RELEASE-NOTES: synced

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 2c0f27e4e09c4c8a9399be3fa6f829d7278edba7..b750535fa1d20c173732006a6294a1b17b54eeee 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -1,24 +1,27 @@
 curl and libcurl 8.22.0
 
  Public curl releases:         276
- Command line options:         274
- curl_easy_setopt() options:   308
+ Command line options:         278
+ curl_easy_setopt() options:   312
  Public functions in libcurl:  100
- Authors:                      1497
- Contributors:                 3749
+ Authors:                      1500
+ Contributors:                 3753
 
 This release includes the following changes:
 
  o gssapi: add support for Apple GSS Framework [72]
  o hardening: add API guards [64]
+ o RFC 9421 HTTP Message Signatures support [108]
  o TLS: drop support for TLS-SRP [71]
 
 This release includes the following bugfixes:
 
+ o asyn-thrdd: retry link-local ipv6 if missing scope id [118]
  o autotools: minor fixes and improvements [33]
  o build: always use local `inet_pton()`/`inet_ntop()` implementations [56]
  o build: drop superfluous `STDC_HEADERS` macro [51]
  o build: enable thread-safe `getaddrinfo()` for OpenBSD [35]
+ o cd2nroff: fix backslashes for 4-space indent lines [104]
  o cd2nroff: stricter checks for asterisks for italics [73]
  o cf-ngtcp2-cmn: initialize new callback ptr for ngtcp2 1.24.0+ [52]
  o cfilters: fix event-based connection shutdown [91]
@@ -31,24 +34,29 @@ This release includes the following bugfixes:
  o cmake: stop probing unused `float.h` for `STDC_HEADERS` [10]
  o configure: fix misleading error messages [42]
  o configure: link `-lcrypt32` instead of `-lm` for wolfSSL on Windows [79]
+ o configure: only check in the watt library if WATT_ROOT is set [120]
  o configure: remove double check for GnuTLS [21]
  o configure: set ldap lib to no by default for non-finds [18]
  o conncache: apply multi limits to transfers using a shared pool [41]
  o conncache: connection alive checks intervals [20]
+ o connect: connection close tweaks [112]
  o content_encoding: give a clear error on multi-member gzip [46]
  o CREDENTIALS.md: remove comment about empty user/pass [50]
+ o ctype: exclude control bytes from ISPRINT and ISGRAPH [119]
  o curl_ws_meta.md: polish and better vocabulary [19]
  o CURLOPT_HEADERFUNCTION.md: document folded header unfolding [53]
  o CURLOPT_SSH_*_KEYFILE: used for setting up, then no more [48]
- o CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization' instead of 'Authentication' [74]
+ o CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization', not 'Authentication' [74]
  o CURLSHOPT_(UN)SHARE.md: do not modify shares while in use [44]
  o FTP: fix TLS session reuse on the data connection [80]
  o ftp: reject control bytes in ACCT and alternative-to-user [26]
  o gopher: reject CR and LF in the selector [1]
  o hostip: only cache negative resolves for authoritative answers [16]
  o http: avoid length underflow in Curl_compareheader [78]
+ o http: fix non-tunneling proxy hostname use [116]
  o http: stop dropping large custom headers [69]
  o http: trim custom header name before the Authorization drop [17]
+ o httpsrr: DoH with HTTPS, fix response handling [113]
  o idn: restore `MultiByteToWideChar()` `MB_ERR_INVALID_CHARS` flag [103]
  o INSTALL.md: add building-from-source overview section [29]
  o INTERNALS.md: require quiche 0.20.0+ [101]
@@ -59,11 +67,13 @@ This release includes the following bugfixes:
  o lib: fix 'ns' -> 'us' in trace messages [57]
  o lib: ratelimit timestamps [14]
  o mbedtls: replace `memset()` with `psa_hash_operation_init()` [28]
+ o md5: replace magic numbers with `MD5_DIGEST_LEN` [122]
  o mime.c: avoid integer overflow in base64 size calculation [105]
  o mime: reject CR and LF in mail part name and filename [30]
  o mod_curltest: fix compiler warnings [49]
  o mqtt: reject control bytes in the topic [43]
  o multi: forbid curl_easy_pause from within multi socket callback [22]
+ o ngtcp2: clean up after ngtcp2 in `curl_global_cleanup` [126]
  o ngtcp2: let verify failures win over expiry processing errors [98]
  o openldap: handle Curl_sasl_continue() returns better [45]
  o openssl+sectrust: fix session reuse [4]
@@ -72,25 +82,33 @@ This release includes the following bugfixes:
  o openssl: prefer modern API flavors for `EVP_MD_CTX` new/free [47]
  o openssl: replace stray legacy API variant with `EVP_DigestInit_ex()` [27]
  o quiche: set the max field section size [100]
+ o runtests: allow comments in `setenv` section, merge sections in test433 [89]
+ o runtests: fix `mode="warn"` tests passing unconditionally, fix test 1752 [66]
  o runtests: flush cached test parts when (re)loading a file [95]
  o runtests: restore `-k` option and actively process as no-op [32]
  o sasl: fix zero-length response encoding [36]
  o schannel: shut off experimental TLS 1.3 support for Win 10 [25]
+ o scripts: replace/extend `--` with `--end-of-options` in git commands [128]
  o scripts: use end-of-options marker in `cd`, `mkdir`, `mv`, `sha256sum` commands [34]
  o setopt: error for CURLOPT_SHARE when easy handle is used [68]
  o setopt: return OK earlier for the deprecated h2 dep options [77]
  o smtp: reject CR and LF in the envelope address [37]
+ o spacecheck: cap number of lines per file [111]
  o ssls: fix potential memory leak on import [96]
  o sws: allow connection-monitor to log all disconnects [2]
+ o terminal: Enhance terminal size detection for multiple outputs [115]
  o test 1560: test RFC4291 style IPv6 IPv4-mapped addresses [40]
  o test1560: allow to build and run without LDAP support [109]
  o test798: force IPv4 to avoid cross-runner port aliasing [97]
  o test: adjust test_06_13 for 0100::/64 being blackholed [13]
+ o tests: fix the FTP check for unexpected RST [117]
  o tests: fix type promotion on 32-bit arches in http test code [88]
  o tests: remove test1701 [58]
  o tests: skip test 311 for wolfSSL 5.9.2 [63]
  o thrdpool: retry failed thread starts while items wait [62]
  o tidy-up: `TEXT()` vs `_TEXT()` vs `_T()` use (Windows) [102]
+ o tidy-up: drop redundant includes [110]
+ o tidy-up: fix Perl syntax and formatting nits [123]
  o tidy-up: typos, comment nits [60]
  o timeval: make `Curl_freq` variable static (Windows) [90]
  o tool: do not flush on out-null [38]
@@ -98,14 +116,18 @@ This release includes the following bugfixes:
  o tool: init progress bar on demand [39]
  o tool_cb_hdr: de-duplicate filename setter [24]
  o tool_cb_prg: avoid integer overflows [93]
+ o tool_doswin: add stdin relay auth [130]
  o tool_operate: remove call to abort() [23]
+ o tool_xattr: add support for Windows alternate data stream [129]
  o uint-spbset: reused empty chunks [67]
  o unit3214: fix to pass on systems with >=128-bit pointers [107]
  o url: reject control codes in credentials set via CURLOPT [70]
  o urlapi: allow URLs to not have userauth (hostname) [92]
  o urlapi: do not keep an internal port string [31]
  o urlapi: preserve empty markers in relative URLs [61]
+ o vms: fix symbol typo and missing closing quotes in `config_h.com` [124]
  o vquic: add Curl_ prefix to some global functions [76]
+ o vquic: initialize new callback slot for nghttp3 v1.18.0+ [87]
  o vssh: keyfile use cleanups [83]
  o VULN-DISCLOSURE-POLICY.md: issues that should be found by tests are LOW [5]
  o wolfssl: fix build for wolfssl without bio chain support [75]
@@ -130,16 +152,18 @@ Planned upcoming removals include:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
-  Alb3e3, Alhuda Khan, Bigtang on hackerone, Bill Mill, Bryan Henderson,
+  11soda11, AlanKingPL, Alb3e3, Alhuda Khan, Bartel Sielski,
+  Bigtang on hackerone, Bill Mill, Bryan Henderson,
   Carlos Henrique Lima Melara, Christian Ullrich, Christoph Reiter,
   Collin Funk, Dan Fandrich, Daniel Stenberg, dependabot[bot],
   ed0d2b2ce19451f2 on github, Emmanuel Ugwu, Eunsoo Kim, firexinghe on github,
   Graham Campbell, Hendrik Hübner, HwangRock, itzTanos29, Joel Depooter,
-  Keng-Yu Lin, Laurent Sabourin, Memduh Çelik, Patrick Monnerat,
-  pszemus on github, Ray Satiro, renovate[bot], Roger Leigh, Sam James,
-  Samuel Dainard, Sergei Zimmerman, smaeljaish on hackerone, Stefan Eissing,
-  stze on hackerone, Viktor Szakats, xmoezzz on github
-  (37 contributors)
+  Keng-Yu Lin, Laurent Sabourin, Memduh Çelik, Patrick Monnerat, Pavel Sobolev,
+  pszemus on github, Ray Satiro, renovate[bot], RMMoreton on github,
+  Roger Leigh, Ross Burton, Sameeh Jubran, Sam James, Samuel Dainard,
+  Sergei Zimmerman, smaeljaish on hackerone, Stefan Eissing, stze on hackerone,
+  Viktor Szakats, xmoezzz on github
+  (44 contributors)
 
 References to bug reports and discussions on issues:
 
@@ -207,6 +231,7 @@ References to bug reports and discussions on issues:
  [62] = https://curl.se/bug/?i=22303
  [63] = https://curl.se/bug/?i=22286
  [64] = https://curl.se/bug/?i=22237
+ [66] = https://curl.se/bug/?i=22388
  [67] = https://curl.se/bug/?i=22340
  [68] = https://curl.se/bug/?i=22253
  [69] = https://curl.se/bug/?i=22336
@@ -225,7 +250,9 @@ References to bug reports and discussions on issues:
  [83] = https://curl.se/bug/?i=22243
  [84] = https://curl.se/bug/?i=22245
  [86] = https://curl.se/bug/?i=22272
+ [87] = https://curl.se/bug/?i=22399
  [88] = https://curl.se/bug/?i=22210
+ [89] = https://curl.se/bug/?i=22389
  [90] = https://curl.se/bug/?i=22346
  [91] = https://curl.se/bug/?i=22282
  [92] = https://curl.se/bug/?i=22279
@@ -238,6 +265,25 @@ References to bug reports and discussions on issues:
  [101] = https://curl.se/bug/?i=22333
  [102] = https://curl.se/bug/?i=22334
  [103] = https://curl.se/bug/?i=22326
+ [104] = https://curl.se/bug/?i=22393
  [105] = https://curl.se/bug/?i=22320
  [107] = https://curl.se/bug/?i=22299
+ [108] = https://curl.se/bug/?i=22386
  [109] = https://curl.se/bug/?i=22312
+ [110] = https://curl.se/bug/?i=22374
+ [111] = https://curl.se/bug/?i=22387
+ [112] = https://curl.se/bug/?i=22379
+ [113] = https://curl.se/bug/?i=22372
+ [115] = https://curl.se/bug/?i=22276
+ [116] = https://curl.se/bug/?i=22382
+ [117] = https://curl.se/bug/?i=22305
+ [118] = https://curl.se/bug/?i=22330
+ [119] = https://curl.se/bug/?i=22371
+ [120] = https://curl.se/bug/?i=22380
+ [122] = https://curl.se/bug/?i=22377
+ [123] = https://curl.se/bug/?i=22376
+ [124] = https://curl.se/bug/?i=22375
+ [126] = https://curl.se/bug/?i=22363
+ [128] = https://curl.se/bug/?i=22369
+ [129] = https://curl.se/bug/?i=22354
+ [130] = https://curl.se/bug/?i=21467