i=22514 |
| + | [208] = https://curl.se/bug/?i=22475 |
| + | [210] = https://curl.se/bug/?i=22519 |