RELEASE-NOTES: synced

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index ba6f25d390a8058e107a80ae8913698c96daabad..2c0f27e4e09c4c8a9399be3fa6f829d7278edba7 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -4,12 +4,13 @@ curl and libcurl 8.22.0
  Command line options:         274
  curl_easy_setopt() options:   308
  Public functions in libcurl:  100
- Authors:                      1494
- Contributors:                 3745
+ Authors:                      1497
+ Contributors:                 3749
 
 This release includes the following changes:
 
  o gssapi: add support for Apple GSS Framework [72]
+ o hardening: add API guards [64]
  o TLS: drop support for TLS-SRP [71]
 
 This release includes the following bugfixes:
@@ -20,6 +21,7 @@ This release includes the following bugfixes:
  o build: enable thread-safe `getaddrinfo()` for OpenBSD [35]
  o cd2nroff: stricter checks for asterisks for italics [73]
  o cf-ngtcp2-cmn: initialize new callback ptr for ngtcp2 1.24.0+ [52]
+ o cfilters: fix event-based connection shutdown [91]
  o cmake: dedupe expressions into local vars in `cmake_uninstall.in.cmake` [9]
  o cmake: fix not to build `tunits` when `BUILD_CURL_EXE=OFF` [7]
  o cmake: flatten build tree, tidy up base dir variables [12]
@@ -44,24 +46,33 @@ This release includes the following bugfixes:
  o ftp: reject control bytes in ACCT and alternative-to-user [26]
  o gopher: reject CR and LF in the selector [1]
  o hostip: only cache negative resolves for authoritative answers [16]
+ o http: avoid length underflow in Curl_compareheader [78]
+ o http: stop dropping large custom headers [69]
  o http: trim custom header name before the Authorization drop [17]
+ o idn: restore `MultiByteToWideChar()` `MB_ERR_INVALID_CHARS` flag [103]
  o INSTALL.md: add building-from-source overview section [29]
+ o INTERNALS.md: require quiche 0.20.0+ [101]
  o ldap: support insecure mode for Windows native LDAP [3]
  o lib1587: fix gcc `-Wconversion` with LibreSSL on Windows, test in CI [6]
  o lib: add "Curl_" prefix to two global functions [84]
+ o lib: add multi_wakeup_internal [86]
  o lib: fix 'ns' -> 'us' in trace messages [57]
  o lib: ratelimit timestamps [14]
  o mbedtls: replace `memset()` with `psa_hash_operation_init()` [28]
+ o mime.c: avoid integer overflow in base64 size calculation [105]
  o mime: reject CR and LF in mail part name and filename [30]
  o mod_curltest: fix compiler warnings [49]
  o mqtt: reject control bytes in the topic [43]
  o multi: forbid curl_easy_pause from within multi socket callback [22]
+ o ngtcp2: let verify failures win over expiry processing errors [98]
  o openldap: handle Curl_sasl_continue() returns better [45]
  o openssl+sectrust: fix session reuse [4]
  o openssl+sectrust: move session verified set into result check [82]
  o openssl: drop unused pre-OpenSSL3 `ctx_option_t` typedef [8]
  o openssl: prefer modern API flavors for `EVP_MD_CTX` new/free [47]
  o openssl: replace stray legacy API variant with `EVP_DigestInit_ex()` [27]
+ o quiche: set the max field section size [100]
+ o runtests: flush cached test parts when (re)loading a file [95]
  o runtests: restore `-k` option and actively process as no-op [32]
  o sasl: fix zero-length response encoding [36]
  o schannel: shut off experimental TLS 1.3 support for Win 10 [25]
@@ -69,18 +80,31 @@ This release includes the following bugfixes:
  o setopt: error for CURLOPT_SHARE when easy handle is used [68]
  o setopt: return OK earlier for the deprecated h2 dep options [77]
  o smtp: reject CR and LF in the envelope address [37]
+ o ssls: fix potential memory leak on import [96]
  o sws: allow connection-monitor to log all disconnects [2]
  o test 1560: test RFC4291 style IPv6 IPv4-mapped addresses [40]
+ o test1560: allow to build and run without LDAP support [109]
+ o test798: force IPv4 to avoid cross-runner port aliasing [97]
+ o test: adjust test_06_13 for 0100::/64 being blackholed [13]
+ o tests: fix type promotion on 32-bit arches in http test code [88]
  o tests: remove test1701 [58]
  o tests: skip test 311 for wolfSSL 5.9.2 [63]
+ o thrdpool: retry failed thread starts while items wait [62]
+ o tidy-up: `TEXT()` vs `_TEXT()` vs `_T()` use (Windows) [102]
  o tidy-up: typos, comment nits [60]
+ o timeval: make `Curl_freq` variable static (Windows) [90]
  o tool: do not flush on out-null [38]
  o tool: fix memory use in parallel mode [59]
  o tool: init progress bar on demand [39]
  o tool_cb_hdr: de-duplicate filename setter [24]
+ o tool_cb_prg: avoid integer overflows [93]
  o tool_operate: remove call to abort() [23]
+ o uint-spbset: reused empty chunks [67]
+ o unit3214: fix to pass on systems with >=128-bit pointers [107]
  o url: reject control codes in credentials set via CURLOPT [70]
+ o urlapi: allow URLs to not have userauth (hostname) [92]
  o urlapi: do not keep an internal port string [31]
+ o urlapi: preserve empty markers in relative URLs [61]
  o vquic: add Curl_ prefix to some global functions [76]
  o vssh: keyfile use cleanups [83]
  o VULN-DISCLOSURE-POLICY.md: issues that should be found by tests are LOW [5]
@@ -106,14 +130,16 @@ Planned upcoming removals include:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
-  Alhuda Khan, Bigtang on hackerone, Bryan Henderson, Christian Ullrich,
-  Christoph Reiter, Dan Fandrich, Daniel Stenberg, dependabot[bot],
+  Alb3e3, Alhuda Khan, Bigtang on hackerone, Bill Mill, Bryan Henderson,
+  Carlos Henrique Lima Melara, Christian Ullrich, Christoph Reiter,
+  Collin Funk, Dan Fandrich, Daniel Stenberg, dependabot[bot],
   ed0d2b2ce19451f2 on github, Emmanuel Ugwu, Eunsoo Kim, firexinghe on github,
   Graham Campbell, Hendrik Hübner, HwangRock, itzTanos29, Joel Depooter,
-  Laurent Sabourin, Memduh Çelik, Patrick Monnerat, Ray Satiro, renovate[bot],
-  Roger Leigh, Sam James, Samuel Dainard, smaeljaish on hackerone,
-  Stefan Eissing, stze on hackerone, Viktor Szakats
-  (29 contributors)
+  Keng-Yu Lin, Laurent Sabourin, Memduh Çelik, Patrick Monnerat,
+  pszemus on github, Ray Satiro, renovate[bot], Roger Leigh, Sam James,
+  Samuel Dainard, Sergei Zimmerman, smaeljaish on hackerone, Stefan Eissing,
+  stze on hackerone, Viktor Szakats, xmoezzz on github
+  (37 contributors)
 
 References to bug reports and discussions on issues:
 
@@ -129,6 +155,7 @@ References to bug reports and discussions on issues:
  [10] = https://curl.se/bug/?i=22191
  [11] = https://curl.se/bug/?i=22193
  [12] = https://curl.se/bug/?i=22192
+ [13] = https://curl.se/bug/?i=22344
  [14] = https://curl.se/bug/?i=22292
  [15] = https://curl.se/bug/?i=22187
  [16] = https://curl.se/bug/?i=22302
@@ -176,8 +203,13 @@ References to bug reports and discussions on issues:
  [58] = https://curl.se/bug/?i=22280
  [59] = https://curl.se/bug/?i=22277
  [60] = https://curl.se/bug/?i=22294
+ [61] = https://curl.se/bug/?i=22298
+ [62] = https://curl.se/bug/?i=22303
  [63] = https://curl.se/bug/?i=22286
+ [64] = https://curl.se/bug/?i=22237
+ [67] = https://curl.se/bug/?i=22340
  [68] = https://curl.se/bug/?i=22253
+ [69] = https://curl.se/bug/?i=22336
  [70] = https://curl.se/bug/?i=22236
  [71] = https://curl.se/bug/?i=21965
  [72] = https://curl.se/bug/?i=22052
@@ -186,8 +218,26 @@ References to bug reports and discussions on issues:
  [75] = https://curl.se/bug/?i=22255
  [76] = https://curl.se/bug/?i=22254
  [77] = https://curl.se/bug/?i=22250
+ [78] = https://curl.se/bug/?i=22338
  [79] = https://curl.se/bug/?i=22251
  [80] = https://curl.se/bug/?i=22225
  [82] = https://curl.se/bug/?i=22248
  [83] = https://curl.se/bug/?i=22243
  [84] = https://curl.se/bug/?i=22245
+ [86] = https://curl.se/bug/?i=22272
+ [88] = https://curl.se/bug/?i=22210
+ [90] = https://curl.se/bug/?i=22346
+ [91] = https://curl.se/bug/?i=22282
+ [92] = https://curl.se/bug/?i=22279
+ [93] = https://curl.se/bug/?i=22316
+ [95] = https://curl.se/bug/?i=22319
+ [96] = https://curl.se/bug/?i=22323
+ [97] = https://curl.se/bug/?i=22318
+ [98] = https://curl.se/bug/?i=22317
+ [100] = https://curl.se/bug/?i=22331
+ [101] = https://curl.se/bug/?i=22333
+ [102] = https://curl.se/bug/?i=22334
+ [103] = https://curl.se/bug/?i=22326
+ [105] = https://curl.se/bug/?i=22320
+ [107] = https://curl.se/bug/?i=22299
+ [109] = https://curl.se/bug/?i=22312