Builder curl-threaded-solaris10-sparc Build #3708

Results:

Failed runtest

SourceStamp:

Project	curl
Repository	https://github.com/curl/curl.git
Branch	master
Revision	079a11bcba5858ffab2cf6e810e9d98024458487
Got Revision	079a11bcba5858ffab2cf6e810e9d98024458487
Changes	159 changes

BuildSlave:

unstable10s

Reason:

The SingleBranchScheduler scheduler named 'schedule-curl-threaded-solaris10-sparc' triggered this build

Steps and Logfiles:

git update ( 1 mins, 38 secs )
1. stdio
Runtest './tests/testcurl.pl --nogitpull ...' failed ( 6 hrs, 27 mins, 32 secs )
1. stdio
2. resultlog
Mail result 'cat resultlog ...' ( 1 secs )
1. stdio

Build Properties:

Name	Value	Source
branch	master	Build
builddir	/export/home/buildbot-unstable10s/slave/curl-threaded-solaris10-sparc	slave
buildername	curl-threaded-solaris10-sparc	Builder
buildnumber	3708	Build
codebase		Build
got_revision	079a11bcba5858ffab2cf6e810e9d98024458487	Git
osplatform	SPARC	SetPropertyFromCommand Step
osrelease	10	SetPropertyFromCommand Step
project	curl	Build
repository	https://github.com/curl/curl.git	Build
revision	079a11bcba5858ffab2cf6e810e9d98024458487	Build
scheduler	schedule-curl-threaded-solaris10-sparc	Scheduler
slavename	unstable10s	BuildSlave
workdir	/export/home/buildbot-unstable10s/slave/curl-threaded-solaris10-sparc	slave (deprecated)

Forced Build Properties:

Name	Label	Value

Responsible Users:

11soda11
115734183+Sodastream11ohnoyoudont@users.noreply.github.com
AlanKingPL
alankingpl0ohnoyoudont@gmail.com
Alb3e3
74142887+Alb3e3ohnoyoudont@users.noreply.github.com
Alhuda Khan
al.hudz.kohnoyoudont@gmail.com
Collin Funk
collin.funk1ohnoyoudont@gmail.com
Dan Fandrich
danohnoyoudont@coneharvesters.com
Daniel Stenberg
danielohnoyoudont@haxx.se
Emmanuel Ugwu
emmanuelugwu121ohnoyoudont@gmail.com
Graham Campbell
helloohnoyoudont@gjcampbell.co.uk
Jay Satiro
raysatiroohnoyoudont@yahoo.com
Joel Depooter
joel.depooterohnoyoudont@safe.com
Keng-Yu Lin
kengyuohnoyoudont@debian.org
Matthew John Cheetham
mjcheethamohnoyoudont@outlook.com
Memduh Çelik
memduhcelik33ohnoyoudont@gmail.com
Patrick Monnerat
patrickohnoyoudont@monnerat.net
Pavel Sobolev
contactohnoyoudont@paveloom.dev
Ross Burton
ross.burtonohnoyoudont@arm.com
Sameeh Jubran
sameehohnoyoudont@wolfssl.com
Stefan Eissing
stefanohnoyoudont@eissing.org
Viktor Szakats
commitohnoyoudont@vsz.me
dependabot[bot]
49699333+dependabot[bot]ohnoyoudont@users.noreply.github.com
itzTanos29
tanushnryohnoyoudont@gmail.com
renovate[bot]
29139614+renovate[bot]ohnoyoudont@users.noreply.github.com

Timing:

Start	Wed Jul 29 11:27:56 2026
End	Thu Jul 30 01:45:38 2026
Elapsed	14 hrs, 17 mins, 42 secs

All Changes:

:

Change #273310

Category	curl
Changed by	Patrick Monnerat <patrickohnoyoudont@monnerat.net>
Changed at	Tue 30 Jun 2026 08:58:33
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	f02c53361e0a00775e3b250b3b60e3da77063ba2

Comments

sasl: fix zero-length response encoding
A sasl zero-length normal response is an empty string, unlike an initial
response. Since the encoding of a zero-length initial response is
protocol dependent, move its handling to the protocol-specific sendauth
procedure. Similarly, do not check for an '=' server message, as this
should normally never occur.

Update the erroneous tests accordingly.

Closes #22218

Changed files

lib/curl_sasl.c
lib/imap.c
lib/pop3.c
lib/smtp.c
tests/data/test838
tests/data/test884
tests/data/test943

Change #273321

Category	curl
Changed by	Memduh Çelik <memduhcelik33ohnoyoudont@gmail.com>
Changed at	Tue 30 Jun 2026 09:57:00
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	ddc76c24c539ac4632e663035c98a66ee8195cd0

Comments

tests: pin connection reuse rules for partial, host, and credentials
Add classic tests 3223-3226 and extend tests/http/test_12_reuse.py so that
connection reuse decisions are explicit:

- partial/aborted HTTP/1.1 responses must not reuse the connection
  (premature multi_done closes non-multiplexed conns)
- different target hostnames must not share a connection even when they
  resolve to the same address (url_match_destination)
- HTTP Basic credentials are per-request (PROTOPT_CREDSPERREQUEST), so
  different -u values still reuse; assert that with num_connects
- same host positive control reuses (num_connects 1 then 0)

Closes #22224

Changed files

tests/data/Makefile.am
tests/data/test3223
tests/data/test3224
tests/data/test3225
tests/data/test3226
tests/http/test_12_reuse.py

Change #273340

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 30 Jun 2026 11:36:55
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	5b10939ef77a3ab7941eefb4a1e2d03cf0d74121

Comments

mbedtls: replace `memset()` with `psa_hash_operation_init()`
To initialize hash contexts.

Ref: https://arm-software.github.io/psa-api/crypto/1.1/api/ops/hashes.html#c.psa_hash_operation_init
Follow-up to 3a305831d1a9d10b2bfd4fa3939ed41275fee7f7 #19077

Closes #22220

Changed files

lib/md5.c
lib/sha256.c

Change #273341

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 30 Jun 2026 11:36:55
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6fbb65126dde3cba931ba393240b2294ea78f725

Comments

openssl: replace stray legacy API variant with `EVP_DigestInit_ex()`
To match rest of code, use the modern variant and avoid an unnecessary
internal reset/cleanup.

Closes #22222

Changed files

lib/vtls/openssl.c

Change #273342

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 30 Jun 2026 11:36:55
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c0cae1eba4b2c08fad635b7066b9bacb7a030242

Comments

formdata: replace stray camelcase local function names
Replace with names using the style in the rest of codebase. Also move
the object to left-hand side and action to the right-hand side.

Closes #22223

Changed files

lib/formdata.c

Change #273450

Category	curl
Changed by	Emmanuel Ugwu <emmanuelugwu121ohnoyoudont@gmail.com>
Changed at	Wed 01 Jul 2026 09:37:35
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	acebf346fe401f64bb3e393058c3004fdc9d94c3

Comments

schannel: shut off experimental TLS 1.3 support for Win 10
- Change minimum Windows version for TLS 1.3 support to
  Windows Server 2022.

Prior to this change Windows Server 2022 was already used as the minimum
version in some but not all of the checks for TLS 1.3 support.

Ref: https://github.com/curl/curl/pull/21719#issuecomment-4520234306
Ref: https://github.com/curl/curl/issues/21702

Signed-off-by: Emmanuel Ugwu <emmanuelugwu121@gmail.com>

Closes https://github.com/curl/curl/pull/22231

Changed files

lib/vtls/schannel.c

Change #273481

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 01 Jul 2026 12:12:37
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	8b6b0d9ee78b57b771ed3fc81e40e5a0a943f6c5

Comments

tool_cb_hdr: de-duplicate filename setter
Closes #22232

Changed files

src/tool_cb_hdr.c

Change #273482

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 01 Jul 2026 12:12:37
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	adf843fbbd1161ca65ea7faa8d589a19a7d7e707

Comments

GHA/curl-for-win: upload snapshot Windows curl tool binary
These are generated for every PR and master pushes. Retain for 3 days.
Size is 1.8MB zipped per artifact. (Takes 1 second extra job time.)

Ref: #22162
Ref: https://github.com/curl/curl-for-win/commit/1b0e3569b393c31572a5895ed65ae6f60a8cba55?w=1

Closes #22234

Changed files

.github/workflows/curl-for-win.yml

Change #273491

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Wed 01 Jul 2026 13:40:00
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	5bf1ce64f5349e1c8ba309da04a742ec9d7d973d

Comments

curl_ws_meta.md: polish and better vocabulary
Assisted-by: Hendrik Hübner
Closes #22233

Changed files

docs/libcurl/curl_ws_meta.md

Change #273538

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 01 Jul 2026 17:18:36
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	a55dfa5e3564c16d26ea63092bddefbb28777815

Comments

GHA/windows: exclude `diffutils` for 32-bit builds
It's not longer offered by MSYS2.

Bug: https://github.com/curl/curl/pull/22239#issuecomment-4856772868
Ref: https://github.com/msys2/MINGW-packages/commit/b13c6d3af1dde801a7d2e16e6daa7e4b5a21cc36
Ref: c4e776cafa22533fe8a6113a39f6a9f624e8c467 #17103

Closes #22242

Changed files

.github/workflows/windows.yml

Change #273539

Category	curl
Changed by	dependabot[bot] <49699333+dependabot[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Wed 01 Jul 2026 17:19:14
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	0e7030f0e17f6d593e3cf6ebb44022cdd1931ff3

Comments

GHA: bump GitHub Actions
- updates `actions/cache` from 5.0.5 to 6.1.0
- updates `actions/checkout` from 6.0.2 to 7.0.0
- updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2
- updates `github/codeql-action/init` from 4.36.0 to 4.36.2
- updates `msys2/setup-msys2` from 2.31.1 to 2.32.0

Closes #22239

Changed files

.github/workflows/checkdocs.yml
.github/workflows/checksrc.yml
.github/workflows/checkurls.yml
.github/workflows/codeql.yml
.github/workflows/configure-vs-cmake.yml
.github/workflows/curl-for-win.yml
.github/workflows/distcheck.yml
.github/workflows/http3-linux.yml
.github/workflows/linux-old.yml
.github/workflows/linux.yml
.github/workflows/macos.yml
.github/workflows/non-native.yml
.github/workflows/windows.yml

Change #273541

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Wed 01 Jul 2026 18:04:30
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	2c97912d7cbe83d874eff096133a103a66a3fced

Comments

INFRASTRUCTURE.md: fix typo

Changed files

docs/INFRASTRUCTURE.md

Change #273611

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Wed 01 Jul 2026 22:41:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	fecff6e610aff725654c39f1ffb9e990869d4445

Comments

TODO: Support WebSocket text frames with command line tool
Closes #21997
Closes #22240

Changed files

docs/TODO.md

Change #273612

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Wed 01 Jul 2026 22:42:29
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	417189f360a168bca93bf5f8581cd40f2293c2f3

Comments

TODO: drop all SMB ideas
SMB is about to be removed, no point in adding new SMB things now.

Closes #22241

Changed files

docs/TODO.md

Change #273616

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Wed 01 Jul 2026 23:11:10
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	75c2c881af3201bc35d582eb4304e9b8ce3436ea

Comments

openssl+sectrust: fix session reuse
When TLS is verified via Apple SecTrust, openssl internal state is a
verification faiure (that is how it works, we use sectrust when openssl
fails to verify and natice ca store is enabled).

OpenSSL stores this verification status inside its TLS session objects.
On reuse, we see an unverified session and do not reuse it for a
verified connect attempt. While this is a performance penalty for most
connections, it *fails* on ftps:// transfers where servers expect
session reuse on DATA connections.

Fix this by remembering that TLS and a session was verified by sectrust
and allow reuse of such sessions for new connect attempts that also use
sectrust.

Closes #22235

Changed files

lib/vquic/cf-ngtcp2-cmn.c
lib/vtls/openssl.c
lib/vtls/openssl.h
lib/vtls/vtls_scache.h
lib/vtls/vtls_spack.c

Change #273622

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Wed 01 Jul 2026 23:16:12
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	3507b74dbaa32aab6b38da36da43e29d4fe4790f

Comments

RELEASE-NOTES: synced

Changed files

RELEASE-NOTES

Change #273627

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 02 Jul 2026 03:20:22
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	03f9751585112cdc3c5f0a370217f08c05782de9

Comments

GHA: update dependency wolfSSL/wolfssl to v5.9.2, apply upstream patch
Apply upstream patch to fix a regression in 5.9.2.

Refs:
https://github.com/wolfSSL/wolfssl/issues/10790
https://github.com/wolfSSL/wolfssl/pull/10793
https://github.com/wolfSSL/wolfssl/commit/7dd269fc52228cbc854b9f0ed8c3938b95d8a2c8

Ref: #22175 (local mitigation attempt)
Fixes #22160

Closes #22204

Changed files

.github/workflows/http3-linux.yml
.github/workflows/linux.yml

Change #273689

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Thu 02 Jul 2026 12:36:07
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	d3a7e571571d6d63039c5d75180f3bcfc4a632ce

Comments

lib: add "Curl_" prefix to two global functions
To make it clear what they are and according to our styleguide.

- Curl_cf_ip_happy_insert_after
- Curl_ftp_conns_match

Found with:

$ nm lib/.libs/libcurl.a | grep ' T ' | grep -vi ' curl'

Closes #22245

Changed files

lib/cf-ip-happy.c
lib/cf-ip-happy.h
lib/cf-setup.c
lib/ftp.c
lib/ftp.h
lib/url.c

Change #273690

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Thu 02 Jul 2026 12:37:20
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c7f67be0100967d041450285a30b2bec6cbfad64

Comments

vssh: keyfile use cleanups
- make the libssh backend do the same fallback for private and public key
  filename as libssh2 already did and is documented behavior. This now uses a
  common function.

- set the file names already in setup_connection if public key auth is
  requested, so that the connection reuse functions can use the
  information when checking for existing connections to reuse

- rename the oddly named struct fields 'rsa' to 'priv_key' and 'rsa_pub'
  to 'pub_key' to better reflect their purposes

Fixes #22243
Closes #22244

Changed files

lib/url.c
lib/vssh/libssh.c
lib/vssh/libssh2.c
lib/vssh/ssh.h
lib/vssh/vssh.c
lib/vssh/vssh.h

Change #273710

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Thu 02 Jul 2026 14:31:07
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6ab52f7c8951747b0379e63a440ca37cca658467

Comments

openssl+sectrust: move session verified set into result check
Pointed out by Codex Security
Closes #22248

Changed files

lib/vtls/openssl.c

Change #273728

Category	curl
Changed by	Jay Satiro <raysatiroohnoyoudont@yahoo.com>
Changed at	Thu 02 Jul 2026 17:03:11
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	0a7ec0ea4d2f1b3255fb9f7a8a81320ed8c54d76

Comments

ci: retain curl-for-win artifacts for a longer time
- Retain for 5 days because 3 days seems too short.

Follow-up to adf843fb.

Closes https://github.com/curl/curl/pull/22238

Changed files

.github/workflows/curl-for-win.yml

Change #273730

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Thu 02 Jul 2026 17:39:04
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	84ecfb3ecc793c0087ed9700bdc2a1475ab53ff9

Comments

FTP: fix TLS session reuse on the data connection
FTP servers using SSL can be configured to check TLS session reuse on
the DATA connection. They hand out a new session on every CONTROL
connect and require to see the client using exactly that one when
up-/downloading on DATA.

This means:

1. We have to configure the SSL filter on the DATA connection with
   exactly the same peers.

2. We have to remember the SSL session on the CONTROL connection -
   separately from the session cache. The SSL filter on the DATA
   connection then looks for a session at the CONTROL filter and, if
   present, uses that.

Tests:

Enable `require_ssl_reuse` in our pytest setup for vsftpd. This
reproduces the problem reported in #22225 and verifies the fix.

Skip ftp+SSL pytests for rustls, as we have no possibility to reuse
sessions in that backend.

Schannel: we do not run these tests with the backend. I expect it has
similar problems but am not able to verify.

Reported-by: Laurent Sabourin
Fixes #22225
Closes #22246

Changed files

lib/cf-setup.c
lib/vquic/cf-ngtcp2-cmn.c
lib/vtls/gtls.c
lib/vtls/gtls.h
lib/vtls/mbedtls.c
lib/vtls/openssl.c
lib/vtls/openssl.h
lib/vtls/vtls.c
lib/vtls/vtls_int.h
lib/vtls/vtls_scache.c
lib/vtls/vtls_scache.h
lib/vtls/wolfssl.c
lib/vtls/wolfssl.h
tests/http/conftest.py
tests/http/test_31_vsftpds.py
tests/http/test_32_ftps_vsftpd.py
tests/http/testenv/vsftpd.py

Change #273809

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Fri 03 Jul 2026 01:35:34
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	0fff69d514aea3879cd8dabb767c571527d6b60b

Comments

configure: link `-lcrypt32` instead of `-lm` for wolfSSL on Windows
Syncing it with CMake/FindWolfSSL.

`-lm` is not needed on Windows. As of mingw-w64 14.0.0 it's offered as
a dummy library; in such case it wasn't causing an actual issue.
`-lcryp32` is necessary when linking wolfSSL statically.

Ref: #22249

Closes #22251

Changed files

m4/curl-wolfssl.m4

Change #273810

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Fri 03 Jul 2026 01:35:34
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	2e2c45831c058f1753701dd8bf043973bab136ed

Comments

GHA/windows: fix MSYS2 UWP job name
Also:
- whitespace tidy-up.
- tried building with MSYS2 wolfSSL, but still not compatible with curl.
  Ref: https://packages.msys2.org/base/mingw-w64-wolfssl
  Ref: #22251

Follow-up to 923db3515d3f3a707fd4cad6f05f9538899536d7 #18116

Closes #22252

Changed files

.github/workflows/windows.yml

Change #273820

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Fri 03 Jul 2026 08:34:54
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	7bfdc6f44ae0b2e93d9f12597ee55dde62535eeb

Comments

setopt: return OK earlier for the deprecated h2 dep options
No need to have them checked twice.

Follow-up to bfbff7852f050232edd3e5

Closes #22250

Changed files

lib/setopt.c

Change #273831

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Fri 03 Jul 2026 09:54:15
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	2d38f44121b4cea687dbc4e16a97941065f1a794

Comments

vquic: add Curl_ prefix to some global functions
Closes #22254

Changed files

lib/vquic/cf-ngtcp2-cmn.c
lib/vquic/cf-ngtcp2-proxy.c
lib/vquic/cf-ngtcp2.c
lib/vquic/cf-quiche.c
lib/vquic/vquic.c
lib/vquic/vquic_int.h

Change #273841

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Fri 03 Jul 2026 13:10:50
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	2213e4bff09428cd7d822daa3dba0e34a8d16578

Comments

THANKS: add Gary from the curl 4.6 release notes

Changed files

docs/THANKS

Change #273886

Category	curl
Changed by	Jay Satiro <raysatiroohnoyoudont@yahoo.com>
Changed at	Fri 03 Jul 2026 17:42:19
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	3dd6a87a7feaecbb66555b11a390b31bb4513b9f

Comments

wolfssl: fix build for wolfssl without bio chain support
- Do not mix declarations and code. (ISO C90 build error)

Ref: https://github.com/curl/curl/pull/22252#issuecomment-4871171567

Closes https://github.com/curl/curl/pull/22255

Changed files

lib/vtls/wolfssl.c

Change #273888

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Fri 03 Jul 2026 17:49:03
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	09bfd2c645eb89a98d2ff777503dc79249394062

Comments

THANKS: remove duplicate, fix typo

Changed files

docs/THANKS

Change #273942

Category	curl
Changed by	Joel Depooter <joel.depooterohnoyoudont@safe.com>
Changed at	Fri 03 Jul 2026 23:43:56
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	d23fa6e4b6b960298a0a8683b9055e9ee9b9503b

Comments

CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization' instead of 'Authentication'
Closes #22256

Changed files

docs/libcurl/opts/CURLOPT_UNRESTRICTED_AUTH.md

Change #273944

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Sat 04 Jul 2026 00:32:58
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	b8ceb430be43edf009836345ec4d9e1b9b3fa108

Comments

cd2nroff: stricter checks for asterisks for italics
The nroff (man page) version of the markdown docs could get asterisks
mistreated as emphasis - seen in the CURLOPT_WRITEDATA manpage. The
regex now more stricter requires a word character to follow an italics
starting asterisk and there needs to be a word character or a closing
parenthesis before the italics ending asterisk.

Also: fix CURLINFO_CERTINFO.md which used wrong italics - it was not
rendered correctly on GitHub and with other generic markdown parsers.

Reported-by: Christian Ullrich
Fixes #22257
Closes #22260

Changed files

docs/libcurl/opts/CURLINFO_CERTINFO.md
scripts/cd2nroff

Change #273946

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sat 04 Jul 2026 01:21:57
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	d169ad68faa5ed5ba2375e7502307a6262466d88

Comments

gssapi: add support for Apple GSS Framework
Add support for the native GSS Framework on Apple targets, which is
Apple's fork of Heimdal. This option allows to drop Apple's deprecated
MIT Kerberos compatibility shim "mit-krb5/1.7-prerelease".

Source code uses different headers, other than that no source changes
are necessary.

You can enable by configuring with:
autotools: `--enable-gssapi-apple`
CMake: `-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=Apple`

These options are experimental, and may receive breaking updates till
the GSS backend selection logic settles, for Apple and also for the GNU
and MIT implementation.

Version string:
```
curl 8.21.0-DEV (aarch64-apple-darwin25.4.0) libcurl/8.21.0-DEV
  OpenSSL/3.6.2 zlib/1.2.12 AppleIDN AppleGSS OpenLDAP/2.4.28/Apple
```

Also:
- drop in-source deprecation warning suppressions when using AppleGSS.
- GHA/macos: enable Apple GSS in CI jobs.

Supported by:
iOS 5.0+, iPadOS 5.0+, Mac Catalyst 13.0+, macOS 10.14+, visionOS 1.0+

Ref: https://developer.apple.com/documentation/gss
Ref: #19109

Closes #22052

Changed files

.github/workflows/macos.yml
CMake/FindGSS.cmake
CMake/curl-config.in.cmake
CMakeLists.txt
configure.ac
docs/INSTALL-CMAKE.md
lib/curl_config-cmake.h.in
lib/curl_gssapi.c
lib/socks_gssapi.c
lib/urldata.h
lib/vauth/krb5_gssapi.c
lib/vauth/spnego_gssapi.c
lib/version.c

Change #273958

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Sat 04 Jul 2026 12:20:20
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	69ac867f98fb438c242687c36526e2a090371d3d

Comments

TLS: drop support for TLS-SRP
The options will simply do nothing.

Closes #21965

Changed files

CMakeLists.txt
configure.ac
docs/CIPHERS.md
docs/DEPRECATE.md
docs/INSTALL-CMAKE.md
docs/INSTALL.md
docs/cmdline-opts/proxy-tlsauthtype.md
docs/cmdline-opts/proxy-tlspassword.md
docs/cmdline-opts/proxy-tlsuser.md
docs/cmdline-opts/tlsauthtype.md
docs/cmdline-opts/tlspassword.md
docs/cmdline-opts/tlsuser.md
docs/cmdline-opts/version.md
docs/internals/TLS-SESSIONS.md
docs/libcurl/curl_easy_setopt.md
docs/libcurl/curl_easy_ssls_export.md
docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_PASSWORD.md
docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_TYPE.md
docs/libcurl/opts/CURLOPT_PROXY_TLSAUTH_USERNAME.md
docs/libcurl/opts/CURLOPT_TLSAUTH_PASSWORD.md
docs/libcurl/opts/CURLOPT_TLSAUTH_TYPE.md
docs/libcurl/opts/CURLOPT_TLSAUTH_USERNAME.md
docs/libcurl/symbols-in-versions
docs/tests/FILEFORMAT.md
include/curl/curl.h
lib/curl_config-cmake.h.in
lib/curl_setup.h
lib/setopt.c
lib/urldata.h
lib/version.c
lib/vtls/gtls.c
lib/vtls/gtls.h
lib/vtls/openssl.c
lib/vtls/vtls_config.c
lib/vtls/vtls_config.h
lib/vtls/vtls_scache.c
m4/curl-gnutls.m4
m4/curl-openssl.m4
scripts/spacecheck.pl
src/config2setopts.c
src/tool_cfgable.c
src/tool_cfgable.h
src/tool_getparam.c
src/tool_libinfo.c
src/tool_libinfo.h
tests/certs/Makefile.am
tests/certs/Makefile.inc
tests/certs/srp-verifier-conf
tests/certs/srp-verifier-db
tests/data/DISABLED
tests/data/Makefile.am
tests/data/data320.html
tests/data/test320
tests/data/test321
tests/data/test322
tests/data/test323
tests/data/test324
tests/runtests.pl
tests/serverhelp.pm
tests/servers.pm
tests/test1165.pl
tests/test1177.pl
tests/unit/unit3304.c

Change #273960

Category	curl
Changed by	Alhuda Khan <al.hudz.kohnoyoudont@gmail.com>
Changed at	Sat 04 Jul 2026 12:28:29
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	ecaa344a7a17874ff0c6e5717489e8f9033c4d5c

Comments

url: reject control codes in credentials set via CURLOPT
Closes #22236

Changed files

lib/url.c
tests/data/Makefile.am
tests/data/test2114

Change #274016

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Sat 04 Jul 2026 22:53:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e0222c00293573e83d85fb5dfc43d67b4b837dda

Comments

test2114: fix reading from stdin
The test provides an invalid username, but no ':' with password, so that
the curl tool tries to read the password from stdin. That makes the test
hang, also in CI.

The check for invalid characters is happening when the CURLOPT_USERPWD
is applied to the URL, so when the transfer is started. Maybe the check
should happen also in setopt already.

The test hangs because tool_paramhlp.c:548 `checkpasswd()` does not see
a ':' and tries to read the password from stdin.

Fix: add a ':' in the tests invalid user setting, so that the read does
not happen.

Follow-up to ecaa344a7a17874ff0c6e5

Closes #22264

Changed files

tests/data/test2114

Change #274017

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Sat 04 Jul 2026 22:53:52
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	791f5b25d32fa4598a629d25b03a152faefc0f75

Comments

setopt: error for CURLOPT_SHARE when easy handle is used
Changing the share while driving would be complicated and error-prone.

URL: https://curl.se/mail/lib-2026-07/0000.html

Closes #22253

Changed files

lib/setopt.c

Change #274178

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Mon 06 Jul 2026 13:29:49
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6841d59af67345493c0a692a6200bc4d8a82c5fd

Comments

GHA: update dependency pizlonator/fil-c to v0.681
Note: Renovate strips pre-existing quotes from the YAML version value.
This breaks the bump next time its version is ending with zero(s).
Ref: 78267398e5a2ce347a6729926c68272b2b6fbed5 #22143 #22142

Closes #22267

Changed files

.github/workflows/linux.yml

Change #274391

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Thu 09 Jul 2026 14:01:15
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6e5f94cd5dad9764641d1718b36e79907c68caf4

Comments

GHA: update dependency Mbed-TLS/mbedtls to v4.2.0
Ref: #21178
Closes #22271

Changed files

.github/workflows/linux.yml

Change #274398

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Thu 09 Jul 2026 18:21:51
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	7183bec8fe7b4efcae3b0354dc5bf6de54384190

Comments

GHA/macos: ignore test 311 results for Homebrew wolfSSL
Homebrew is distributing v5.9.2 at the time of this commit, which
contains known regression failing to parse the server certificate.
The fix has been merged upstream. Till it makes it into a release
and Homebrew, ignore test results for 311.

Refs:
https://github.com/wolfSSL/wolfssl/pull/10793
https://github.com/wolfSSL/wolfssl/commit/7dd269fc52228cbc854b9f0ed8c3938b95d8a2c8

Follow-up to 03f9751585112cdc3c5f0a370217f08c05782de9 #22204 #22175 #22160
Closes #22269

Changed files

.github/workflows/macos.yml

Change #274399

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 09 Jul 2026 18:21:51
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	06a42cd8bbf237626b6e0c67f592e380cd359e86

Comments

GHA/linux: bump 3.x mbedTLS to 3.6.7
Follow-up to 6e5f94cd5dad9764641d1718b36e79907c68caf4 #22271

Closes #22285

Changed files

.github/workflows/linux.yml

Change #274419

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 09 Jul 2026 21:09:34
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	50c244c74d775979e2771d128fd90affe7193b49

Comments

tests: skip test 311 for wolfSSL 5.9.2
To fix this for everyone running curl tests.

Also: drop workarounds for CI.

Refs:
https://github.com/wolfSSL/wolfssl/pull/10793
https://github.com/wolfSSL/wolfssl/commit/7dd269fc52228cbc854b9f0ed8c3938b95d8a2c8

Ref: https://github.com/curl/curl/pull/22269#issuecomment-4892203666
Follow-up to 7183bec8fe7b4efcae3b0354dc5bf6de54384190 #22269
Follow-up to 03f9751585112cdc3c5f0a370217f08c05782de9 #22204

Closes #22286

Changed files

.github/workflows/http3-linux.yml
.github/workflows/linux.yml
.github/workflows/macos.yml
tests/data/test311
tests/runtests.pl

Change #274426

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 09 Jul 2026 21:28:04
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	d054f386dd77ed02f6d7513e0464e414948d93df

Comments

GHA/windows: enable wolfSSL in two MSYS2 mingw-w64 jobs
Number of tests went to 1919 (from 1912). Runs 30s faster.

Thanks-to: Christoph Reiter
Ref: https://github.com/msys2/MINGW-packages/commit/5c995ac09830ac84bcfff58e6fcf032c42f4b20f
Ref: #22252

Closes #22259

Changed files

.github/workflows/windows.yml

Change #274475

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Fri 10 Jul 2026 12:14:20
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	5c5334f831c29fc993b5689c2265655297a848b4

Comments

GHA: update dependency awslabs/aws-lc to v5.1.0
Closes #22288

Changed files

.github/workflows/http3-linux.yml
.github/workflows/linux.yml

Change #274517

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sat 11 Jul 2026 13:55:45
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	b093d884475b75d266ee2e1693c596db0416536e

Comments

tidy-up: typos, comment nits
Closes #22294

Changed files

RELEASE-NOTES
docs/INFRASTRUCTURE.md
docs/TODO.md
docs/VULN-DISCLOSURE-POLICY.md
docs/cmdline-opts/MANPAGE.md
docs/internals/CREDENTIALS.md
docs/tests/FILEFORMAT.md
lib/altsvc.c
lib/asyn-thrdd.c
lib/asyn.h
lib/cf-dns.c
lib/curl_sha512_256.c
lib/curl_trc.c
lib/curlx/inet_pton.c
lib/ftp.c
lib/hostip4.c
lib/http.c
lib/peer.h
lib/setopt.c
lib/socks.c
lib/vquic/cf-ngtcp2-cmn.c
lib/vssh/libssh.c
lib/vtls/openssl.c
projects/OS400/os400sys.c
projects/vms/config_h.com
scripts/verify-release
tests/http/test_06_eyeballs.py
tests/http/test_10_proxy.py
tests/http/test_20_websockets.py
tests/http/test_21_resolve.py
tests/http/test_60_h3_proxy.py
tests/libtest/cli_hx_download.c
tests/secureserver.pl
tests/unit/unit1658.c
tests/unit/unit2600.c

Change #274590

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Sun 12 Jul 2026 17:50:02
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	eb73af253cb37bf3caa2112fff7d02f38cfe49fb

Comments

tool: fix memory use in parallel mode
The curl tool was creating a new transfer every time it checked if
it needed to add one to reach max parallelism. This led to eventually
all configured transfers to have easy handles created.

Limit the creation again to the ones needed for max parallelism.

scorecard.py: set --out-null only for curl versions that support it

Closes #22277

Changed files

src/tool_operate.c
tests/http/testenv/curl.py
tests/http/testenv/env.py

Change #274593

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Sun 12 Jul 2026 18:03:48
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e89d5a1202f3e00918eb0ea465041dbaa78e75c7

Comments

tests: remove test1701
Test 1701 did a HTTP/2 Upgrade in a HTTP/1.1 POST request. This will no
longer be supported in the upcoming nghttp2 release for security reasons
(Upgrade requests with body a re messy, error prone and can easily lead
to connection confusion).

As no other server we have supports this, remove the test.

Reported-by: firexinghe on github
Fixes #22280
Closes #22291

Changed files

tests/data/Makefile.am
tests/data/test1701

Change #274599

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Sun 12 Jul 2026 18:06:21
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	b940cb15666560c86d4f443713a621d737a56c60

Comments

ws: pause/unpause write handling
Websocket frames need to be written individualy, so that applications
can access the frame meta data correctly. This worked until the write
function triggered a pause. Remaining frames accumulated in the "out"
writer's buffer and on unpaused were written in one chunk.

ws decode writer will now stop writing frames when the client writer
is paused. To handle the writing of buffered raw data after an unpause,
client writers have gotten a new "flush" method.

Add pytest test_20_12 with a new client to check handling of pauses
and websocket frames.

Reported-by: Hendrik Hübner
Fixes #22273
Closes #22283

Changed files

lib/content_encoding.c
lib/cw-out.c
lib/cw-pause.c
lib/cw-pause.h
lib/ftp.c
lib/headers.c
lib/http_chunks.c
lib/sendf.c
lib/sendf.h
lib/ws.c
tests/http/Makefile.am
tests/http/test_20_websockets.py
tests/http/testenv/env.py
tests/http/testenv/ws_4frames_server.py
tests/libtest/Makefile.inc
tests/libtest/cli_ws_pause.c

Change #274600

Category	curl
Changed by	itzTanos29 <tanushnryohnoyoudont@gmail.com>
Changed at	Sun 12 Jul 2026 18:07:37
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	fa246bf7f2b6096732ae9f53408363444b5865fe

Comments

CURLOPT_HEADERFUNCTION.md: document folded header unfolding
Fixes #22296
Closes #22297

Changed files

docs/libcurl/opts/CURLOPT_HEADERFUNCTION.md

Change #274601

Category	curl
Changed by	Emmanuel Ugwu <emmanuelugwu121ohnoyoudont@gmail.com>
Changed at	Sun 12 Jul 2026 18:14:58
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6bad3db3d55161fb6deafee005de0bbde6a795c4

Comments

configure: fix misleading error messages
Reported-by: Bryan Henderson
URL: https://curl.se/mail/lib-2026-07/0010.html
Closes #22300
Signed-off-by: Emmanuel Ugwu <emmanuelugwu121@gmail.com>

Changed files

configure.ac
m4/curl-openssl.m4

Change #274615

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Sun 12 Jul 2026 21:08:31
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	02214d98f7ae3e7dad099e807c1ed549ef551014

Comments

conncache: apply multi limits to transfers using a shared pool
- Determine max host and total connection limits from the transfer's own
  multi handle and test that it works for shared connections.

Prior to this change, since df67269 (precedes 8.13.0),
Curl_cpool_check_limits() took the limits from the multi handle that
owns the pool. A share-owned pool is not owned by any multi, so the
limit check always passed.

Prior to df67269 the limits came from the transfer's own multi handle.

Fixes https://github.com/curl/curl/issues/22265
Closes https://github.com/curl/curl/pull/22266

Changed files

docs/libcurl/opts/CURLSHOPT_SHARE.md
lib/conncache.c
tests/http/test_02_download.py
tests/http/test_19_shutdown.py
tests/libtest/cli_hx_download.c

Change #274656

Category	curl
Changed by	Alhuda Khan <al.hudz.kohnoyoudont@gmail.com>
Changed at	Mon 13 Jul 2026 08:29:22
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c3f9ef13f62a2f09466cbfec8676eb6fbb361313

Comments

mime: reject CR and LF in mail part name and filename
Closes #22247

Changed files

lib/mime.c
tests/data/Makefile.am
tests/data/test3227
tests/unit/Makefile.inc
tests/unit/unit3227.c

Change #274658

Category	curl
Changed by	Alhuda Khan <al.hudz.kohnoyoudont@gmail.com>
Changed at	Mon 13 Jul 2026 08:46:45
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	94947509868bab0219945567632b519416b1dfb4

Comments

ftp: reject control bytes in ACCT and alternative-to-user
A CR or LF in the CURLOPT_FTP_ACCOUNT or CURLOPT_FTP_ALTERNATIVE_TO_USER
string split the control-channel command line and smuggled a second FTP
command. Reject a byte below 0x20 in both values before the command is
built.

Closes #22301

Changed files

lib/ftp.c
tests/data/Makefile.am
tests/data/test2115
tests/data/test2116

Change #274667

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Mon 13 Jul 2026 09:36:21
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	d43d24beb1188d1bcf0cc34450b9af96889b7f9d

Comments

configure: remove double check for GnuTLS
`GNUTLS_ENABLED` was checked twice in the HTTPS-proxy support block,
making the second check redundant.

- also fix the "or upper" phrasing which is hard to understand

Pointed out by the GitHub AI thing

Closes #22307

Changed files

configure.ac
m4/curl-openssl.m4

Change #274668

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Mon 13 Jul 2026 09:37:00
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	353d05ef0c82c4e8052affb4e30b56db7349106c

Comments

configure: set ldap lib to no by default for non-finds
`ldap_lib_ok` is never actually set at the start, so a prior cached
autoconf result could lead to an incorrect value.

Pointed out by the GitHub AI

Closes #22308

Changed files

configure.ac

Change #274706

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Mon 13 Jul 2026 11:27:16
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c3ae9ef8226ac60c5e5915e44a927d4b05daebd9

Comments

hostip: only cache negative resolves for authoritative answers
Closes #22302

Changed files

docs/libcurl/libcurl-env-dbg.md
docs/libcurl/opts/CURLOPT_DNS_CACHE_TIMEOUT.md
lib/asyn-ares.c
lib/asyn-thrdd.c
lib/asyn.h
lib/doh.c
lib/doh.h
lib/fake_addrinfo.c
lib/hostip.c
tests/http/test_21_resolve.py
tests/http/testenv/dnsd.py
tests/server/dnsd.c
tests/unit/unit1650.c

Change #274712

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Mon 13 Jul 2026 11:53:00
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	34bc5b60bcc13b413116c7eb3635c202ad02f206

Comments

lib: ratelimit timestamps
Remove the timestamp passed for ratelimit checks. Let the limit
calculation obtain a timestamp when it needs it. Most transfers run
without active ratelimits and getting a fresh timestamp is unnecessary.

Closes #22292

Changed files

lib/http2.c
lib/multi.c
lib/progress.c
lib/ratelimit.c
lib/ratelimit.h
lib/sendf.c
lib/transfer.c
lib/vquic/cf-ngtcp2-proxy.c
lib/vquic/cf-ngtcp2.c
tests/http/scorecard.py

Change #274731

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 13 Jul 2026 12:27:40
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	7bbcf26edf15d20544a94ff02d566215444357ca

Comments

scripts/contri*: find 'Thanks-to' references
Also any other `<word>-to:` alternatives.

Co-authored-by: Daniel Stenberg

Closes #22293

Changed files

scripts/contributors.sh
scripts/contrithanks.sh

Change #274732

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Mon 13 Jul 2026 12:34:23
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	30d74402959bd6360e0f491c504552186652f707

Comments

RELEASE-NOTES: synced
And bump to 8.22.0 for the pending release

Changed files

RELEASE-NOTES
include/curl/curlver.h

Change #274801

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Mon 13 Jul 2026 22:04:43
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	eecc273f6d9a61100fc99898f91f517ab7d9c184

Comments

test1560: allow to build and run without LDAP support
Closes #22312

Changed files

tests/data/test1560
tests/libtest/lib1560.c

Change #274804

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Tue 14 Jul 2026 03:07:21
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	87704c45e8123b5dd82e3406536a5154f7d15b41

Comments

GHA: update dependency google/boringssl to v0.20260713.0
Closes #22311

Changed files

.github/workflows/http3-linux.yml
.github/workflows/linux.yml

Change #274807

Category	curl
Changed by	Collin Funk <collin.funk1ohnoyoudont@gmail.com>
Changed at	Tue 14 Jul 2026 03:14:49
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	dfa444f1e59c52b56fb0d16152e610e4c29c7115

Comments

unit3214: fix to pass on systems with >=128-bit pointers
E.g. on CHERI pointers are 128 bits [1]. This causes the unit3214 test
to fail, which was written with more traditional platforms in mind. Here
is the output of log/stderr3214:

```
URL: -
BAD: struct Curl_easy is 7984 bytes, allowed to be 5370: 2614 bytes too big
BAD: struct connectdata is 1408 bytes, allowed to be 1300: 108 bytes too big
BAD: struct Curl_multi is 1248 bytes, allowed to be 850: 398 bytes too big
BAD: struct curl_httppost is 224 bytes, allowed to be 112: 112 bytes too big
BAD: struct curl_slist is 32 bytes, allowed to be 16: 16 bytes too big
BAD: struct curl_khkey is 32 bytes, allowed to be 24: 8 bytes too big
BAD: struct curl_hstsentry is 48 bytes, allowed to be 40: 8 bytes too big
BAD: struct curl_mime is 144 bytes, allowed to be 96: 48 bytes too big
BAD: struct curl_mimepart is 592 bytes, allowed to be 440: 152 bytes too big
BAD: struct curl_certinfo is 32 bytes, allowed to be 16: 16 bytes too big
BAD: struct curl_tlssessioninfo is 32 bytes, allowed to be 16: 16 bytes too big
BAD: struct curl_blob is 32 bytes, allowed to be 24: 8 bytes too big
BAD: struct CURLMsg is 48 bytes, allowed to be 24: 24 bytes too big
BAD: struct curl_header is 80 bytes, allowed to be 48: 32 bytes too big
Test ended with result 14
```

Multiply the allowed size on systems with larger than 64-bit pointers.

[1] https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/20171017a-cheri-poster.pdf

Closes #22299

Changed files

tests/unit/unit3214.c

Change #274884

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Tue 14 Jul 2026 18:59:22
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6546ffeda4f1e81f68db6af721398148b5c74317

Comments

GHA: update debian:bookworm-slim Docker digest to 7b140f3
Closes #22321

Changed files

Dockerfile

Change #274944

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Wed 15 Jul 2026 10:59:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	bc440a89d47aa8f3a5d02b01985fd7f6fb7e7e0a

Comments

mime.c: avoid integer overflow in base64 size calculation
Reported-by: xmoezzz on github
Fixes #22320
Closes #22322

Changed files

lib/mime.c

Change #274983

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Wed 15 Jul 2026 17:07:22
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	cb81c5f4e2b51f77e3e913013a236a89bb74f130

Comments

GHA: update dependency codespell to v2.4.3
Closes #22332

Changed files

.github/scripts/requirements.txt

Change #274984

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 15 Jul 2026 17:14:08
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	d52c7e78a3531f975591eb1bb1250185a9fd14c2

Comments

idn: restore `MultiByteToWideChar()` `MB_ERR_INVALID_CHARS` flag
Also:
- curlx: pass this flag to the actual conversion calls, for consistency
  and robustness. (It's not stricly necessary because the initial call
  to determine size, with this flag passed, fails already on bad input.)
- schannel: unfold `MultiByteToWideChar()` line (formatting).

Ref: https://learn.microsoft.com/windows/win32/api/stringapiset/nf-stringapiset-multibytetowidechar

Follow-up to 6694a42aa0e820a6fe1e59d85ff8597b6d768d8d #19798

Closes #22326

Changed files

lib/curlx/fopen.c
lib/curlx/multibyte.c
lib/idn.c
lib/vtls/schannel.c

Change #274991

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 15 Jul 2026 21:26:04
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	5f2a70abe3f780b6a97ac7039b7862bd828302cd

Comments

tidy-up: `TEXT()` vs `_TEXT()` vs `_T()` use (Windows)
Use `_TEXT()` when interacting with CRT functions (also prefer over
synonym `_T()`), `TEXT()` for Win32 functions.

Within curl, they mean the same because CRT/Win32 Unicode mode are
always enabled in sync.

Ref: https://devblogs.microsoft.com/oldnewthing/20040212-00/?p=40643/

Closes #22334

Changed files

lib/curl_sspi.c
lib/curlx/fopen.c
lib/vtls/schannel.c
src/tool_main.c

Change #274992

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 15 Jul 2026 21:26:04
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	899e2edec95b3df01db63ad219d3c5547a3e3ae5

Comments

INTERNALS.md: require quiche 0.20.0+
For function `quiche_h3_config_set_max_field_section_size()`.

Ref: #22331
Ref: https://github.com/curl/curl/pull/22331#issuecomment-4981647189
Ref: https://github.com/cloudflare/quiche/releases/tag/0.20.0

Closes #22333

Changed files

docs/INTERNALS.md

Change #274996

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Wed 15 Jul 2026 21:52:07
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	f369c7ba437962591c8aa9d0519c7b256e7ea5bf

Comments

quiche: set the max field section size
quiche 0.29.3 started enforcing a default
`SETTINGS_MAX_FIELD_SECTION_SIZE` of 32 KiB, so larger response headers
now shut down the whole connection with `CURLE_HTTP3`. curl accepts up
to 300 KiB of response headers with every other backend and HTTP
version. Tell quiche to allow what curl itself allows. This keeps
test_01_11 passing with quiche 0.29.3 and it also advertises our real
limit to servers, which the RFC encourages.

Ref: 899e2edec95b3df01db63ad219d3c5547a3e3ae5 #22333
Ref: #22329
Ref: #22325
Ref: https://github.com/cloudflare/quiche/commit/9be0e4fa18594a5cca00120f6ae392e217e837e5
Ref: https://github.com/cloudflare/quiche/releases/tag/0.29.3

Closes #22331

Changed files

lib/vquic/cf-quiche.c

Change #275000

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Wed 15 Jul 2026 22:00:26
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	8b5f1809bd0d2c10ac71f3043d3c71a71326bfe1

Comments

GHA: update dependency cloudflare/quiche to v0.29.3
Follow-up to f369c7ba437962591c8aa9d0519c7b256e7ea5bf #22331
Follow-up to 899e2edec95b3df01db63ad219d3c5547a3e3ae5 #22333

Closes #22325

Changed files

.github/workflows/http3-linux.yml

Change #275001

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Wed 15 Jul 2026 22:04:38
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	b8c061c75187fe59dff7ab79022125daa94b5e23

Comments

ngtcp2: let verify failures win over expiry processing errors
A flaky CI failure of `test_17_05_bad_ip_addr[h3]` (GnuTLS, event-based)
had curl detect the certificate name mismatch yet exit with
`CURLE_RECV_ERROR` (56) instead of `CURLE_PEER_FAILED_VERIFICATION`
(60). `Curl_cf_ngtcp2_cmn_connect` calls `Curl_cf_ngtcp2_cmn_set_expiry`
after its `ctx->tls_vrfy_result` override and returns the error
unfiltered, so when the server's final handshake flight happens to be
processed by the ingress inside set_expiry, the verify failure surfaces
as a generic receive error.

This PR makes set_expiry prefer `ctx->tls_vrfy_result` over generic
progress errors, as the recv and send paths already do after calling it,
and also covers the `cf-ngtcp2-proxy.c` call sites that lack the
override. Completes #21712. Seen in
https://github.com/curl/curl/actions/runs/29243256619/job/86794119412.

Closes #22317

Changed files

lib/vquic/cf-ngtcp2-cmn.c

Change #275002

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Wed 15 Jul 2026 22:06:07
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	94fab2d210cc60da33da1d7ed862b28a5d970ebf

Comments

test798: force IPv4 to avoid cross-runner port aliasing
`test798` is the only test fetching `http://localhost:%HTTPPORT` without
`-4`, since it needs the hostname for its folded `domain=localhost`
cookie. curl tries `::1` first, but the test HTTP server is IPv4-only.
On the BSDs, IPv4 and IPv6 have separate ephemeral port namespaces, so
with every test server binding port 0, another parallel runner's
IPv6-bound server can hold the same numeric port. curl then connects to
the wrong runner's server, which cannot open its own `log/N/test798` and
closes without a response, giving exit 52 and an empty `server.input`.

This PR fixes this flake by adding `-4` matches what tests 389 and 392
already do. Linux is immune because wildcard IPv6 binds occupy the IPv4
port too. Seen in
https://github.com/curl/curl/actions/runs/29229170329/job/86749470571.

Closes #22318

Changed files

tests/data/test798

Change #275004

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Wed 15 Jul 2026 22:18:04
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	0dc22b690dd8dba4048d494f09a50122dd7c0dd4

Comments

ssls: fix potential memory leak on import
Memory can be leaked when importing corrupted SSL session data that
carry the same data fields repeatedly.

Fixes #22323

Closes #22324

Changed files

docs/tests/FILEFORMAT.md
lib/vtls/vtls_scache.c
lib/vtls/vtls_scache.h
lib/vtls/vtls_spack.c
tests/data/Makefile.am
tests/data/test1678
tests/libtest/Makefile.inc
tests/libtest/lib1678.c
tests/runtests.pl

Change #275013

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Thu 16 Jul 2026 01:36:36
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	d0545d223a96884cb157a90eab3313a232fb744c

Comments

runtests: flush cached test parts when (re)loading a file
Force test file reload on client connect in ftpserver.

Closes #22319

Changed files

tests/ftpserver.pl
tests/getpart.pm
tests/runner.pm

Change #275019

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Thu 16 Jul 2026 08:51:16
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	f2fda908f922836134fec313d20b24f7cc2d8937

Comments

lib1560: test CURLU_DEFAULT_PORT more
Closes #22314

Changed files

tests/data/test1560
tests/libtest/lib1560.c

Change #275020

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Thu 16 Jul 2026 08:52:16
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	4176aba5e4871a2f1c7c120dd76568f80f5d5ddc

Comments

tool_cb_prg: avoid integer overflows
Verify in test 2093

Fixes #22316
Reported-by: xmoezzz on github
Closes #22328

Changed files

src/tool_cb_prg.c
tests/data/Makefile.am
tests/data/test2093

Change #275028

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Thu 16 Jul 2026 10:02:05
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	33dc64fd0e7bfa3b05f73496718a340e125a90f9

Comments

urlapi: allow URLs to not have userauth (hostname)
Verified in test 1560

Fixes #22279
Reported-by: Bill Mill
Closes #22313

Changed files

lib/urlapi.c
tests/libtest/lib1560.c

Change #275091

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Fri 17 Jul 2026 10:00:56
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	820c014578b56b9fa4d2c472e90b5060198dd404

Comments

cfilters: fix event-based connection shutdown
- Adjust pollset during connection shutdown.

- Separate the FIRSTSOCKET and SECONDSOCKET check so that one being in
  connect or shutdown no longer adds poll events for the other.

- Fix shutdown state evaluation (as detailed below).

- Add a unit test for Curl_conn_adjust_pollset.

- Add a client for event testing.

- Test that shutdown sockets stay with the socket callback until done.

The pollset predicate now reads the connection's own shutdown state
rather than going through data->conn, and the EXPIRE_SHUTDOWN arming in
cshutdn_perform() works again: next_expire_ms started at 0 and could
never be set, so a peer that never sends a close_notify would still park
its connection forever, timeout or not.

Reported-by: pszemus@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/22282
Closes https://github.com/curl/curl/pull/22304

Changed files

lib/cfilters.c
lib/connect.c
lib/connect.h
lib/cshutdn.c
lib/transfer.c
tests/data/Makefile.am
tests/data/test2606
tests/http/test_19_shutdown.py
tests/libtest/Makefile.inc
tests/libtest/cli_ev_download.c
tests/unit/Makefile.inc
tests/unit/unit2606.c

Change #275141

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sat 18 Jul 2026 03:12:41
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	1027d07704836c8d642abbed34ab98535de47433

Comments

timeval: make `Curl_freq` variable static (Windows)
Follow-up to 64d4f5c4b660be112a02be104e7314e8bf264caa #20852

Closes #22346

Changed files

lib/curlx/timeval.c
lib/system_win32.h

Change #275146

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sat 18 Jul 2026 14:22:27
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	1128177a6f725d1f8c4cba4f7ff6532969109e7a

Comments

timeval: rename timer frequency variable
It's no longer a global variable.

Follow-up to 1027d07704836c8d642abbed34ab98535de47433 #22346

Closes #22347

Changed files

lib/curlx/timeval.c

Change #275286

Category	curl
Changed by	Keng-Yu Lin <kengyuohnoyoudont@debian.org>
Changed at	Mon 20 Jul 2026 19:13:53
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	703a999602bcddfc297a75d9991a82c5e17182e9

Comments

tests: fix type promotion on 32-bit arches in http test code
As reported in the bug:

> On a 32-bit architecture (i386):
> 1. `chunks * chunk_size` evaluates to `unsigned int` (32-bit
>    unsigned).
> 2. Due to Usual Arithmetic Conversions in C, the signed `-1` (int)
>    operand of the ternary operator is promoted to `unsigned int`,
>    yielding `4294967295` (0xFFFFFFFF).
> 3. The ternary operator returns `4294967295` as an `unsigned int`.
> 4. This unsigned value is then assigned to `r->clength` (apr_off_t,
>    64-bit signed). Since the source is unsigned, it is zero-extended,
>    resulting in `r->clength` becoming `+4294967295`.
> 5. The subsequently executed check `if(r->clength >= 0)` evaluates to
>    true.
> 6. Inside the block, `apr_ltoa(r->pool, (long)r->clength)` casts it to
>    a 32-bit signed `long` (on 32-bit platforms), which truncates it
>    back to `-1`, formatting it as "-1" and sending the
>    "Content-Length: -1" header.
>
> On a 64-bit architecture (amd64), `size_t` is 64-bit, and `-1` (32-bit
> int) is promoted to `unsigned long` (64-bit), yielding
> `18446744073709551615`. When assigned to `r->clength` (64-bit signed),
> it wraps back to `-1`, which correctly skips the Content-Length
> generation.
>
> This type promotion mismatch can be safely fixed by avoiding the
> signed/unsigned mixture in the ternary operator.

Origin: debian, https://bugs.debian.org/1140793
Bug-Debian: https://bugs.debian.org/1140793

These are standard Debian patches' trailers, I can get rid of then if you prefer.

I've tested the fix using [debusine on i386 runner](https://debusine.debian.net/debian/developers/artifact/4083252/raw/log):

> 782s tests/http/test_05_errors.py::TestErrors::test_05_04_unclean_tls_shutdown[http/1.0] PASSED [ 17%]
> 782s tests/http/test_05_errors.py::TestErrors::test_05_04_unclean_tls_shutdown[http/1.1] PASSED [ 18%]
> 782s tests/http/test_05_errors.py::TestErrors::test_05_04_unclean_tls_shutdown[h2] PASSED [ 18%]

Versus the [i386 run in Debian's infrastructure](https://debusine.debian.net/debian/developers/artifact/4084220/raw/log):

> 2690s tests/http/test_05_errors.py::TestErrors::test_05_04_unclean_tls_shutdown[http/1.0] FAILED [ 17%]
> 2690s tests/http/test_05_errors.py::TestErrors::test_05_04_unclean_tls_shutdown[http/1.1] PASSED [ 18%]
> 2690s tests/http/test_05_errors.py::TestErrors::test_05_04_unclean_tls_shutdown[h2] PASSED [ 18%]

Closes #22210

Changed files

tests/http/testenv/mod_curltest/mod_curltest.c

Change #275292

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 20 Jul 2026 19:16:08
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	bd58857201452aba99d78742990296f1a6b72c6a

Comments

vtls_scache: allocate absolute filename on heap (Windows)
To allow any full path lengths, beyond the 260 characters allowed by
`_MAX_PATH`.

Follow-up to fa0ccd9f1fbbbd77bf50b26e3ba231ea6c729474 #15774

Closes #22357

Changed files

lib/vtls/vtls_scache.c

Change #275308

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Tue 21 Jul 2026 00:01:48
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	009fd378e8f01c97ebe67a14a41a06d56430f3df

Comments

lib: add multi_wakeup_internal
For threaded resolving, added an additional socket/eventfd pair to the
multi handle for notifications from threads. The original "double use"
of the standard wakeup pair did lead to regressions for apps.

The API definition of curl_multi_poll/wait/wakeup is pretty tight
regarding what effects what and adding notifications on top of that
broke what apps perceived to be the contract.

Fixes #22272
Reported-by: Sergei Zimmerman
Closes #22274

Changed files

lib/asyn-thrdd.c
lib/multi.c
lib/multihandle.h
lib/multiif.h
tests/data/Makefile.am
tests/data/test2414
tests/libtest/Makefile.inc
tests/libtest/lib2414.c

Change #275309

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Tue 21 Jul 2026 00:03:59
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	f65253056a1b3d0bc6b27f450a6291ed253f6491

Comments

cf-quiche.c: minor tidy-ups
Pointed out by the GitHub AI thing

Closes #22360

Changed files

lib/vquic/cf-quiche.c

Change #275312

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Tue 21 Jul 2026 00:07:03
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	b41c28e70af47e1a49606db9c28f622f2a0052d0

Comments

lib: client writer tweaks
- keep pause state at request
- keep presense of content decoding writers at request
- only add cw-pause writer when content decoding happens
- define macro for passing data down the writer chain

scorecard: add option to test with h2o server

Closes #22335

Changed files

lib/cw-out.c
lib/cw-out.h
lib/cw-pause.c
lib/request.h
lib/sendf.c
lib/sendf.h
tests/http/scorecard.py
tests/http/testenv/__init__.py

Change #275313

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Tue 21 Jul 2026 00:14:07
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	f0f84d1251f84ee1d421c2faf419a64a76d28f6c

Comments

http: avoid length underflow in Curl_compareheader
Closes #22338

Changed files

lib/http.c
tests/data/test1625
tests/unit/unit1625.c

Change #275316

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Tue 21 Jul 2026 00:37:46
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	5bb7d7a4f27ca16eb12a02cdd43f40493a51272b

Comments

http: stop dropping large custom headers
Closes #22336

Changed files

lib/http.c
tests/data/Makefile.am
tests/data/test3228
tests/data/test3229
tests/unit/unit1625.c

Change #275317

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Tue 21 Jul 2026 00:38:26
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c5fd5eb55a58f0f370c69d56fd0dabfe76035474

Comments

uint-spbset: reused empty chunks
Fix chunk allocations by reusing existing empty chunks when a new offset
is needed. Before this fix, spbsets would only ever grow with added
numbers outside the range of existing chunks.

Closes #22340

Changed files

lib/uint-spbset.c

Change #275389

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Tue 21 Jul 2026 23:18:53
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	7ad33fe56f25424fb51a10405b849de81ff74b98

Comments

cf-dns: resolve on filter demand
Use separate dns cache entries for addresses (A+AAAA) and HTTPS-RR
results. That makes also "negative" results independent of each other.
Dns cache entries, once in use, can no longer be modified safely, as
concurrent use would require each access then to be done under lock. By
using separate entries, we can update a HTTPS entry without needing to
duplicate an existing address entry for the same host+port.

Connection filters can now ask for DNS resolves. This works at any time
during connection setup and while connect is going on.
`Curl_conn_dns_add_addr_resolve()` and
`Curl_conn_dns_add_https_resolve()` are used for that. They check if the
resolve is already ongoing, can be added to a resolve not started yet
or, as last resort, create a new filter instance and add it to the
connection (it's easier to add more filters than making the same filter
handle multiple resolves. Since DNS filters are removed once the
connection is established, there is no later penalty).

HTTPS-RR queries are added by the `HTTPS-CONNECT`, `SSL` and `QUIC`
filters. The latter will only do that when ECH is configured and
supported. That means we trigger HTTPS-RR queries only when the results
matter.

Add test_22_06 for ALPN influenced via HTTPS-RR when tunneling through a
proxy. This did not work before.

Adjust test2100 to use https: as the previous http: URL no longer
triggers HTTPS-RR resolves.

Closes #22216

Changed files

lib/asyn-ares.c
lib/asyn-base.c
lib/asyn-thrdd.c
lib/asyn.h
lib/cf-dns.c
lib/cf-dns.h
lib/cf-https-connect.c
lib/cf-https-connect.h
lib/cf-ip-happy.c
lib/cf-setup.c
lib/cfilters.c
lib/cfilters.h
lib/connect.c
lib/dnscache.c
lib/dnscache.h
lib/doh.c
lib/hostip.c
lib/hostip.h
lib/httpsrr.c
lib/httpsrr.h
lib/multi.c
lib/socks.c
lib/vquic/vquic.c
lib/vquic/vquic.h
lib/vtls/vtls.c
tests/data/test2100
tests/data/test716
tests/http/test_06_eyeballs.py
tests/http/test_22_httpsrr.py
tests/unit/unit1607.c
tests/unit/unit1658.c

Change #275390

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Tue 21 Jul 2026 23:20:35
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	ab8d771d31f015327b555981992ade034603acf0

Comments

lib: reader/writer fixes
- clear writer paused bit when destroying writer stack
- remove the reader paused bit that turned out not to be a good idea

follow-up to b41c28e70af47e1

Closes #22361

Changed files

lib/request.h
lib/sendf.c

Change #275391

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Tue 21 Jul 2026 23:22:24
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	dfc01ea2a3e01f04a310456af2132e2fc001f933

Comments

hardening: add API guards
Add call stacks to easy and multi instances. Record ongoing API calls
and callback invocations there to detect recursion and not allowed
invocations.

Define enums for easy, multi and callbacks in `api.h`. In `api.c` define
properties for these functions:

- can they recurse
- is the easy/multi handle destroyed during the call or should it be
  good afterwards
- is the call allowed when a multi event callback is ongoing
- is the call allowed when a notification callback is ongoing

Entering a guard
- checks that passed CURL*/CURLM* are GOOD on entering
- checks that easy handle's `mid` is correct and it is known
  for it in the multi.
- checks that call properties are obeyed (recursion, callback checks)
- checks that passed CURL*/CURLM* are GOOD on leaving, unless call is
  known to kill it

Checks for ongoing callbacks inspect the whole call stack and catches
nested invocations (which our current flags can not).

Call stacks in easy/multi handle are fixed size and will deny recursion
when the limit is reached. The current limits are 7 for easy and 15 for
multi now.

Removes:
- multi->in_callback, check is done via call stack
- multi->in_ntfy_cb, check is done via call stack

The overhead in my tests seems minimal, if noticeable at all.

Closes #22237

Changed files

lib/Makefile.inc
lib/api.c
lib/api.h
lib/cf-socket.c
lib/curl_trc.c
lib/cw-out.c
lib/doh.c
lib/easy.c
lib/ftp.c
lib/ftplistparser.c
lib/hostip.c
lib/http2.c
lib/http_chunks.c
lib/multi.c
lib/multi_ev.c
lib/multi_ntfy.c
lib/multihandle.h
lib/multiif.h
lib/progress.c
lib/rtsp.c
lib/sendf.c
lib/setopt.c
lib/transfer.h
lib/url.c
lib/urldata.h
lib/vssh/libssh.c
lib/vssh/libssh2.c
lib/vtls/openssl.c
lib/ws.c
tests/unit/unit3214.c

Change #275393

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Tue 21 Jul 2026 23:35:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	4dc236a1093f407d975ee1329f5a0a97b0736eed

Comments

thrdpool: retry failed thread starts while items wait
Verified in test 3306

Closes #22303

Changed files

docs/libcurl/libcurl-env-dbg.md
lib/asyn-thrdd.c
lib/thrdpool.c
lib/thrdqueue.c
lib/thrdqueue.h
tests/data/Makefile.am
tests/data/test3306
tests/http/test_21_resolve.py
tests/unit/Makefile.inc
tests/unit/unit3306.c

Change #275395

Category	curl
Changed by	Alb3e3 <74142887+Alb3e3ohnoyoudont@users.noreply.github.com>
Changed at	Tue 21 Jul 2026 23:38:55
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c221469032d4f89790b9d3a8cf3cebe4d4794b1d

Comments

urlapi: preserve empty markers in relative URLs
Verified in test 1560

Closes #22298

Changed files

lib/urlapi.c
tests/libtest/lib1560.c

Change #275399

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Tue 21 Jul 2026 23:52:35
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	0c4eebb3fa9d18f04b03c2bb2a53ef670bf6e389

Comments

test: adjust test_06_13 for 0100::/64 being blackholed
Fixes #22344
Reported-by: Carlos Henrique Lima Melara
Closes #22355

Changed files

tests/http/test_06_eyeballs.py

Change #275400

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Tue 21 Jul 2026 23:55:11
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	a53bae792280e2cb947712fb3a9bd38c76db42eb

Comments

RELEASE-NOTES: synced

Changed files

RELEASE-NOTES

Change #275405

Category	curl
Changed by	11soda11 <115734183+Sodastream11ohnoyoudont@users.noreply.github.com>
Changed at	Wed 22 Jul 2026 00:45:12
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	057b25135848575d6f62eed97874a8d71e72af1d

Comments

tool_doswin: add stdin relay auth
Verify the peer with a random number in the background thread.

Closes #21467

Changed files

docs/KNOWN_BUGS.md
lib/curlx/winapi.c
lib/curlx/winapi.h
lib/rand.c
lib/rand.h
lib/vtls/schannel.c
projects/Windows/tmpl/curl.vcxproj
src/tool_doswin.c

Change #275457

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 22 Jul 2026 12:27:39
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6bff85be68785e8dce7131279775688af75b0339

Comments

tool_xattr: add support for Windows alternate data stream
Requires a supported filesystem, i.e. NTFS.

Example:
```console
> curl.exe https://curl.se/index.html --output test.txt --xattr --referer https://curl.se/
> cat < test.txt:Zone.Identifier

[ZoneTransfer]
HostUrl=https://curl.se/index.html
ReferrerUrl=https://curl.se/
```

Where newlines are CLRF, `ReferrerUrl` is set when using `--referer`
option.

Also:
- test688: make it test `--referer`.
- document `user.xdg.referrer.url` in `--xattr` man page.

Refs:
https://en.wikipedia.org/wiki/Mark_of_the_Web
https://en.wikipedia.org/wiki/NTFS#Alternate_data_stream_(ADS)
https://learn.microsoft.com/en-us/windows/win32/fileio/file-streams
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3

Ref: #22345

Closes #22354

Changed files

.github/scripts/pyspelling.words
docs/cmdline-opts/xattr.md
src/tool_operate.c
src/tool_xattr.c
src/tool_xattr.h
tests/data/test644
tests/data/test687
tests/data/test688

Change #275526

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 22 Jul 2026 21:14:52
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	41b4a911234207b7c5271f8147053769570b06e7

Comments

scripts: replace/extend `--` with `--end-of-options` in git commands
It makes these scripts require Git 2.24.0+ (2019-11-04).

Refs:
https://git-scm.com/docs/gitcli
https://nesbitt.io/2026/07/21/end-of-options.html
https://github.com/git/git/commit/19e8789b236dfe33667747d5523d6689bb59b5ef

Closes #22369

Changed files

.github/scripts/cleancmd.pl
scripts/badwords
scripts/checksrc.pl
scripts/delta
scripts/singleuse.pl
tests/test1275.pl

Change #275541

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Wed 22 Jul 2026 23:17:35
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	2c3200f5785fed310d0541d9c428d822248869ed

Comments

dnscache: avoid double unlock
Follow-up to 7ad33fe56f25424fb51a1040

Pointed out by Zeropath

Closes #22364

Changed files

lib/dnscache.c

Change #275544

Category	curl
Changed by	Pavel Sobolev <contactohnoyoudont@paveloom.dev>
Changed at	Wed 22 Jul 2026 23:41:35
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	381c3d56e332b7decb5392a84ccac0e972b4c56d

Comments

ngtcp2: clean up after ngtcp2 in `curl_global_cleanup`
Frees the memory allocated by `ngtcp2_crypto_ossl_init`, thus making
Valgrind happy. Works for versions of ngtcp2 >= 1.24.0.

Ref: https://github.com/ngtcp2/ngtcp2/issues/2207

Closes #22363

Changed files

lib/easy.c
lib/vquic/vquic.c
lib/vquic/vquic.h

Change #275604

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 23 Jul 2026 12:01:40
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	3a0c600a1e327dfcfe3b5a4730196b531f2669c4

Comments

tidy-up: fix comment indentation
Closes #22373

Changed files

docs/examples/cookie_interface.c
docs/examples/htmltitle.cpp
docs/examples/post-callback.c
docs/examples/sendrecv.c
docs/examples/simplessl.c
docs/examples/threaded.c
docs/libcurl/opts/CURLOPT_COOKIELIST.md
docs/libcurl/opts/CURLOPT_ERRORBUFFER.md
include/curl/curl.h
include/curl/curlver.h
include/curl/multi.h
lib/asyn-ares.c
lib/cookie.c
lib/cookie.h
lib/curl_config-cmake.h.in
lib/curl_fopen.c
lib/curl_ntlm_core.c
lib/curl_setup.h
lib/curlx/basename.c
lib/curlx/strparse.h
lib/fake_addrinfo.c
lib/file.c
lib/ftp.c
lib/functypes.h
lib/gopher.c
lib/hash.h
lib/http.c
lib/http.h
lib/http_aws_sigv4.c
lib/http_chunks.c
lib/http_digest.c
lib/llist.c
lib/multi.c
lib/parsedate.c
lib/progress.c
lib/protocol.h
lib/proxy.c
lib/select.c
lib/select.h
lib/setopt.c
lib/sha256.c
lib/socks.c
lib/url.c
lib/urlapi.c
lib/urldata.h
lib/vauth/digest.c
lib/vauth/ntlm.c
lib/vssh/libssh2.c
lib/vtls/apple.c
lib/vtls/openssl.c
lib/vtls/schannel.c
lib/vtls/schannel_int.h
lib/vtls/vtls.c
lib/vtls/vtls_config.c
lib/ws.c
projects/vms/curl_crtl_init.c
src/tool_cb_dbg.c
src/tool_cb_dbg.h
src/tool_cb_hdr.c
src/tool_cb_hdr.h
src/tool_cb_prg.c
src/tool_cb_prg.h
src/tool_cb_rea.c
src/tool_cb_rea.h
src/tool_cb_see.c
src/tool_cb_see.h
src/tool_cb_soc.c
src/tool_cb_soc.h
src/tool_cb_wrt.c
src/tool_cb_wrt.h
src/tool_formparse.c
src/tool_getparam.c
src/tool_helpers.c
src/tool_main.c
src/tool_paramhlp.c
src/tool_progress.c
src/tool_urlglob.c
src/tool_writeout.c
src/tool_writeout_json.c
tests/libtest/lib1156.c
tests/libtest/lib1560.c
tests/libtest/lib1978.c
tests/libtest/lib514.c
tests/libtest/lib590.c
tests/server/dnsd.c
tests/server/mqttd.c
tests/server/sockfilt.c
tests/server/socksd.c
tests/unit/unit1609.c
tests/unit/unit1667.c

Change #275609

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 23 Jul 2026 12:42:56
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	4b0cf12ab1aa7fa4fbf2f8964f49628f0c163778

Comments

vms: fix symbol typo and missing closing quotes in `config_h.com`
Closes #22375

Changed files

projects/vms/config_h.com

Change #275613

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 23 Jul 2026 12:56:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	0ada20387c31c638cfd7f6b4ae7e5cab5b318caf

Comments

tidy-up: fix Perl syntax and formatting nits
Closes #22376

Changed files

.github/scripts/cleancmd.pl
.github/scripts/randcurl.pl
.github/scripts/trimmarkdownheader.pl
.github/scripts/verify-examples.pl
docs/examples/version-check.pl
docs/libcurl/symbols.pl
scripts/extract-unit-protos
scripts/managen
scripts/mk-ca-bundle.pl
scripts/release-notes.pl
src/mkhelp.pl
tests/devtest.pl
tests/ftpserver.pl
tests/getpart.pm
tests/libtest/test610.pl
tests/libtest/test613.pl
tests/memanalyze.pl
tests/runner.pm
tests/runtests.pl
tests/secureserver.pl
tests/servers.pm
tests/sshserver.pl
tests/test1119.pl
tests/test1135.pl
tests/test1165.pl
tests/test1175.pl
tests/test1477.pl
tests/test1488.pl
tests/testcurl.pl
tests/testutil.pm

Change #275614

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 23 Jul 2026 12:56:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	932e63aab9618436e0f0a88f0abd841c18ebe12a

Comments

md5: replace magic numbers with `MD5_DIGEST_LEN`
Closes #22377

Changed files

lib/md5.c

Change #275629

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Thu 23 Jul 2026 14:19:23
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	8734b088834c74ae3d77193387dbe37ccda6d00d

Comments

tidy-up: miscellaneous
- CMake/CurlTests.c: sync indent with rest of file and most of code.
- cmake: sync term in `_CURL_PREFILL` description with rest of code.
- curl_setup.h: document function relying on `_CRT_SECURE_NO_WARNINGS`.
- tests/http/scorecard.py: typo in message.
- 'Quiche' -> 'quiche'.
- fix comment and formatting nits.

Closes #22378

Changed files

CMake/CurlTests.c
CMakeLists.txt
configure.ac
docs/EXPERIMENTAL.md
lib/curl_setup.h
lib/curlx/fopen.c
lib/vssh/libssh2.c
lib/vtls/schannel.c
tests/http/scorecard.py
tests/http/testenv/mod_curltest/mod_curltest.c

Change #275651

Category	curl
Changed by	Ross Burton <ross.burtonohnoyoudont@arm.com>
Changed at	Thu 23 Jul 2026 22:04:15
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	090056522b494feee8bb2e127a3df087b8753e56

Comments

configure: only check in the watt library if WATT_ROOT is set
Only look for gethostbyname in libwatt in $WATT_ROOT/lib if WATT_ROOT
has actually been set. This avoids configure trying to search in /lib,
which won't every succeed and can cause problems in cross builds which
check that host paths are not being searched.

Closes #22380

Changed files

configure.ac

Change #275653

Category	curl
Changed by	Alhuda Khan <al.hudz.kohnoyoudont@gmail.com>
Changed at	Thu 23 Jul 2026 22:25:06
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	489a4c1b48096db7df4875af0bedf4f7d0973382

Comments

ctype: exclude control bytes from ISPRINT and ISGRAPH
Closes #22371

Changed files

lib/curl_ctype.h
tests/unit/unit1307.c

Change #275655

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Thu 23 Jul 2026 22:26:43
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	545cdd4b504310df7d8823a3acf6764b77b4f05b

Comments

asyn-thrdd: retry link-local ipv6 if missing scope id
When the threaded resolver gets AAAA results that carry a link-local
address without scope-id, it now re-queues a query with AF_UNSPEC and
strips ipv4 addresses from that result. Whatever the resulting addresses
and scope-ids are, this becomes the result of the resolve.

Fixes #22330
Reported-by: Bartel Sielski
Closes #22368

Changed files

lib/asyn-thrdd.c
lib/asyn.h
lib/cf-dns.c
lib/thrdqueue.c
lib/thrdqueue.h
tests/http/test_21_resolve.py
tests/unit/unit3301.c
tests/unit/unit3306.c

Change #275670

Category	curl
Changed by	Graham Campbell <helloohnoyoudont@gjcampbell.co.uk>
Changed at	Fri 24 Jul 2026 10:31:09
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c8860532ddac762c0cc9f9cb2ddbf9c479f136cb

Comments

tests: fix the FTP check for unexpected RST
- In vsftpd ignore unrelated RST by matching tcpdump RSTs to the data
  connection port pair.

Prior to this change an unrelated RST on a recycled ephemeral port
could cause test failure.

Closes https://github.com/curl/curl/pull/22305

Changed files

tests/http/test_30_vsftpd.py
tests/http/test_31_vsftpds.py
tests/http/test_32_ftps_vsftpd.py
tests/http/testenv/curl.py
tests/http/testenv/vsftpd.py

Change #275713

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Fri 24 Jul 2026 16:27:41
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	a479459ea39ac0e7de37237f9f0ba9a0c9d7f470

Comments

http: fix non-tunneling proxy hostname use
Make sure hostname used in URL to proxy is IDN decoded form, but keep
the original hostname in case it was ipv6.

Fixes #22382
Reported-by: RMMoreton on github
Closes #22385

Changed files

lib/http.c

Change #275719

Category	curl
Changed by	AlanKingPL <alankingpl0ohnoyoudont@gmail.com>
Changed at	Fri 24 Jul 2026 17:46:54
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	20c7877dcb0aba0a198ea3e66b29f72cc5e8de85

Comments

terminal: Enhance terminal size detection for multiple outputs
- Get the terminal size from STDOUT or STDERR when the terminal size of
  STDIN is not available.

Closes https://github.com/curl/curl/pull/22276

Changed files

src/terminal.c

Change #275765

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Fri 24 Jul 2026 22:57:58
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	474ebb524708ecddf4fe0fdb5493e8d638bdc04d

Comments

api-guard: check lock on session cache
Add a property to easy/multi API calls that prohibit calling
the function when the involved SSL session cache is under lock
by the current thread.

Checks are only in effect when pthreads/Windows threads are
available.

Closes #22367

Changed files

lib/api.c
lib/curl_threads.c
lib/curl_threads.h
lib/vtls/vtls_scache.c
lib/vtls/vtls_scache.h

Change #275766

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Fri 24 Jul 2026 22:58:51
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	a954d87f0b41e4424f5565f74be5f2bd08d3347b

Comments

httpsrr: DoH with HTTPS, fix response handling
Fix handling of DoH response that only asks for HTTPS records.

Add test 2117 for checking that a HTTPS-RR resolve is processed,
even though the actual answer is invalid.

Closes #22372

Changed files

docs/libcurl/curl_global_trace.md
lib/curl_trc.c
lib/curl_trc.h
lib/doh.c
lib/httpsrr.c
lib/multi.c
lib/urldata.h
tests/data/Makefile.am
tests/data/test2117

Change #275767

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Fri 24 Jul 2026 22:59:46
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e093c67f1cc3fbedefc49fd2e3f9520afcfa769f

Comments

connect: connection close tweaks
- connclose/streamclose/connkeep() remove description string that was
  never used anywhere. Add trace statements where reasons for closing
  were not already traced and maybe not obvious.
- multi_remove_handle: only lookup former connection in pool when
  transfer is set to connect only
- test1554: adapt expectations now that pool is less often locked

Closes #22379

Changed files

lib/cfilters.c
lib/conncache.c
lib/conncache.h
lib/connect.c
lib/connect.h
lib/easy.c
lib/ftp.c
lib/gopher.c
lib/http.c
lib/http2.c
lib/imap.c
lib/ldap.c
lib/mqtt.c
lib/multi.c
lib/pop3.c
lib/sendf.c
lib/smb.c
lib/smtp.c
lib/tftp.c
lib/transfer.c
lib/vquic/cf-ngtcp2-proxy.c
lib/vquic/cf-ngtcp2.c
lib/vquic/cf-quiche.c
lib/vssh/libssh.c
lib/vssh/libssh2.c
tests/data/test1554

Change #275830

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sat 25 Jul 2026 11:33:55
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c4dcdb838883ad060c44a30680328451decdad1b

Comments

spacecheck: cap number of lines per file
To prevent merging large text files by accident.

Set the cap at 10k lines. The current line number top list is:
```
    5577 configure.ac
    5561 lib/vtls/openssl.c
    5077 lib/http.c
    4517 lib/ftp.c
    4284 lib/multi.c
```

Closes #22387

Changed files

scripts/spacecheck.pl

Change #275831

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sat 25 Jul 2026 11:37:12
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	ebc5212dacd3db8f5315b5a2d676415848e936d5

Comments

tidy-up: drop redundant includes
`sys/types.h` and `sys/socket.h` (non-Win32). They are included via
`curl/curl.h` and `curl_setup.h`.

This drops `HAVE_SYS_TYPES_H` guards from the codebase. It's safe
because `sys/types.h` (POSIX) is already required unconditionally by
`curl/curl.h`. It remains used in feature checks by both autotools and
cmake; to be reviewed in a future step.

Closes #22374

Changed files

lib/curl_setup.h
lib/file.c
lib/vtls/vtls.c
lib/vtls/vtls_config.c
lib/vtls/vtls_scache.c
src/tool_xattr.h
tests/unit/unit1961.c

Change #275832

Category	curl
Changed by	Sameeh Jubran <sameehohnoyoudont@wolfssl.com>
Changed at	Sat 25 Jul 2026 16:25:37
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	a55731050e8c3dbea0b96205cf916443118f6acb

Comments

httpsig: add RFC 9421 HTTP Message Signatures support
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.

New libcurl options:
 - CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
 - CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
 - CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
 - CURLOPT_HTTPSIG_HEADERS: space-separated components to sign

New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers

The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.

Verified by test 5000 to 5021

Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239

Changed files

.github/scripts/pyspelling.words
.github/workflows/linux.yml
CMakeLists.txt
configure.ac
docs/CURL-DISABLE.md
docs/EXPERIMENTAL.md
docs/cmdline-opts/.gitignore
docs/cmdline-opts/Makefile.inc
docs/cmdline-opts/httpsig-algo.md
docs/cmdline-opts/httpsig-headers.md
docs/cmdline-opts/httpsig-key.md
docs/cmdline-opts/httpsig-keyid.md
docs/libcurl/curl_easy_setopt.md
docs/libcurl/curl_version_info.md
docs/libcurl/opts/CURLOPT_HTTPAUTH.md
docs/libcurl/opts/CURLOPT_HTTPSIG_ALGORITHM.md
docs/libcurl/opts/CURLOPT_HTTPSIG_HEADERS.md
docs/libcurl/opts/CURLOPT_HTTPSIG_KEY.md
docs/libcurl/opts/CURLOPT_HTTPSIG_KEYID.md
docs/libcurl/opts/Makefile.inc
docs/libcurl/symbols-in-versions
docs/options-in-versions
include/curl/curl.h
include/curl/typecheck-gcc.h
lib/Makefile.inc
lib/curl_config-cmake.h.in
lib/curl_ed25519.c
lib/curl_ed25519.h
lib/curl_hmac.h
lib/curl_setup.h
lib/curl_sha256.h
lib/easyoptions.c
lib/http.c
lib/http_httpsig.c
lib/http_httpsig.h
lib/setopt.c
lib/urldata.h
lib/version.c
projects/OS400/README.OS400
projects/OS400/ccsidcurl.c
scripts/managen
src/config2setopts.c
src/curlinfo.c
src/tool_cfgable.c
src/tool_cfgable.h
src/tool_getparam.c
src/tool_getparam.h
src/tool_libinfo.c
src/tool_libinfo.h
src/tool_listhelp.c
tests/data/Makefile.am
tests/data/data-httpsig-ed25519.key
tests/data/data-httpsig-hmac-sha256.key
tests/data/test5000
tests/data/test5001
tests/data/test5002
tests/data/test5003
tests/data/test5004
tests/data/test5005
tests/data/test5006
tests/data/test5007
tests/data/test5008
tests/data/test5009
tests/data/test5010
tests/data/test5011
tests/data/test5012
tests/data/test5013
tests/data/test5014
tests/data/test5015
tests/data/test5016
tests/data/test5017
tests/data/test5018
tests/data/test5019
tests/data/test5020
tests/data/test5021
tests/libtest/Makefile.inc
tests/libtest/lib5000.c
tests/libtest/lib5004.c

Change #275851

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Sat 25 Jul 2026 22:10:30
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	9bcc64c39b9f4b57361d3535829743d6999d4aad

Comments

curl: make --httpsig-key take a key OR a file name for key
Verified by test 5022

Closes #22392

Changed files

docs/cmdline-opts/httpsig-key.md
src/config2setopts.c
src/tool_listhelp.c
tests/data/Makefile.am
tests/data/test5001
tests/data/test5002
tests/data/test5003
tests/data/test5005
tests/data/test5006
tests/data/test5007
tests/data/test5010
tests/data/test5011
tests/data/test5012
tests/data/test5013
tests/data/test5014
tests/data/test5015
tests/data/test5016
tests/data/test5018
tests/data/test5021
tests/data/test5022

Change #275865

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Sat 25 Jul 2026 22:59:55
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	163f0cbc8bd1b0ecd2a885594bdb4e41cebb90b3

Comments

cd2nroff: fix backslashes for 4-space indent lines
They were previously only properly escaped for ~~~ quotes. Spotted for
the CURLOPT_HTTPSIG_KEY man page.

Closes #22393

Changed files

scripts/cd2nroff

Change #275872

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Sat 25 Jul 2026 23:35:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c5d683b961d49dbfa297c61c53b58466b960e202

Comments

tool_getparam: clear the --httpsig-key argument
To hide it somewhat from process listings.

Closes #22394

Changed files

src/tool_getparam.c

Change #275986

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sun 26 Jul 2026 16:43:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	12532713d654d265bb7cb1c0c62e8a942d3a64d5

Comments

build: tidy up httpsig options
- say 'experimental'.
- cmake: add to documentation.
- cmake: alpha-sort.

Follow-up to a55731050e8c3dbea0b96205cf916443118f6acb #22386

Closes #22391

Changed files

CMakeLists.txt
configure.ac
docs/INSTALL-CMAKE.md

Change #275987

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sun 26 Jul 2026 16:43:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	b2a5369e708982d1050ccec76967e8fc42f6e2dd

Comments

runtests: allow comments in `setenv` section, merge sections in test433
Closes #22389

Changed files

tests/data/test433
tests/runner.pm

Change #275988

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sun 26 Jul 2026 16:43:18
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e416e2948b5433251e8939f65f57734bfd4d07bf

Comments

vquic: initialize new callback slot for nghttp3 v1.18.0+
Closes #22399

Changed files

lib/vquic/cf-ngtcp2-proxy.c
lib/vquic/cf-ngtcp2.c

Change #275989

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Sun 26 Jul 2026 16:43:35
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6b1ff5407ee00f8160434885cc2d4e31f7df4aee

Comments

GHA/http3-linux: update dependency ngtcp2/nghttp3 to v1.18.0
Closes #22397

Changed files

.github/workflows/http3-linux.yml

Change #276026

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Sun 26 Jul 2026 22:45:30
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	acf4498381cfd4dbaa2a2de6d868eb2f71bfb2b1

Comments

http: fix httpsig with auth-redir
Do not let unrelated credentials from a redirected URL bypass the
cross-host auth boundary

Verified by test 5023 to 5025

Follow-up to a55731050e8c3dbea0

Closes #22395

Changed files

lib/http.c
tests/data/Makefile.am
tests/data/test5023
tests/data/test5024
tests/data/test5025

Change #276027

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Sun 26 Jul 2026 22:50:50
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6f39c854c8e9df067e0acf0cccf631035d40ca7c

Comments

runtests: fix `mode="warn"` tests passing unconditionally, fix test 1752
Fix test 1712 to pass curl C by setting `COLUMNS` to the highest
accepted value, and adjust expected results. To avoid envs with varying
lengths of `LOGDIR` affect the outcome.

Apply the same fix to test 459, though it wasn't affected in curl CI.

Also sync up test 433 `COLUMNS` value with these two tests for
consistency.

Ref: #22381
Follow-up to 8e3a2a64d103a46508e17cde76595993de96ea6c #20666

Closes #22388

Changed files

tests/data/test1712
tests/data/test433
tests/data/test459
tests/runtests.pl

Change #276036

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 27 Jul 2026 01:49:40
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	16d49ac659659bb4fd0c4d7d0e6add87a5762ec6

Comments

GHA/windows: bump stunnel to 5.79
Closes #22403

Changed files

.github/workflows/windows.yml

Change #276045

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Mon 27 Jul 2026 09:40:05
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	17855dd44795afa8856facefb6d0e69026526250

Comments

RELEASE-NOTES: synced

Changed files

RELEASE-NOTES

Change #276058

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 27 Jul 2026 10:16:43
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e90c4397c8f522e8e395707f3aba0f201e41a1c7

Comments

vquic: silence `-Wmissing-field-initializers` for nghttp3/ngtcp2 callback tables
To avoid a breakage in CI and curl-for-win builds on upstream updates
extending the callback lists. Each such breakage needed patching curl,
rolling these patches into curl-for-win, and doing it in near real-time,
to keep CI and builds working (and still causing some red CI jobs).

Bring calmness here by suppressing the warnings and allowing time to
extend the callback tables as/if needed and at a convenient moment.

Closes #22400

Changed files

lib/vquic/cf-ngtcp2-cmn.c
lib/vquic/cf-ngtcp2-proxy.c
lib/vquic/cf-ngtcp2.c

Change #276059

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 27 Jul 2026 10:16:43
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	f9dc57a149a8ba38557b5d0e1f7e31ce9b93c810

Comments

pytest: update two H3 tests for nghttp3 1.18.0+
Fixing:
```
FAILED ../../tests/http/test_02_download.py::TestDownload::test_02_36_looong_urls[65536-h3] -
  AssertionError: expected exit code 0, got 56
FAILED ../../tests/http/test_14_auth.py::TestAuth::test_14_05_basic_large_pw[h3] -
  AssertionError: expected exit code 0, got 56
```
Ref: https://github.com/curl/curl/actions/runs/30207198835/job/89807247058?pr=22400

Refs:
https://github.com/ngtcp2/nghttp3/pull/539
https://github.com/ngtcp2/nghttp3/commit/a5872645446cdc07e897fea33b61a3c665563da9

Bug: https://github.com/curl/curl/pull/22397#issuecomment-5084927935

Closes #22402

Changed files

tests/http/test_02_download.py
tests/http/test_14_auth.py

Change #276060

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 27 Jul 2026 10:16:43
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	7484874fdf799398523fc57022c3fd2cc85835f3

Comments

cmake: verify if options are listed in `INSTALL-CMAKE.md`
Also:
- add one debug option to pass the test.

Ref: https://github.com/curl/curl/discussions/14885#discussioncomment-10632311

Closes #22404

Changed files

.github/workflows/checksrc.yml
docs/INSTALL-CMAKE.md
scripts/Makefile.am
scripts/cmakeopts.sh

Change #276061

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 27 Jul 2026 10:17:15
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	6350eb01ed3f4a1ad2e1c6a1d4cdcd855eac3a10

Comments

cf-ngtcp2-cmn: de-duplicate `ngtcp2_conn_client_new()` call code
Closes #22401

Changed files

lib/vquic/cf-ngtcp2-cmn.c

Change #276065

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Mon 27 Jul 2026 10:26:59
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	ed3508b1ee43534d65299b9440d5ba7906f4fcf2

Comments

GHA: update dependency ngtcp2/ngtcp2 to v1.25.0
Closes #22398

Changed files

.github/workflows/http3-linux.yml

Change #276090

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Mon 27 Jul 2026 11:36:56
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	4eb4b0d080723d328c4bf88c3be86faf02a39c5f

Comments

vquic: use ngtcp2 v1.25.0 new close2 callback
Forward only the app error code from the receiving side to the h3 layer.

This only takes effect when building against ngtcp2 v1.25.0 or higher.

Fixes #22270

Closes #22356

Changed files

lib/vquic/cf-ngtcp2-cmn.c
tests/http/test_14_auth.py

Change #276156

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Mon 27 Jul 2026 18:54:14
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c5ad90bf9a8471987ebb47a05881a51108bcf87f

Comments

typecheck-gcc: allow passing `char[]` as callback data
E.g. `TEST_DATA_STRING` in test 655.

Cherry-picked from #22406

Closes #22409

Changed files

include/curl/typecheck-gcc.h

Change #276206

Category	curl
Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
Changed at	Mon 27 Jul 2026 23:26:57
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c9ead9bd1cdc7fa03d5e9eb20ebed37e27110407

Comments

conncache: conn upkeep/alive: move and enhance
- move `Curl_conn_seems_dead()` into conncache.c
- move `Curl_conn_upkeep()` into conncache.c
- when upkeep gives an error on a connection not in use,
  terminate it

Closes #21806

Changed files

lib/cfilters.c
lib/cfilters.h
lib/conncache.c
lib/conncache.h
lib/url.c
lib/url.h

Change #276207

Category	curl
Changed by	Matthew John Cheetham <mjcheethamohnoyoudont@outlook.com>
Changed at	Mon 27 Jul 2026 23:28:52
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	a8881e5e1d2e22d4b085d45ab6c8ce1df251d602

Comments

spnego: block NTLM fallback in SPNEGO negotiation
- Switch the Windows SSPI identity struct to SEC_WINNT_AUTH_IDENTITY_EX
  to use !ntlm in PackageList to prevent NTLM from being offered.

- For GSS filter out NTLMSSP OID, and restrict via gss_set_neg_mechs()
  to prevent NTLM from being offered.

- Extend the GSS-API debug stub layer to support the NTLM blocking logic
  without a real Kerberos environment.

- Update test 2057 to check that negotiate auth is silently skipped with
  no Authorization header when only NTLM stub credentials are available.

- Add SPNEGO NTLM blocking test 2093 which verifies that Kerberos
  credentials still succeed when NTLM is blocked within SPNEGO.

- Suppress tests valgrind leak for MIT krb5 gss_display_status, since
  the leak is in the library and not in curl.

To suppress the tests valgrind leak, the wildcard '...' bridges over an
anonymous frame inside libgssapi_krb5.so that valgrind reports as '???'.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Aided-by: Johannes Schindelin

Closes https://github.com/curl/curl/pull/21315
Closes https://github.com/curl/curl/pull/22410

Changed files

CMakeLists.txt
configure.ac
docs/INSTALL-CMAKE.md
lib/curl_config-cmake.h.in
lib/curl_gssapi.c
lib/curl_gssapi.h
lib/curl_sspi.c
lib/curl_sspi.h
lib/ldap.c
lib/socks_gssapi.c
lib/vauth/digest_sspi.c
lib/vauth/krb5_gssapi.c
lib/vauth/spnego_gssapi.c
lib/vauth/spnego_sspi.c
lib/vauth/vauth.h
tests/data/Makefile.am
tests/data/test2057
tests/data/test2094
tests/valgrind.supp

Change #276244

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Tue 28 Jul 2026 09:20:28
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	27a4557c9ea87f1961741fb728387261387b398c

Comments

EXPERIMENTAL.md: We do not accept vuln reports for experimental features
Closes #22411

Changed files

docs/EXPERIMENTAL.md

Change #276275

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Tue 28 Jul 2026 13:30:26
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c7328740ecad6e5549c210366b8403eca29b4123

Comments

lib2405: adjust for non-threaded builds
- Attempt to fix the flakiness set in 9726fc8259ad7ebf1682
- Reduce macro use

Closes #22414

Changed files

tests/data/test2405
tests/data/test2407
tests/libtest/lib2405.c

Change #276277

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Tue 28 Jul 2026 13:37:28
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	573a6ec16b5822ee209d46c490f7e4200036c7dd

Comments

urlapi: improved return codes
- add CURLUE_BACKSLASH that can be returned when a backslash was used
  where a forward one probably was intended.

- make CURLUE_NO_HOST higher priority than port number errors for URLs
  without hostname. Like in "http://::1"

- shortened some URL parser error strings

Extend test 1560 to verify.

Reported-by: kit-ty-kate on github
Fixes #22337
Closes #22408

Changed files

docs/libcurl/libcurl-errors.md
docs/libcurl/symbols-in-versions
include/curl/urlapi.h
lib/strerror.c
lib/urlapi.c
projects/OS400/curl.inc.in
tests/data/test1538
tests/libtest/lib1560.c

Change #276280

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 28 Jul 2026 13:53:11
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e1450d8fdaf05f27ec75eb15df303fe931755a59

Comments

tidy-up: use more `static`, `sizeof()`, `char[]`, double-const
- make `const` data `static`, where missing and possible.
- replace `strlen()` on literal or const strings with `sizeof()`.
  While the latter is optimized by popular C compiler, e.g. MSVC only
  does it with `/O2`.
- replace magic numbers with `sizeof()`, where missing.
- introduce `CURL_CSTRLEN()` macro for `sizeof(char[]) - 1`.
- use `CURL_CSTRLEN()` macro.
- move `const` before integer types, where missing.
- replace `char *var` with `var[]`, where missing and possible.
- use double const, where missing.
  `static const char *` -> `static const char * const`.
- lib1514: constify pointers.
- unit3205: drop redundant cast, avoid another one.
- unit1666: map `OID()` macro to identical `STRCONST()`.

Closes #22406

Changed files

CMake/CurlTests.c
docs/examples/10-at-a-time.c
docs/examples/crawler.c
docs/examples/ephiperfifo.c
docs/examples/evhiperfifo.c
docs/examples/ghiper.c
docs/examples/hiperfifo.c
docs/examples/imap-append.c
docs/examples/maxconnects.c
docs/examples/postinmemory.c
docs/examples/sendrecv.c
docs/examples/sepheaders.c
docs/examples/sftpuploadresume.c
docs/examples/simplepost.c
docs/examples/simplessl.c
docs/examples/smtp-authzid.c
docs/examples/smtp-mail.c
docs/examples/smtp-mime.c
docs/examples/smtp-multi.c
docs/examples/smtp-ssl.c
docs/examples/smtp-tls.c
docs/examples/synctime.c
docs/examples/url2file.c
docs/examples/websocket-updown.c
lib/cf-h1-proxy.c
lib/cf-h2-proxy.c
lib/curl_setup.h
lib/dict.c
lib/http.c
lib/http2.c
lib/http_aws_sigv4.c
lib/http_digest.c
lib/http_negotiate.c
lib/http_ntlm.c
lib/http_proxy.c
lib/imap.c
lib/ldap.c
lib/mqtt.c
lib/progress.c
lib/smb.c
lib/tftp.c
lib/vquic/cf-quiche.c
lib/vssh/libssh2.c
lib/vtls/cipher_suite.c
lib/vtls/gtls.c
lib/vtls/keylog.h
lib/vtls/openssl.c
lib/vtls/schannel.c
lib/vtls/schannel_verify.c
lib/vtls/vtls.c
lib/vtls/wolfssl.c
scripts/schemetable.c
src/curlinfo.c
src/tool_doswin.c
src/tool_easysrc.c
src/tool_formparse.c
src/tool_getparam.c
src/tool_helpers.c
src/tool_libinfo.c
src/tool_paramhlp.c
src/tool_progress.c
src/var.c
tests/http/testenv/mod_curltest/mod_curltest.c
tests/libtest/lib1514.c
tests/libtest/lib1517.c
tests/libtest/lib1520.c
tests/libtest/lib1525.c
tests/libtest/lib1526.c
tests/libtest/lib1527.c
tests/libtest/lib1531.c
tests/libtest/lib1537.c
tests/libtest/lib1554.c
tests/libtest/lib1560.c
tests/libtest/lib1576.c
tests/libtest/lib1591.c
tests/libtest/lib1598.c
tests/libtest/lib1662.c
tests/libtest/lib1901.c
tests/libtest/lib1940.c
tests/libtest/lib1948.c
tests/libtest/lib1965.c
tests/libtest/lib3102.c
tests/libtest/lib505.c
tests/libtest/lib508.c
tests/libtest/lib536.c
tests/libtest/lib544.c
tests/libtest/lib547.c
tests/libtest/lib554.c
tests/libtest/lib555.c
tests/libtest/lib571.c
tests/libtest/lib643.c
tests/libtest/lib654.c
tests/libtest/lib655.c
tests/libtest/lib667.c
tests/libtest/lib668.c
tests/libtest/lib677.c
tests/libtest/lib757.c
tests/server/mqttd.c
tests/server/rtspd.c
tests/server/socksd.c
tests/server/sws.c
tests/tunit/tool1720.c
tests/unit/unit1303.c
tests/unit/unit1395.c
tests/unit/unit1396.c
tests/unit/unit1398.c
tests/unit/unit1625.c
tests/unit/unit1627.c
tests/unit/unit1650.c
tests/unit/unit1655.c
tests/unit/unit1664.c
tests/unit/unit1666.c
tests/unit/unit1675.c
tests/unit/unit2603.c
tests/unit/unit3200.c
tests/unit/unit3205.c
tests/unit/unit3400.c

Change #276308

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 17:52:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c39193a589164a5ef506385f352b9c904d7107f9

Comments

tests: improve exception handling in Python test code
* Explicitly set "check" in subprocess.run() to raise an exception
  automatically, where it was done manually before
* Use contextlib.suppress to ignore exceptions
* Use custom exceptions for test errors for clarity and flexibility.
* Replace IOError with OSError

This fixes ruff rules BLE001, PLW1510, S110, TRY201, TRY203, TRY002,
UP024.

Changed files

tests/dictserver.py
tests/http/scorecard.py
tests/http/test_05_errors.py
tests/http/test_11_unix.py
tests/http/testenv/caddy.py
tests/http/testenv/certs.py
tests/http/testenv/client.py
tests/http/testenv/curl.py
tests/http/testenv/env.py
tests/http/testenv/httpd.py
tests/http/testenv/ports.py
tests/http/testenv/sshd.py
tests/http/testenv/ws_echo_server.py
tests/negtelnetserver.py
tests/util.py

Change #276309

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 17:52:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	4eb691e89c3e324d10d112510bb76f352d655b64

Comments

tests: change whitespace and comments in Python test code
* remove an unneeded ruff warning disable
* remove coding: utf-8 from Python code; PEP 3120 makes UTF-8 the
  default encoding
* remove unusable shebang lines from Python code
* remove empty print strings
* disable warnings when file objects are stored; these instances can't
  be handled with context managers
* use more consistent whitespace in Python code, fixing flake8 warnings
* set the executable bit on scorecard.py, making it easier to run

These fix ruff rules EXE001, FURB105, UP009, SIM115.

Changed files

tests/dictserver.py
tests/ech_combos.py
tests/http/scorecard.py
tests/http/test_01_basic.py
tests/http/test_02_download.py
tests/http/test_03_goaway.py
tests/http/test_04_stuttered.py
tests/http/test_05_errors.py
tests/http/test_06_eyeballs.py
tests/http/test_07_upload.py
tests/http/test_08_caddy.py
tests/http/test_09_push.py
tests/http/test_10_proxy.py
tests/http/test_11_unix.py
tests/http/test_12_reuse.py
tests/http/test_13_proxy_auth.py
tests/http/test_14_auth.py
tests/http/test_15_tracing.py
tests/http/test_16_info.py
tests/http/test_17_ssl_use.py
tests/http/test_18_methods.py
tests/http/test_19_shutdown.py
tests/http/test_20_websockets.py
tests/http/test_21_resolve.py
tests/http/test_22_httpsrr.py
tests/http/test_30_vsftpd.py
tests/http/test_31_vsftpds.py
tests/http/test_32_ftps_vsftpd.py
tests/http/test_40_socks.py
tests/http/test_50_scp.py
tests/http/test_51_sftp.py
tests/http/test_60_h3_proxy.py
tests/http/testenv/__init__.py
tests/http/testenv/caddy.py
tests/http/testenv/certs.py
tests/http/testenv/client.py
tests/http/testenv/curl.py
tests/http/testenv/dante.py
tests/http/testenv/dnsd.py
tests/http/testenv/env.py
tests/http/testenv/h2o.py
tests/http/testenv/httpd.py
tests/http/testenv/nghttpx.py
tests/http/testenv/ports.py
tests/http/testenv/sshd.py
tests/http/testenv/vsftpd.py
tests/http/testenv/ws_4frames_server.py
tests/http/testenv/ws_echo_server.py
tests/negtelnetserver.py
tests/smbserver.py
tests/util.py

Change #276310

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 17:52:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	3901c16933c2ab327bf9030e0d49f1161d603fbb

Comments

tests: simplify by removing unneeded Python code
* combine separate if statements
* remove an unneeded encode() call
* remove unneeded returns
* simplify code when returning early

This fixes ruff rules SIM102, SIM114, UP012, PLR1711.

Changed files

tests/http/scorecard.py
tests/http/test_02_download.py
tests/http/test_11_unix.py
tests/http/test_17_ssl_use.py
tests/http/testenv/certs.py
tests/http/testenv/h2o.py
tests/smbserver.py
tests/util.py

Change #276311

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 17:52:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	b151a0bb901b8740c0025483c7fe375e65466dae

Comments

tests: use simpler constructions in Python code
* call super() without arguments
* mark an unused variable as such
* simplify by using dict getter for default values
* use writelines() when possible
* use dedent to simplify some text formatting
* avoid items() on dict in a loop when unnecessary
* replace most Python format() calls with f-strings
* use capture_output in subprocess.run

This fixes ruff rules FLY002, FURB122, PERF102, RUF059, SIM401, UP008,
UP022, UP030.

Changed files

tests/dictserver.py
tests/http/test_11_unix.py
tests/http/testenv/caddy.py
tests/http/testenv/certs.py
tests/http/testenv/client.py
tests/http/testenv/curl.py
tests/http/testenv/env.py
tests/http/testenv/httpd.py
tests/http/testenv/nghttpx.py
tests/negtelnetserver.py
tests/smbserver.py
tests/util.py

Change #276312

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 17:52:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e13362c20accd210de60035825f7195f9679570b

Comments

tests: address mutable class vars and naive datetime in Python code
Mark Python mutable class variables with ClassVar, to denote that the
danger this can cause has been considered.  Since any change made to
these in any object affects all other objects, this can cause locality
errors. However, as used in the test suite, they are are never modified
and so they are annotated as being intended.

Always set a timezone in datetime objects, as mixing naive and
timezone-aware object can cause errors.

These fix ruff rules DTZ005, RUF012.

Changed files

tests/http/test_17_ssl_use.py
tests/http/test_20_websockets.py
tests/http/testenv/caddy.py
tests/http/testenv/certs.py
tests/http/testenv/client.py
tests/http/testenv/curl.py
tests/http/testenv/dante.py
tests/http/testenv/dnsd.py
tests/http/testenv/h2o.py
tests/http/testenv/httpd.py
tests/http/testenv/nghttpx.py
tests/http/testenv/sshd.py
tests/http/testenv/vsftpd.py

Change #276313

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 17:52:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	3de2777421b25f8bc1dcd115143c3e1b5ae9f15a

Comments

tests: target Python 3.8 as the minimum Python version
This version is already two releases out of support, but is "only" 7
years old so is probably still being used in the real world. Document
this version along with some other testing dependencies.  Remove code
support for earlier versions. Disable ruff checks that need a newer
version.

Changed files

docs/INTERNALS.md
scripts/pythonlint.sh
tests/dictserver.py
tests/http/testenv/ports.py
tests/negtelnetserver.py

Change #276314

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 17:52:01
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	5e75aedab2214c6114f1ad52b1bce6a6cd302480

Comments

tests: bump ruff version to 0.60.0
This version enables many more warnings by default.

Closes #22396

Changed files

.github/scripts/requirements.txt

Change #276326

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 28 Jul 2026 19:20:41
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	75404bda1a4fe062fdb5c98b31c0be2e1558674e

Comments

curl_gssapi: document/update feature availability
- update `GSS_C_DELEG_POLICY_FLAG` comment to include Apple GSS, add
  date, and amend MIT Kerberos version to 1.7+ (was: 1.8+)
  Ref: https://github.com/krb5/krb5/commit/45875a4d7bbd6bb8a943572d84fef5ca2bb18291
  Ref: https://github.com/apple-oss-distributions/Heimdal/commit/1635de38a813f6e1dd3f8fd270683187ad4f02be

- document `HAVE_GSS_SET_NEG_MECHS`/`gss_set_neg_mechs()`.
  Ref: https://github.com/krb5/krb5/commit/079eed2cf749702f75ddc385cf943fbab931f9d8
  It's also committed to Heimdal, but not present in a release
  as of 7.8.0 (current latest).
  Ref: https://github.com/heimdal/heimdal/commit/735039dbdc3aa58d06afdefd214efe3f5e421244

Follow-up to a8881e5e1d2e22d4b085d45ab6c8ce1df251d602 #21315 #22410
Follow-up to d169ad68faa5ed5ba2375e7502307a6262466d88 #22052

Closes #22419

Changed files

lib/curl_gssapi.c

Change #276328

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 28 Jul 2026 19:29:34
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	1386135d1c65a3d32c2887a60e66b41afef341ec

Comments

schannel: fix error check logic in `get_client_cert()` file reader
Reported by GitHub Code Quality
Follow-up to 0fdf96512613574591f501d63fe49495ba40e1d5 #5193

Closes #22415

Changed files

lib/vtls/schannel.c

Change #276341

Category	curl
Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
Changed at	Tue 28 Jul 2026 22:20:04
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	e2fa29c402b0662ff483a0ccec6b45eab5f7f7b0

Comments

CI: improve labeler matches

Changed files

.github/labeler.yml

Change #276344

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 28 Jul 2026 22:22:50
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	387b4c5e4c3fe654187c49db743efd0be41febaf

Comments

dnsd: fix bounds check in `read_https_alpn_part()`
"The check `i > 256` permits `i == 256` to pass through. When `i` is
then cast to `uint8_t` in `blob_add(b, (uint8_t)i)`, the value wraps to
0, silently encoding a zero-length ALPN entry instead of rejecting it.
The condition should be `i > 255` (or equivalently `i >= 256`) to
correctly reject any length that does not fit in a single byte."

Reported by GitHub Code Quality

Follow-up to 86f1e5b3f6c90e453368fdf23c366c1d4a8c953b #21299

Closes #22420

Changed files

tests/server/dnsd.c

Change #276345

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Tue 28 Jul 2026 22:22:50
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	ca96fd5190c3910f633ad8fe9f66380c28cd91ad

Comments

scorecard: fix `max_upload` init value in `ul_parallel()`
"In `ul_parallel`, `max_parallel` is computed using
`self._download_parallel` instead of `self._upload_parallel`. This
causes the upload parallelism to incorrectly follow the download
parallel setting. It should use `self._upload_parallel` to be consistent
with how `uploads()` computes `max_parallel`."

Reported by GitHub Code Quality

Follow-up to 30ef79ed937ca0fc7592ff73d162398773c6a5aa #17295

Closes #22421

Changed files

tests/http/scorecard.py

Change #276351

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Tue 28 Jul 2026 22:48:20
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	cccd76f2aa02b78af0b305a3f548edafb12966e9

Comments

docs/INTERNALS.md: move a column one byte
To make the minimum gap two spaces, so that we can separate the columns
programmatically

Changed files

docs/INTERNALS.md

Change #276353

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Tue 28 Jul 2026 23:00:47
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	8186edf85dd35b27fbb2865176b6ac2e8947b49c

Comments

scripts/badwords.txt: do not recommend using 'will' in rewrites
Instead suggest "avoid contraction and rewrite to present tense"

Reported-by: claudex on github
Fixes #22422
Closes #22423

Changed files

scripts/badwords.txt

Change #276364

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 29 Jul 2026 00:19:37
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	59dc2bbe07c3b5889e0b380e5fa384d338d9d24e

Comments

tidy-up: use `CURL_CSTRLEN()` macro on more static strings
Follow-up to e1450d8fdaf05f27ec75eb15df303fe931755a59 #22406

Closes #22424

Changed files

lib/file.c
lib/mprintf.c
lib/rand.c
lib/vtls/mbedtls.c
tests/server/rtspd.c
tests/server/util.c

Change #276379

Category	curl
Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
Changed at	Wed 29 Jul 2026 09:05:04
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	14cd071484d8abdf41b72d5d862d404381e880b9

Comments

HISTORY: add when c-ares support was introduced (2004)

Changed files

docs/HISTORY.md

Change #276386

Category	curl
Changed by	renovate[bot] <29139614+renovate[bot]ohnoyoudont@users.noreply.github.com>
Changed at	Wed 29 Jul 2026 11:19:28
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c7245578c389fffe11d9bf23b5af150817d3e43d

Comments

GHA: update dependency google/boringssl to v0.20260728.0
Closes #22425

Changed files

.github/workflows/http3-linux.yml
.github/workflows/linux.yml

Change #276390

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 29 Jul 2026 11:43:05
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	c7fb986b72e14d702172a789111502e34123b305

Comments

GHA/configure-vs-cmake: dump `./configure --help`
For visual review when necessary. For the three major platforms for
symmetry and good measure.

Closes #22427

Changed files

.github/workflows/configure-vs-cmake.yml

Change #276392

Category	curl
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Wed 29 Jul 2026 11:53:19
Repository	https://github.com/curl/curl.git
Project	curl
Branch	master
Revision	079a11bcba5858ffab2cf6e810e9d98024458487

Comments

vquic: add option to use Apple fast UDP
Using Apple's secret `SYS_recvmsg_x` and `SYS_sendmsg_x` syscalls for
receiving/sending batches of UDP packets.

Since it uses undocumented calls, it's experimental and disabled by
default.

To enable:
- autotools: `--enable-apple-fast-udp`
- cmake: `-DCURL_ENABLE_APPLE_FAST_UDP=ON`

Also:
- enable in two H3 CI jobs with both build tools, pytest and clang-tidy.

Refs:
https://max-inden.de/post/fast-udp-io-in-firefox/
https://www.macsyscalls.com/en/syscall/480-recvmsg-x
https://www.macsyscalls.com/en/syscall/481-sendmsg-x

C-code-authored-by: Stefan Eissing
Build-code-authored-by: Viktor Szakats

Closes #22341
Closes #22417

Changed files

.github/workflows/macos.yml
CMakeLists.txt
configure.ac
docs/INSTALL-CMAKE.md
lib/curl_config-cmake.h.in
lib/vquic/vquic.c