Changes in 8.12.0 - February 5 2025

Changes:

• curl: add byte range support to --variable reading from file
• curl: make --etag-save acknowledge --create-dirs
• getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
• getinfo: provide info which auth was used for HTTP and proxy
• hyper: drop support
• openssl: add support to use keys and certificates from PKCS#11 provider
• QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
• vtls: feature ssls-export for SSL session im-/export

Bugfixes:

• altsvc: avoid integer overflow in expire calculation
• altsvc: return error on dot-only name
• android: add CI jobs, buildinfo, cmake docs, disable `CURL_USE_PKGCONFIG` by default
• asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
• asyn-ares: fix memory leak
• asyn-ares: initial HTTPS resolve support
• asyn-thread: use c-ares to resolve HTTPS RR
• asyn-thread: avoid closing eventfd twice
• autotools: add support for mingw UWP builds
• autotools: silence gcc warnings in libtool code
• binmode: convert to macro and use it from tests
• build: delete `-Wsign-conversion` related FIXMEs
• build: drop `-Winline` picky warning
• build: drop `tool_hugehelp.c.cvs`, tidy up macros, drop `buildconf.bat`
• build: drop unused feature macros, update exception list
• build: fix `-Wtrampolines` picky warning for gcc 4.x versions
• build: fix compiling with GCC 4.x versions
• build: fix the tidy targets for autotools
• build: fix unsigned `time_t` detection for cmake, MS-DOS, AmigaOS
• build: replace configure check with PP condition (Android <21)
• build: stop detecting `sched_yield()` on Windows
• c-ares: fix/tidy-up macro initializations, avoid a deprecated function
• cd2nroff: do not insist on quoted <> within backticks
• cd2nroff: support "none" as a TLS backend
• cf-https-connect: look into httpsrr alpns when available
• cf-socket: error if address can't be copied
• cfilters: kill connection filter events attach+detach
• checksrc.bat: remove explicit SNPRINTF bypass
• checksrc: ban use of sscanf()
• checksrc: check for return with parens around a value/name
• checksrc: exclude generated bundle files to avoid race condition
• checksrc: fix the return() checker
• checksrc: introduce 'banfunc' to ban specific functions
• cmake/Find: add `iphlpapi` for c-ares, omit syslibs if dep not found
• cmake/FindLDAP: avoid empty 'Requires' item when omitting `pkg-config` module
• cmake/FindLDAP: avoid framework locations for libs too (Apple)
• cmake/FindLibpsl: protect against `pkg-config` "half-detection"
• cmake/FindLibssh: sync header comment with other modules
• cmake/FindMbedTLS: drop lib duplicates early
• cmake: add `librtmp` Find module
• cmake: add LDAP Find module
• cmake: add native `pkg-config` detection for remaining Find modules
• cmake: allow `CURL_LTO` regardless of `CURL_BUILD_TYPE`, enable in CI
• cmake: clang-cl improvements
• cmake: delete accidental debug message
• cmake: deprecate winbuild, add migration guide from legacy build methods
• cmake: detect mingw-w64 version, pre-fill `HAVE_STRTOK_R`
• cmake: do not store `MINGW64_VERSION` in cache
• cmake: drop `CURL_USE_PKGCONFIG` from `curl-config.cmake.in`
• cmake: drop `fseeko()` pre-fill and check for Windows
• cmake: drop duplicate Windows cache value
• cmake: drop redundant FOUND checks (libgsasl, libssh, libuv)
• cmake: drop redundant opening/closing `.*` from `MATCH` expressions
• cmake: drop unused `HAVE_SYS_XATTR_H` detection
• cmake: drop VS2010 "Dialog Hell" workaround added in 2013
• cmake: extend zlib's `AUTO` option to brotli, zstd and enable if found
• cmake: fix `net/in.h` detection for MS-DOS
• cmake: improve `curl_dumpvars()` and move to `Utilities.cmake`
• cmake: make libpsl required by default
• cmake: make system libraries `dl`, `m`, `pthread` customizable
• cmake: move `pkg-config` names to Find modules
• cmake: move GSS init before feature detections
• cmake: move mingw UWP workaround from GHA to `CMakeLists.txt`
• cmake: namespace functions and macros
• cmake: optimize out 4 picky warning option detections with gcc
• cmake: pick a better IPv6 feature flag when assembling the feature list
• cmake: pre-fill `HAVE_STDATOMIC_H`, `HAVE_ATOMIC` for mingw-w64
• cmake: pre-fill `HAVE_STDINT_H` on Windows
• cmake: prefer dash-style MSVC options
• cmake: publish/check supported protocols/features via `CURLConfig.cmake`
• cmake: replace `unset(VAR)` with `set(VAR "")` for init
• cmake: sync OpenSSL QUIC fork detection with autotools
• cmake: use `CMAKE_REQUIRED_LINK_DIRECTORIES`
• cmake: use `STREQUAL` to detect Linux
• cmake: warn for OpenSSL versions missing TLS 1.3 support
• cmdline-opts/version.md: describe multissl, mention SSLS-EXPORT
• completion.pl: add completion for paths after @ for fish
• config-mac: drop `MACOS_SSL_SUPPORT` macro
• config: drop unused code and variables
• configure: do not inline 'dnl' comments
• configure: drop unused detections and macros
• configure: streamline Windows large file feature check
• configure: UWP and Android follow-up fixes
• conncache: count shutdowns against host and max limits
• conncache: result_cb comment removed from function docs
• content_encoding: drop support for zlib before 1.2.0.4
• content_encoding: namespace GZIP flag constants
• content_encoding: put the decomp buffers into the writer structs
• content_encoding: support use of custom libzstd memory functions
• cookie: cap expire times to 400 days
• cookie: fix crash in netscape cookie parsing
• cookie: parse only the exact expire date
• curl-functions.m4: fix indentation in `CURL_SIZEOF()`
• curl: return error if etag options are used with multiple URLs
• curl_multi_fdset: include the shutdown connections in the set
• curl_multi_waitfds.md: tidy up the example
• curl_multibyte: support Windows paths longer than MAX_PATH
• curl_setup: fix missing `ADDRESS_FAMILY` type in rare build cases
• curl_sha512_256: rename symbols to the curl namespace
• curl_url_set.md: adjust the added-in to 7.62.0
• curl_ws_recv.md: fix typo
• CURLOPT_CONNECT_ONLY.md: an easy handle with this option set cannot be reused
• CURLOPT_PROXY.md: clarify the credential support in proxy URLs
• CURLOPT_RESOLVE.md: fix wording
• CURLOPT_SEEKFUNCTION.md: used for FTP, HTTP and SFTP (only)
• docs/BUGS.md: remove leading space from a link
• docs/cmdline-opts/_ENVIRONMENT.md: minor language fix
• docs/cmdline-opts/location.md: fix typos for location flag
• docs/HTTP-COOKIES.md: link to more information
• docs/HTTPSRR.md: initial HTTPS RR documentation
• docs/libcurl/opts: clarify the return values
• docs/libcurl: return value overhall
• docs/TLS-SESSIONS: fix typo, the->they
• docs: document the behavior of -- in the curl command line
• docs: use lowercase curl and libcurl
• doh: cleanups and extended HTTPS RR code
• doh: send HTTPS RR requests for all HTTP(S) transfers
• easy: allow connect-only handle reuse with easy_perform
• easy: make curl_easy_perform() return error if connection still there
• easy_lock: use Sleep(1) for thread yield on old Windows
• ECH: update APIs to those agreed with OpenSSL maintainers
• examples/block-ip: drop redundant `memory.h` include
• examples/block-ip: show how to block IP addresses
• examples/complicated: fix warnings, bump deprecated callback, tidy up
• examples/synctime.c: remove references to dead URLs and functionality
• examples: make them compile with compatibility functions disabled (Windows)
• examples: use return according to code style
• file: drop `OPEN_NEEDS_ARG3` option
• file: fix Android compiler warning
• gitignore: add generated unity sources for lib and src
• GnuTLS: fix 'time_appconnect' for early data
• hash: add asserts in hash_element_dtor()
• HTTP/2: strip TE request header
• http2: fix data_pending check
• http2: fix value stored to 'result' is never read
• http: fix build with `CURL_DISABLE_COOKIES`
• http: ignore invalid Retry-After times
• http_aws_sigv4: Fix invalid compare function handling zero-length pairs
• https-connect: start next immediately on failure
• INFRASTRUCTURE.md: project infra
• INSTALL-CMAKE.md: fix punctuation
• INSTALL.md: add CMake examples for macOS and iOS
• INSTALL.md: document VS2008 and mingw-w64
• INTERNALS.md: sync wolfSSL version requirement with source code
• lib517: extend the getdate test with quotes and leading "junk"
• lib: clarify 'conn->httpversion'
• lib: redirect handling by protocol handler
• lib: remove `__EMX__` guards
• lib: replace `inline` redefine with `CURL_INLINE` macro
• lib: suppress deprecation warnings in apple builds
• lib: TLS session ticket caching reworked
• libcurl/opts: do not save files in dirs where attackers have access
• Makefile.dist: delete
• Makefile.mk: drop in favour of autotools and cmake (MS-DOS, AmigaOS3)
• mbedtls: fix handling of blocked sends
• mbedtls: PSA can be used independently of TLS 1.3 (avoid runtime errors)
• mime: explicitly rewind subparts at attachment time.
• mprintf: fix integer handling in float precision
• mprintf: terminate snprintf output on windows
• msvc: add missing push/pop for warning pragmas
• msvc: assume `_INTEGRAL_MAX_BITS >= 64`
• msvc: drop checks for ancient versions
• msvc: fix building with `HAVE_INET_NTOP` and MSVC <=1900
• msvc: require VS2005 for large file support
• msvc: tidy up `_CRT_*_NO_DEPRECATE` definitions
• multi: fix curl_multi_waitfds reporting of fd_count
• multi: fix return code for an already-removed easy handle
• multihandle: add an ssl_scache here
• multissl: auto-enable `OPENSSL_COEXIST` for wolfSSL + OpenSSL
• multissl: make openssl + wolfssl builds work
• netrc: 'default' with no credentials is not a match
• netrc: fix password-only entries
• netrc: restore _netrc fallback logic
• ngtcp2: fix memory leak on connect failure
• ngtcp2: fix two cases of value stored never read
• openssl: define `HAVE_KEYLOG_CALLBACK` before use
• openssl: drop unused `HAVE_SSL_GET_SHUTDOWN` macro
• openssl: fix ECH logic
• osslq: use SSL_poll to determine writeability of QUIC streams
• projects/Windows: remove wolfSSL from legacy projects
• projects: fix `INSTALL-CMAKE.md` references
• pytest: remove 'repeat' parameter
• pytest: use httpd/apache2 directly, no apachectl
• RELEASE-PROCEDURE.md: mention how to publish security advisories
• runtests.pl: fix precedence issue
• scripts/mdlinkcheck: markdown link checker
• sectransp: free certificate on error
• select: avoid a NULL deref in cwfds_add_sock
• smb: fix compiler warning
• src: add `CURL_STRICMP()` macro, use `_stricmp()` on Windows
• src: drop support for `CURL_TESTDIR` debug env
• src: omit hugehelp and ca-embed from libcurltool
• ssl session cache: change cache dimensions
• strparse: string parsing helper functions
• symbols-in-versions: update version for LIBCURL_VERSION and LIBCURL_VERSION_NUM
• system.h: add 64-bit curl_off_t definitions for NonStop
• system.h: drop compilers lacking 64-bit integer type (Windows/MS-DOS)
• system.h: drop duplicate and no-op code
• system.h: fix indentation
• telnet: handle single-byte input option
• test1960: don't close the socket too early
• test483: require cookie support
• tests/http/clients: use proper sleep() call on NonStop
• tests: change the behavior of swsbounce
• tests: stop promoting perl warnings to fatal errors
• TheArtOfHttpScripting.md: rewrite double 'that'
• tidy-up: `curl_setup.h`, `curl_setup_once.h`, `config-win32ce.h`
• tidy-up: drop parenthesis around `return` expression
• tidy-up: drop parenthesis around `return` values
• tidy-up: extend `CURL_O_BINARY` to lib and tests
• TLS: check connection for SSL use, not handler
• tool_formparse.c: make curlx_uztoso a static in here
• tool_formparse: accept digits in --form type= strings
• tool_getparam: ECH param parsing refix
• tool_getparam: fail --hostpubsha256 if libssh2 is not used
• tool_getparam: fix "Ignored Return Value"
• tool_getparam: fix memory leak on error in parse_ech
• tool_getparam: fix the ECH parser
• tool_operate: make --etag-compare always accept a non-existing file
• transfer: fix CURLOPT_CURLU override logic
• urlapi: fix redirect to a new fragment or query (only)
• urldata: tweak the UserDefined struct
• variable.md: mention --expand-variable for variables to variables
• variable.md: show function use with examples
• version: fix the IDN feature for winidn and appleidn
• vquic: fix 4th function call argument is an uninitialized value
• vquic: make vquic_send_packets not return without setting psent
• vtls: fix default SSL backend as a fallback
• vtls: only remember the expiry timestamp in session cache
• vtls: remove 'detach/attach' functions from TLS handler struct
• vtls: remove unused 'check_cxn' from TLS handler struct
• vtls: replace "none"-functions with NULL pointers
• VULN-DISCLOSURE-POLICY.md: mention the not setting CVSS
• VULN-DISCLOSURE-POLICY: on legacy dependencies
• websocket: fix message send corruption
• windows: drop dupe macros, detect `CURL_OS` for WinCE ARM, indentation
• windows: drop redundant `USE_WIN32_SMALL_FILES` macro
• windows: drop two missed `buildconf.bat` references
• windows: merge `config-win32ce.h` into `config-win32.h`
• ws-docs: extend WebSocket documentation
• ws-docs: remove the outdated texts saying ws support is experimental
• ws: reject frames with unknown reserved bits set
• x509asn1: add parse recursion limit

Further