cURL full changelog

Changes:
build: drop Heimdal support
build: drop the winbuild build system
krb5: drop support for Kerberos FTP
libssh2: up the minimum requirement to 1.9.0
multi: add notifications API
progress: expand to use 6 characters per size
ssl: support Apple SecTrust configurations
tool_getparam: add --knownhosts
vssh: drop support for wolfSSH
wcurl: import v2025.11.04
write-out: make %header{} able to output *all* occurrences of a header
Bugfixes:
ares: fix leak in tracing
asyn-ares: remove wrong comment about the callback argument
asyn-ares: use the duped hostname pointer for all calls
asyn-thrdd resolver: clear timeout when done
asyn-thrdd: drop pthread_cancel
autotools: add support for libgsasl auto-detection via pkg-config
autotools: capitalize Rustls in the log output
autotools: drop detection of ancient OpenSSL libs RSAglue and rsaref
autotools: fix duplicate UNIX and BSD flags in buildinfo.txt
autotools: fix silly mistake in clang detection for buildinfo.txt
autotools: make --enable-code-coverage support llvm/clang
autotools: merge `if`s in GnuTLS/OpenSSL feature detection
aws-lc: re-enable large read-ahead with v1.61.0 again
base64: accept zero length argument to base64_encode
build: address some -Weverything warnings, update picky warnings
build: avoid overriding system open and stat symbols
build: avoid overriding system symbols for fopen functions
build: avoid overriding system symbols for socket functions
build: show llvm/clang in platform flags and buildinfo.txt
c-ares: when resolving failed, persist error
cf-h2-proxy: break loop on edge case
cf-ip-happy: mention unix domain path, not port number
cf-socket: always check Curl_cf_socket_peek() return code
cf-socket: check params and remove accept procondition
cf-socket: make set_local_ip void, and remove failf()
cf-socket: set FD_CLOEXEC on all sockets opened
cf-socket: tweak a memcpy() to read better
cf-socket: use the right byte order for ports in bindlocal
cfilter: unlink and discard
cfilters: check return cod

Changes:
build: bump minimum required mingw-w64 to v3.0 (from v1.0)
curl: add --follow
curl: add --out-null
curl: add --parallel-max-host to limit concurrent connections per host
curl: make --retry-delay and --retry-max-time accept decimal seconds
hostip: cache negative name resolves
ip happy eyeballing: keep attempts running
mbedtls: bump minimum version required to 3.2.0
multi: add curl_multi_get_offt
multi: add CURLMOPT_NETWORK_CHANGED to signal network changed
netrc: use the NETRC environment variable (first) if set
smtp: allow suffix behind a mail address for RFC 3461
tls: make default TLS version be minimum 1.2
tool_getparam: add support for `--longopt=value`
vquic: drop msh3
websocket: support CURLOPT_READFUNCTION
writeout: add %time{}
Bugfixes:
_PROTOCOLS.md: mention file:// is only for absolute paths
acinclude: --with-ca-fallback only works with OpenSSL
alpn: query filter
ares: destroy channel on shutdown
ares: use `ares_strerror()` to retrieve error messages
asyn-thrdd: fix --disable-socketpair builds
asyn-thrdd: fix Curl_async_pollset without socketpair
asyn-thrdd: fix no `HAVE_GETADDRINFO` builds
asyn-thrdd: manage DEFERRED and locks better
autotools: make curl-config executable
aws-lc: do not use large buffer
BINDINGS.md: add LibQurl
bufq: add integer overflow checks before chunk allocations
bufq: removed "Useless Assignment"
bufq: simplify condition
build: allow libtests/clients to use libcurl dependencies directly
build: disable `TCP_NODELAY` for emscripten
build: enable _GNU_SOURCE on GNU/Hurd
build: extend GNU C guards to clang where applicable, fix fallouts
build: fix build errors/warnings in rare configurations
build: fix disable-verbose
build: fix mingw-w64 version guard for mingw32ce
build: if no perl, fix to use the pre-built hugehelp, if present
build: link to Apple frameworks required by static wolfSSL
build: support LibreSSL native crypto lib with ngtcp2 1.15.0+
build: tidy up compiler definition for tests
cf-https-connect: delete

Changes:
TLS: remove support for Secure Transport and BearSSL
Bugfixes:
altsvc: accept 'clear' without semicolon as well
asyn-ares: remove redundant NULL check
asyn-thrdd: free the previous name before strdup'ing the new
autotools: detect and link `brotlicommon` library for brotli
autotools: drop `$top_builddir/src` from src header path
autotools: drop headers from src mk-unity rules (fixup)
autotools: drop no longer necessary `--srcdir` unity options
autotools: drop redundant `Makefile.inc` from `EXTRA_DIST` in src
autotools: simplify configuration in tests, examples
bufq: change read/write signatures
bufq: remove the unused Curl_bufq_unwrite function
build: assume `sys/socket.h`, `sys/time.h` on non-Windows (as in `curl/curl.h`)
build: drop `HAVE_SYS_SOCKET_H` and `HAVE_SYS_TIME_H` macros
build: drop explicit curlx from hdr paths, refer headers with `curlx/` prefix
build: drop unused variables in tests
build: fix libcurltool with cmake and tunits, related tidy-ups
build: split `.c` and `.h` file lists in tests
build: stop checking for `sys/stat.h`
build: stubgss tidy-ups (in tests)
build: sync build scripts between client/libtest
build: tidy up `Makefile.inc` use in lib and src
build: tidy up header paths, use srcdir where possible
cf-socket: make socket data_pending a nop
checksrc-all: rewrite in Perl, remove `checksrc.bat`
checksrc: reduce exceptions, apply again to curlx
cmake/FindGSS: fix processing C header path options
cmake/FindGSS: initialize result variables
cmake: `curl_add_clang_tidy_test_target` tidy-ups
cmake: build `stubgss` library for libtests to match autotools
cmake: check USE_WINDOWS_SSPI when adding secur32 to CURL_LIBS
cmake: configure c-ares header directory in project root (was: lib)
cmake: document OpenSSL and ngtcp2 crypto lib custom variables
cmake: drop never propagated C macros
cmake: drop passing redundant `CURL_STATICLIB` in examples and clients
cmake: drop redundant macro from test clients
cmake: drop reference to future variable
cma

Changes:
Bugfixes:
asyn-thrdd: fix cleanup when RR fails due to OOM
autotools: recognize more Linux targets when setting `-D_GNU_SOURCE`
BUG-BOUNTY.md. mention the medium bounty amount in 2025
cmake: fix missed version number for multi-pkg-config detections
cmdline-docs: mention HTTP resumed uploads to be shaky
curl: make -N handled correctly
curl: upload from '.' fix
dllmain: exclude from Cygwin builds
docs/tests: remove mention of hyper
docs: fix typos
ftp: fix teardown of DATA connection in done
http: fail early when rewind of input failed when following redirects
license: update some copyright links to curl.se
memanalyze.pl: fix getaddrinfo/freeaddrinfo checks
misc: fix spelling
misc: we write *an* IPv6 address
multi: fix add_handle resizing
spelling: 'a' vs 'an'
spelling: call it null-terminate consistently
test1510: fix expectation
tests: await portfile to be complete
tests: fix checks for https-mtls proto
tests: improve server start reliability
tests: move test docs into /docs
tests: re-enable 1510, document heimdal memleak
tests: test mtls also w/ clientAuth EKU only
tests: test mtls with --insecure
tls BIOs: handle BIO_CTRL_EOF correctly
tool_getparam: make --no-anyauth not be accepted
tool_getparam: refactored, simplified
tool_getparam: remove two nextarg NULL checks
VULN-DISCLOSURE-POLICY.md: the distros list wants <= 7 days embargo
wolfssl: fix sending of early data
ws: handle blocked sends better
ws: tests and fixes

Changes:
mqtt: send ping at upkeep interval
schannel: handle pkcs12 client certificates containing CA certificates
TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
vquic: ngtcp2 + openssl support
wcurl: import v2025.04.20 script + docs
websocket: add option to disable auto-pong reply
Bugfixes:
_SEEALSO.md: remove spaces around command and man page section
asny-thrdd: fix detach from running thread
asnyc-thrdd: explain how this is okay with a comment
asyn resolver code improvements
async-threaded resolver: use ref counter
async: DoH improvements
autotools: detect `wolfSSL_set_quic_use_legacy_code` like cmake does
autotools: install shell completion files on cross build
aws-sigv4: allow a blank string
build: check required rustls-ffi version
build: enable gcc-12/13+, clang-10+ picky warnings
build: enable gcc-15 picky warnings
certs: drop unused `default_bits` from `.prm` files
cf-https-connect: use the passed in dns struct pointer
cf-socket: fix FTP accept connect
cfilters: remove assert
cmake/FindNGTCP2: simplify multi-pkg-config detection
cmake: append picky warnings to `CMAKE_REQUIRED_FLAGS` as string
cmake: avoid 'target is imported but not globally visible' when consuming libcurl with old cmake
cmake: do not install `mk-ca-bundle` script and manpage
cmake: enable `-Wall` for MSVC when `PICKY_COMPILER=ON`
cmake: extend integration tests
cmake: fix `fish` install directory detection via `pkg-config`
cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
cmake: fix option() and mark_as_advanced() mixed order
cmake: fix shell completion install when just one flavor is enabled
cmake: honor individual picky option overrides found in `CMAKE_C_FLAGS`
cmake: install shell completions for cross-builds
cmake: link `crypt32` for OpenSSL feature detection
cmake: merge `CURL_WERROR` logic into `PickyWarnings.cmake`
cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
cmake: quotes, whitespace, use `VERSION_GREATER_EQUAL`
cmake: revert `CURL_L

Changes:
curl: add write-out variable 'tls_earlydata'
curl: make --url support a file with URLs
gnutls: set priority via --ciphers
IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
OpenSSL/quictls: add support for TLSv1.3 early data
rustls: add support for CERTINFO
rustls: add support for SSLKEYLOGFILE
rustls: support ECH w/ DoH lookup for config
rustls: support native platform verifier
var: add a '64dec' function that can base64 decode a string
wolfssl: tls early data support
Bugfixes:
addrinfo: add curl macro to avoid redefining foreign symbols
asyn-thread: avoid the separate 'struct resdata' alloc
asyn-thread: avoid the separate curl_mutex_t alloc
asyn-thread: do not allocate thread_data separately
asyn-thread: remove 'status' from struct Curl_async
autotools: fix `dllmain.c` in unity builds
autotools: fix `libtest` bundle to depend on `FIRSTFILES`
autotools: use `CURLDEBUG` to exclude TrackMemory code from unity
aws_sigv4: cannot be used for proxy
aws_sigv4: merge repeated headers in canonical request
aws_sigv4: use strparse more for parsing
base64: drop `BUILDING_CURL` macro, always include in tests/server
build: add Windows CE / CeGCC support, with CI jobs
build: cmake multi-pkg-config detection improvements (brotli, ldap, mbedtls)
build: do not apply curl debug macros to `tests/server` by default
build: drop unused `getpart` tool
build: enable -Wjump-misses-init for GCC 4.5+
build: enable `-Wcast-qual`, fix or silence compiler warnings
build: fix compiler warnings in feature detections
build: replace Curl_ prefix with curlx_ for functions used in servers
build: set `-O3` and tune WinCE in CI, fix `getpart`, `vtls_scache` fallouts
build: set `HAVE_STDINT_H` if `stdint.h` is available
build: set `HAVE_WRITABLE_ARGV` for Apple cross-builds
build: silence bogus `-Wconversion` warnings with gcc 5.1-5.4
build: silence mingw32ce C99 format warnings, simplify CI
build: tidy-ups around `inet_pton`
c-ares httpsrr: f

Bugfixes:
all: remove FIXME and TODO comments
asyn-thread: fix build with `CURL_DISABLE_SOCKETPAIR`
asyn-thread: fix HTTPS RR crash
asyn-thread: fix the returned bitmask from Curl_resolver_getsock
asyn-thread: survive a c-ares channel set to NULL
build: add tool_hugehelp.c into IBMi build
checksrc.pl: warn on FIXME/TODO comments
cmake/Find: set `<Modulename>_FOUND` for compatibility when found via `pkg-config`
cmake: add integration tests, run them in CI
cmake: always reference OpenSSL and ZLIB via imported targets
cmake: avoid unnecessary `-L` for implicit link dirs
cmake: drop `LDAP_DEPRECATED=1` macro, to sync with autotools
cmake: fix `HAVE_GETHOSTBYNAME_R_*` detections with `CURL_WERROR=ON`
cmake: fix to detect `HAVE_OPENSSL_SRP` in MSVC UWP builds
cmake: fix/add missing feature detections for Windows/MS-DOS
cmake: initialize variables where missing
cmake: lib order fixes for picky linkers (e.g. binutils `ld`)
cmake: normalize before matching paths with syspaths
cmake: respect `GNUTLS_CFLAGS` when detected via `pkg-config`
cmake: respect `GNUTLS_LIBRARY_DIRS` in `libcurl.pc` and `curl-config`
cmake: save a line with `CMAKE_C_IMPLICIT_LINK_DIRECTORIES` exclusion
cmake: tidy up string append and list prepend syntax
configure/cmake: check for realpath
configure/cmake: set asyn-rr a feature only if httpsrr is enabled
content_encoding: #error on too old zlib
curl_global_sslset.md: Add SSL backend names
CURLOPT_SSH_KNOWNHOSTS.md: strongly recommend using this
CURLSHOPT_SHARE.md: adjust for the new SSL session cache
docs: better explain multi-part byte range behavior
docs: use valid example domain names
generate.bat: remove curl_get_line.c from the curlx file list
header.md: mention `Authorization:` and `Cookie:` special treatment
imap: TLS upgrade fix
INTERNALS: fix c-ares, as we actually support 1.6.0 or later
ldap: drop support for legacy Novell LDAP SDK
lib: include necessary headers for `inet_ntop`/`inet_pton`
lib: silence LibreSSL collision warning on non-

Changes:
curl: add byte range support to --variable reading from file
curl: make --etag-save acknowledge --create-dirs
getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
getinfo: provide info which auth was used for HTTP and proxy
hyper: drop support
openssl: add support to use keys and certificates from PKCS#11 provider
QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
vtls: feature ssls-export for SSL session im-/export
Bugfixes:
altsvc: avoid integer overflow in expire calculation
altsvc: return error on dot-only name
android: add CI jobs, buildinfo, cmake docs, disable `CURL_USE_PKGCONFIG` by default
asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
asyn-ares: fix memory leak
asyn-ares: initial HTTPS resolve support
asyn-thread: use c-ares to resolve HTTPS RR
async-thread: avoid closing eventfd twice
autotools: add support for mingw UWP builds
autotools: silence gcc warnings in libtool code
binmode: convert to macro and use it from tests
build: delete `-Wsign-conversion` related FIXMEs
build: drop `-Winline` picky warning
build: drop `tool_hugehelp.c.cvs`, tidy up macros, drop `buildconf.bat`
build: drop unused feature macros, update exception list
build: fix `-Wtrampolines` picky warning for gcc 4.x versions
build: fix compiling with GCC 4.x versions
build: fix the tidy targets for autotools
build: fix unsigned `time_t` detection for cmake, MS-DOS, AmigaOS
build: replace configure check with PP condition (Android <21)
build: stop detecting `sched_yield()` on Windows
c-ares: fix/tidy-up macro initializations, avoid a deprecated function
cd2nroff: do not insist on quoted <> within backticks
cd2nroff: support "none" as a TLS backend
cf-https-connect: look into httpsrr alpns when available
cf-socket: error if address can't be copied
cfilters: kill connection filter events attach+detach
checksrc.bat: remove explicit SNPRINTF bypass
checksrc: ban use of sscanf()
checksrc: check for return with parens around a value/name
checksrc: exclude

Bugfixes:
build: fix ECH to always enable HTTPS RR
build: fix MSVC UWP builds
build: omit certain deps from `libcurl.pc` unless found via `pkg-config`
build: use `_fseeki64()` on Windows, drop detections
cmake: do not echo most inherited `LDFLAGS` to config files
cmake: drop cmake args list from `buildinfo.txt`
cmake: include `wolfssl/options.h` first
cmake: remove legacy unused IMMEDIATE keyword
cmake: restore cmake args list in `buildinfo.txt`
cmake: set `CURL_STATICLIB` for static lib when `SHARE_LIB_OBJECT=OFF`
cmake: sync GSS config code with other deps
cmake: typo in comment
cmake: work around `ios.toolchain.cmake` breaking feature-detections
cmakelint: fix to check root `CMakeLists.txt`
cmdline/ech.md: formatting cleanups
configure: add FIXMEs for disabled pkg-config references
configure: do not echo most inherited `LDFLAGS` to config files
configure: replace `$#` shell syntax
cookie: treat cookie name case sensitively
curl-rustls.m4: keep existing `CPPFLAGS`/`LDFLAGS` when detected
curl.h: mark two error codes as obsolete
curl: --continue-at is mutually exclusive with --no-clobber
curl: --continue-at is mutually exclusive with --range
curl: --continue-at is mutually exclusive with --remove-on-error
curl: --test-duphandle in debug builds runs "duphandled"
curl: do more command line parsing in sub functions
curl: rename struct var to fix AIX build
curl: use realtime in trace timestamps
curl_multi_socket_all.md: soften the deprecation warning
CURLOPT_PREREQFUNCTION.md: add result code on failure
digest: produce a shorter cnonce in Digest headers
DISTROS: update Alt Linux links
dmaketgz: use --no-cache when building docker image
docs: bring back ALTSVC.md and HSTS.md
docs: document default `User-Agent`
docs: suggest --ssl-reqd instead of --ftp-ssl
duphandle: also init netrc
ECH: enable support for the AWS-LC backend
hostip: don't use the resolver for FQDN localhost
http_negotiate: allow for a one byte larger channel binding buffer
http_proxy: move dynh

Changes:
curl: --create-dirs works for --dump-header as well
gtls: Add P12 format support
ipfs: add options to disable
TLS: TLSv1.3 earlydata support for curl
WebSockets: make support official (non-experimental)
Bugfixes:
alt-svc: honor data->state.httpwant
altsvc: avoid using local buffer and memcpy
asyn-ares: remove typecast, fix expire
autotools: add support for 'unity' builds, enable in CI
bearssl: avoid strpcy() when generating TLS version log message
bearssl: improved session handling, test exceptions
bufq: unwrite fix
build: add `ldap` to `libcurl.pc` `Requires:`
build: add pytest targets
build: clarify CA embed is for curl tool, mark default, improve summary
build: detect and use `_setmode()` with Cygwin/MSYS, also use on Windows
build: disable warning `-Wunreachable-code-break`
build: fix clang-cl builds, add CI job
build: fix cross-compile check for poll with bionic
build: fix possible `-Wformat-overflow` in lib557
build: limit arc4random detection to no-SSL configs
build: show if CA bundle to embed was found
build: tidy up and improve versioned-symbols options
build: tidy up deprecation suppression, enable warnings for clang
certs: add missing `-CAcreateserial` option for LibreSSL
checksrc: add check for spaces around logical AND operators
checksrc: Added checks for colon operator in ternary expressions
checksrc: check for spaces around '?', '>' and '<'
ci: dump `curl_config.h` to log in all jobs
CI: run with standard mod_http2
cmake, Makefile.mk: use -isystem for headers, silence BearSSL issues
cmake/FindCares: fix version detection for c-ares 1.34.1
cmake/FindNGTCP2: use library path as hint for finding crypto module
cmake: add missed variable to comment
cmake: add native `pkg-config` detection for mbedTLS, MSH3, Quiche, Rustls, wolfSSL
cmake: allow building tests in unity mode
cmake: apply `WIN32_LEAN_AND_MEAN` to all feature checks
cmake: avoid setting `BUILD_TESTING`
cmake: clear package version after `pkg-config` detection
cmake: delete unu