# changelog

author: Paul Howarth <paul@city-fan.org> - 7.65.0-1.0.cf
changelog:
  - Update to 7.65.0
    - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
    - CURLOPT_MAXAGE_CONN: Set the maximum allowed age for conn reuse
    - pipelining: Removed
    - CVE-2019-5435: Integer overflows in curl_url_set
    - CVE-2019-5436: tftp: Use the current blksize for recvfrom()
    - --config: Clarify that initial : and = might need quoting
    - AppVeyor: Enable testing for WinSSL build
    - CURLMOPT_TIMERFUNCTION.3: Warn about the recursive risk
    - CURLOPT_ADDRESS_SCOPE: Fix range check and more
    - CURLOPT_CAINFO.3: With Schannel, you want Windows 8 or later
    - CURLOPT_CHUNK_BGN_FUNCTION.3: Document the struct and time value
    - CURLOPT_READFUNCTION.3: See also CURLOPT_UPLOAD_BUFFERSIZE
    - CURL_MAX_INPUT_LENGTH: Largest acceptable string input size
    - Curl_disconnect: Treat all CONNECT_ONLY connections as "dead"
    - INTERNALS: Add code highlighting
    - OS400/ccsidcurl: Replace use of Curl_vsetopt
    - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
    - README.md: Fix no-consecutive-blank-lines Codacy warning
    - VC15 project: Remove MinimalRebuild
    - VS projects: Use Unicode for VC10+
    - WRITEFUNCTION: Add missing set_in_callback around callback
    - altsvc: Fix building with cookies disabled
    - auth: Rename the various authentication clean up functions
    - base64: Build conditionally if there are users
    - build-openssl.bat: Fixed support for OpenSSL v1.1.0+
    - build: Fix "clarify calculation precedence" warnings
    - checksrc.bat: Ignore snprintf warnings in docs/examples
    - cirrus: Customize the disabled tests per FreeBSD version
    - cleanup: Remove FIXME and TODO comments
    - cmake: Avoid linking executable for some tests with cmake 3.6+
    - cmake: Clear CMAKE_REQUIRED_LIBRARIES after each use
    - cmake: Rename CMAKE_USE_DARWINSSL to CMAKE_USE_SECTRANSP
    - cmake: Set SSL_BACKENDS
    - configure: Avoid unportable '==' test(1) operator
    - configure: Error out if OpenSSL wasn't detected when asked for
    - configure: Fix default location for fish completions
    - cookie: Guard against possible NULL ptr deref
    - curl: Make code work with protocol-disabled libcurl
    - curl: Report error for "--no-" on non-boolean options
    - curl_easy_getinfo.3: Fix minor formatting mistake
    - curlver.h: Use parenthesis in CURL_VERSION_BITS macro
    - docs/BUG-BOUNTY: Bug bounty time
    - docs/INSTALL: Fix broken link
    - docs/RELEASE-PROCEDURE: Link to live iCalendar
    - documentation: Fix several typos
    - doh: Acknowledge CURL_DISABLE_DOH
    - doh: Disable DOH for the cases it doesn't work
    - examples: Remove unused variables
    - ftplistparser: Fix LGTM alert "Empty block without comment"
    - hostip: Acknowledge CURL_DISABLE_SHUFFLE_DNS
    - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
    - http: Acknowledge CURL_DISABLE_HTTP_AUTH
    - http: Mark bundle as not for multiuse on < HTTP/2 response
    - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
    - http_negotiate: Do not treat failure of gss_init_sec_context() as fatal
    - http_ntlm: Corrected the name of the include guard
    - http_ntlm_wb: Handle auth for only a single request
    - http_ntlm_wb: Return the correct error on receiving an empty auth message
    - lib509: Add missing include for strdup
    - lib557: Initialize variables
    - makedebug: Fix ERRORLEVEL detection after running where.exe
    - mbedtls: Enable use of EC keys
    - mime: Acknowledge CURL_DISABLE_MIME
    - multi: Improved HTTP_1_1_REQUIRED handling
    - netrc: Acknowledge CURL_DISABLE_NETRC
    - nss: Allow fifos and character devices for certificates
    - nss: Provide more specific error messages on failed init
    - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
    - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
    - openssl: Mark connection for close on TLS close_notify
    - openvms: Remove pre-processor for SecureTransport
    - openvms: Remove pre-processors for Windows
    - parse_proxy: Use the URL parser API
    - parsedate: Disabled on CURL_DISABLE_PARSEDATE
    - pingpong: Disable more when no pingpong protocols are enabled
    - polarssl_threadlock: Remove conditionally unused code
    - progress: Acknowledge CURL_DISABLE_PROGRESS_METER
    - proxy: Acknowledge DISABLE_PROXY more
    - resolve: Apply Happy Eyeballs philosophy to parallel c-ares queries
    - revert "multi: Support verbose conncache closure handle"
    - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
    - sasl: Only enable if there's a protocol enabled using it
    - scripts: Fix typos
    - singleipconnect: Show port in the verbose "Trying ..." message
    - smtp: Fix compiler warning
    - socks5: User name and passwords must be shorter than 256
    - socks: Fix error message
    - socksd: New SOCKS 4+5 server for tests
    - spnego_gssapi: Fix return code on gss_init_sec_context() failure
    - ssh-libssh: Remove unused variable
    - ssh: Define USE_SSH if SSH is enabled (any backend)
    - ssh: Move variable declaration to where it's used
    - test1002: Correct the name
    - test2100: Fix typos in test description
    - tests/server/util: Fix Windows Unicode build
    - tests: Run global cleanup at end of tests
    - tests: Make Impacket (SMB server) Python 3 compatible
    - tool_cb_wrt: Fix bad-function-cast warning
    - tool_formparse: Remove redundant assignment
    - tool_help: Warn if curl and libcurl versions do not match
    - tool_help: include <strings.h> for strcasecmp
    - transfer: Fix LGTM alert "Comparison is always true"
    - travis: Add an osx http-only build
    - travis: Allow builds on branches named "ci"
    - travis: Install dependencies only when needed
    - travis: Update some builds do Xenial
    - travis: Updated mesalink builds
    - url: Always clone the CUROPT_CURLU handle
    - url: Convert the zone id from a IPv6 URL to correct scope id
    - urlapi: Add CURLUPART_ZONEID to set and get
    - urlapi: Increase supported scheme length to 40 bytes
    - urlapi: Require a non-zero host name length when parsing URL
    - urlapi: Stricter CURLUPART_PORT parsing
    - urlapi: Strip off zone id from numerical IPv6 addresses
    - urlapi: urlencode characters above 0x7f correctly
    - vauth/cleartext: Update the PLAIN login to match RFC 4616
    - vauth/oauth2: Fix OAUTHBEARER token generation
    - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
    - vtls: Fix potential ssl_buffer stack overflow
    - wildcard: Disable from build when FTP isn't present
    - winbuild: Support MultiSSL builds
    - xattr: Skip unittest on unsupported platforms
  - Re-enable fish completions as they shouldn't conflict with fish any more


author: Paul Howarth <paul@city-fan.org> - 7.65.1-1.0.cf
changelog:
  - Update to 7.65.1
    - CURLOPT_LOW_SPEED_* repaired
    - NTLM: Reset proxy "multipass" state when CONNECT request is done
    - PolarSSL: Deprecate support step 1 - removed from configure
    - appveyor: Add Visual Studio solution build
    - cmake: Check for if_nametoindex()
    - cmake: Support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
    - config-win32: Add support for if_nametoindex and getsockname
    - conncache: Remove the DEBUGASSERT on length check
    - conncache: Make "bundles" per host name when doing proxy tunnels
    - curl-win32.h: Enable Unix Domain Sockets based on the Windows SDK version
    - curl_share_setopt.3: Improve wording
    - dump-header.d: Spell out that no headers == empty file
    - example/http2-download: Fix format specifier
    - examples: Clean-ups and compiler warning fixes
    - http2: Stop drain from being permanently set
    - http: Don't parse body-related headers in bodyless responses
    - md4: Build correctly with openssl without MD4
    - md4: include the mbedtls config.h to get the MD4 info
    - multi: Track users of a socket better
    - nss: Allow to specify TLS 1.3 ciphers if supported by NSS
    - parse_proxy: Make sure portptr is initialized
    - parse_proxy: Use the IPv6 zone id if given
    - sectransp: Handle errSSLPeerAuthCompleted from SSLRead()
    - singlesocket: Use separate variable for inner loop
    - ssl: Update outdated "openssl-only" comments for supported backends
    - tests: Add HAProxy keywords
    - tests: Add support to test against OpenSSH for Windows
    - tests: Make test 1420 and 1406 work with rtsp-disabled libcurl
    - tls13-docs: Mention it is only for OpenSSL ≥ 1.1.1
    - tool_parse_cfg: Avoid 2 fopen() for WIN32
    - tool_setopt: For builds with disabled-proxy, skip all proxy setopts()
    - url: Load if_nametoindex() dynamically from iphlpapi.dll on Windows
    - url: Fix bad feature-disable #ifdef
    - url: Use correct port in ConnectionExists()
    - winbuild: Use two space indentation


author: Paul Howarth <paul@city-fan.org> - 7.65.2-1.0.cf
changelog:
  - Update to 7.65.2
    - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
    - CMake: Convert errant elseif() to else()
    - CMake: Fix finding Brotli on case-sensitive file systems
    - CURLMOPT_SOCKETFUNCTION.3: Clarified
    - CURLMOPT_SOCKETFUNCTION.3: Fix typo
    - CURLOPT_CAINFO.3: Polished wording
    - CURLOPT_HEADEROPT.3: Fix example
    - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
    - CURLOPT_SEEKDATA.3: Fix variable name
    - DEPRECATE: Fixup versions and spelling
    - bindlocal: Detect and avoid IP version mismatches in bind()
    - build: Fix Codacy warnings
    - buildconf.bat: Fix header filename
    - c-ares: Honour port numbers in CURLOPT_DNS_SERVERS
    - config-os400: Add getpeername and getsockname defines
    - configure: --disable-progress-meter
    - configure: Fix --disable-code-coverage
    - configure: Fix typo '--disable-http-uath'
    - configure: More --disable switches to toggle off individual features
    - configure: Remove CURL_DISABLE_TLS_SRP
    - conn_maxage: Move the check to prune_dead_connections()
    - curl: Skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
    - curl_multi_wait.3: Escape backslash in example
    - docs: Explain behaviour change in --tlsv1. options since 7.54
    - docs: Fix links to OpenSSL docs
    - docs: Fix string suggesting HTTP/2 is not the default
    - examples/fopen: Fix comparison
    - examples/htmltitle: Use C++ casts between pointer types
    - headers: Remove no longer exported functions
    - http2: Call done_sending on end of upload
    - http2: Don't call stream-close on already closed streams
    - http2: Remove CURL_DISABLE_TYPECHECK define
    - http: Allow overriding timecond with custom header
    - http: Clarify header buffer size calculation
    - krb5: Fix compiler warning
    - lib: Use UTF-8 encoding in comments
    - libcurl-tutorial.3: Fix small typo (mutipart → multipart)
    - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
    - multi: Enable multiplexing by default (again)
    - multi: Fix the transfer hashes in the socket hash entries
    - multi: Make sure 'data' can present in several sockhash entries
    - netrc: Return the correct error code when out of memory
    - nss: Don't set unused parameter
    - nss: Inspect return value of token check
    - nss: Only cache valid CRL entries
    - nss: Support using libnss on macOS
    - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
    - openssl: Disable engine if OPENSSL_NO_UI_CONSOLE is defined
    - openssl: Fix pubkey/signature algorithm detection in certinfo
    - openssl: Remove outdated comment
    - os400: Make vsetopt() non-static as Curl_vsetopt() for os400 support
    - quote.d: Asterisk prefix works for SFTP as well
    - runtests: Keep logfiles around by default
    - runtests: Report single test time + total duration
    - smb: Use the correct error code for access denied on file open
    - sws: Remove unused variables
    - system_win32: Fix clang warning
    - system_win32: Fix typo
    - test1165: Verify that CURL_DISABLE_ symbols are in sync
    - test1521: Adapt to SLISTPOINT
    - test1523: Test CURLOPT_LOW_SPEED_LIMIT
    - test153: Fix content-length to avoid occasional hang
    - test188/189: Fix Content-Length
    - tests: Have runtests figure out disabled features
    - tests: Support non-localhost HOSTIP for dict/smb servers
    - tests: Update fixed IP for hostip/clientip split
    - tool_cb_prg: Fix integer overflow in progress bar
    - travis: Disable threaded resolver for coverage build
    - travis: Enable alt-svc for coverage build
    - travis: Enable brotli for all xenial jobs
    - travis: Enable libssh2 for coverage build
    - travis: Enable warnings-as-errors for coverage build
    - travis: Update scan-build job to xenial
    - typecheck: CURLOPT_CONNECT_TO takes an slist too
    - typecheck: Add 3 missing strings and a callback data pointer
    - unit1654: Cleanup on memory failure
    - unpause: Trigger a timeout for event-based transfers
    - url: Fix CURLOPT_MAXAGE_CONN time comparison
    - win32: Make DLL loading a no-op for UWP
    - winbuild: Change Makefile to honor ENABLE_OPENSSL_AUTO_LOAD_CONFIG
    - winbuild: Use WITH_PREFIX if given
    - wolfssl: Refer to it as wolfSSL only


author: Paul Howarth <paul@city-fan.org> - 7.66.0-1.0.cf
changelog:
  - Update to 7.66.0
    - CVE-2019-5481: FTP-KRB double-free
    - CVE-2019-5482: TFTP small blocksize heap buffer overflow
    - CURLINFO_RETRY_AFTER: Parse the Retry-After header value
    - HTTP3: Initial (experimental still not working) support
    - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
    - curl: Support parallel transfers with -Z
    - curl_multi_poll: A sister to curl_multi_wait() that waits more
    - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
    - CI: Remove duplicate configure flag for LGTM.com
    - CMake: Remove needless newlines at end of gss variables
    - CMake: Use platform dependent name for dlopen() library
    - CURLINFO docs: Mention that in redirects times are added
    - CURLOPT_ALTSVC.3: Use a "" file name to not load from a file
    - CURLOPT_ALTSVC_CTRL.3: Remove CURLALTSVC_ALTUSED
    - CURLOPT_HEADERFUNCTION.3: Clarify
    - CURLOPT_HTTP_VERSION: Setting this to 3 forces HTTP/3 use directly
    - CURLOPT_READFUNCTION.3: Provide inline example
    - CURLOPT_SSL_VERIFYHOST: Treat the value 1 as 2
    - Curl_addr2string: Take an addrlen argument too
    - Curl_fillreadbuffer: Avoid double-free trailer buf on error
    - HTTP: Use chunked Transfer-Encoding for HTTP_POST if size unknown
    - alt-svc: Add protocol version selection masking
    - alt-svc: Fix removal of expired cache entry
    - alt-svc: Make it use h3-22 with ngtcp2 as well
    - alt-svc: More liberal ALPN name parsing
    - alt-svc: Send Alt-Used: in redirected requests
    - alt-svc: With quiche, use the quiche h3 alpn string
    - appveyor: Pass on -k to make
    - asyn-thread: Create a socketpair to wait on
    - build-openssl: Fix build with Visual Studio 2019
    - cleanup: Move functions out of url.c and make them static
    - cleanup: Remove the 'numsocks' argument used in many places
    - configure: Avoid undefined check_for_ca_bundle
    - curl.h: Add CURL_HTTP_VERSION_3 to the version enum
    - curl.h: Fix outdated comment
    - curl: Cap the maximum allowed values for retry time arguments
    - curl: Handle a libcurl build without netrc support
    - curl: Make use of CURLINFO_RETRY_AFTER when retrying
    - curl: Remove outdated comment
    - curl: Use .curlrc (with a dot) on Windows
    - curl: Use CURLINFO_PROTOCOL to check for HTTP(s)
    - curl_global_init_mem.3: Mention it was added in 7.12.0
    - curl_version: Bump string buffer size to 250
    - curl_version_info.3: Mentioned ALTSVC and HTTP3
    - curl_version_info: Offer quic (and h3) library info
    - curl_version_info: Provide nghttp2 details
    - defines: Avoid underscore-prefixed defines
    - docs/ALTSVC: Remove what works and the experimental explanation
    - docs/EXPERIMENTAL: Explain what it means and what's experimental now
    - docs/MANUAL.md: Converted to markdown from plain text
    - docs/examples/curlx: Fix errors
    - docs: s/curl_debug/curl_dbg_debug in comments and docs
    - easy: Resize receive buffer on easy handle reset
    - examples: Avoid reserved names in hiperfifo examples
    - examples: Add http3.c, altsvc.c and http3-present.c
    - getenv: Support up to 4K environment variable contents on Windows
    - http09: Disable HTTP/0.9 by default in both tool and library
    - http2: When marked for closure and wanted to close == OK
    - http2_recv: Trigger another read when the last data is returned
    - http: Fix use of credentials from URL when using HTTP proxy
    - http_negotiate: Improve handling of gss_init_sec_context() failures
    - md4: Use our own MD4 when no crypto libraries are available
    - multi: Call detach_connection before Curl_disconnect
    - netrc: Make the code try ".netrc" on Windows
    - nss: Use TLSv1.3 as default if supported
    - openssl: Build warning free with boringssl
    - openssl: Use SSL_CTX_set_<min|max>_proto_version() when available
    - plan9: Add support for running on Plan 9
    - progress: Reset download/uploaded counter between transfers
    - readwrite_data: Repair setting the TIMER_STARTTRANSFER stamp
    - scp: Fix directory name length used in memcpy
    - smb: Initialize *msg to NULL in smb_send_and_recv()
    - smtp: Check for and bail out on too short EHLO response
    - source: Remove names from source comments
    - spnego_sspi: Add typecast to fix build warning
    - src/makefile: Fix uncompressed hugehelp.c generation
    - ssh-libssh: Do not specify O_APPEND when not in append mode
    - ssh: Move code into vssh for SSH backends
    - sspi: Fix memory leaks
    - tests: Replace outdated test case numbering documentation
    - tftp: Return error when packet is too small for options
    - timediff: Make it 64 bit (if possible) even with 32 bit time_t
    - travis: Reduce number of torture tests in 'coverage'
    - url: Make use of new HTTP version if alt-svc has one
    - urlapi: Verify the IPv6 numerical address
    - urldata: Avoid 'generic', use dedicated pointers
    - vauth: Use CURLE_AUTH_ERROR for auth function errors


author: B Stack <bgstack15@gmail.com> - 10.9-1
changelog:
  - version bump
  - add manual install that is now absent from upstream
  - move datadir to lowercase name instead of camelcase


author: Paul Howarth <paul@city-fan.org> - 0.1.3-1
changelog:
  - Update to 0.1.3
    - Fixes a bug in which the signature element in metalink v4 was not parsed
      correctly


author: Paul Howarth <paul@city-fan.org> - 0.1.3-4
changelog:
  - Drop support for EOL distributions prior to F-13
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section


author: Paul Howarth <paul@city-fan.org> - 0.1.3-6
changelog:
  - ldconfig replaced by RPM File Triggers from Fedora 28
  - BR: CUnit-devel unconditionally
  - Work around presence of incompatible expat21 in EPEL-6


author: Christopher Meng <rpm@cicku.me> - 0.5.0-2
changelog:
  - Drop useless test data
  - Add missing gettext-devel
  - psl is now separately packaged recommended by the upstream


author: Paul Howarth <paul@city-fan.org> - 1.8.0-5.0.cf
changelog:
  - scp: Do not NUL-terminate the command for remote exec (#1489736, GH#208)
  - Make devel package dependency on main package arch-specific


author: Paul Howarth <paul@city-fan.org> - 1.8.0-10.0.cf
changelog:
  - Explicitly run the test suite in the en_US.UTF-8 locale to work around flaky
    locale settings in mock builders


author: Paul Howarth <paul@city-fan.org> - 1.8.1-1.0.cf
changelog:
  - Update to 1.8.1
    - Fixed possible integer overflow when reading a specially crafted packet
      (CVE-2019-3855)
    - Fixed possible integer overflow in userauth_keyboard_interactive with a
      number of extremely long prompt strings (CVE-2019-3863)
    - Fixed possible integer overflow if the server sent an extremely large
      number of keyboard prompts (CVE-2019-3856)
    - Fixed possible out of bounds read when processing a specially crafted
      packet (CVE-2019-3861)
    - Fixed possible integer overflow when receiving a specially crafted exit
      signal message channel packet (CVE-2019-3857)
    - Fixed possible out of bounds read when receiving a specially crafted exit
      status message channel packet (CVE-2019-3862)
    - Fixed possible zero byte allocation when reading a specially crafted SFTP
      packet (CVE-2019-3858)
    - Fixed possible out of bounds reads when processing specially crafted SFTP
      packets (CVE-2019-3860)
    - Fixed possible out of bounds reads in _libssh2_packet_require(v)
      (CVE-2019-3859)
  - Fix mis-applied patch in the fix of CVE-2019-3859
    - https://github.com/libssh2/libssh2/issues/325
    - https://github.com/libssh2/libssh2/pull/327


author: Paul Howarth <paul@city-fan.org> - 1.8.2-1.0.cf
changelog:
  - Update to 1.8.2
    - Fixed the misapplied userauth patch that broke 1.8.1
    - Moved the MAX size declarations from the public header


author: Paul Howarth <paul@city-fan.org> - 1.9.0-1.0.cf
changelog:
  - Update to 1.9.0
    - Fixed integer overflow leading to out-of-bounds read (CVE-2019-13115)
    - Adds ECDSA keys and host key support when using OpenSSL
    - Adds ED25519 key and host key support when using OpenSSL 1.1.1
    - Adds OpenSSH style key file reading
    - Adds AES CTR mode support when using WinCNG
    - Adds PEM passphrase protected file support for libgcrypt and WinCNG
    - Adds SHA256 hostkey fingerprint
    - Adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
    - Adds explicit zeroing of sensitive data in memory
    - Adds additional bounds checks to network buffer reads
    - Adds the ability to use the server default permissions when creating sftp directories
    - Adds support for building with OpenSSL no engine flag
    - Adds support for building with LibreSSL
    - Increased sftp packet size to 256k
    - Fixed oversized packet handling in sftp
    - Fixed building with OpenSSL 1.1
    - Fixed a possible crash if sftp stat gets an unexpected response
    - Fixed incorrect parsing of the KEX preference string value
    - Fixed conditional RSA and AES-CTR support
    - Fixed a small memory leak during the key exchange process
    - Fixed a possible memory leak of the ssh banner string
    - Fixed various small memory leaks in the backends
    - Fixed possible out of bounds read when parsing public keys from the server
    - Fixed possible out of bounds read when parsing invalid PEM files
    - No longer null terminates the scp remote exec command
    - Now handle errors when Diffie Hellman key pair generation fails
    - Fixed compiling on Windows with the flag STDCALL=ON
    - Improved building instructions
    - Improved unit tests
  - Needs OpenSSL ≥ 1.0.1 now as ECC support is assumed


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-4
changelog:
  - do not try to use EC groups disallowed in FIPS mode
    in TLS
  - fix Valgrind regression with constant-time code


