- o mkhelp: generate code for --disable-manual as well [1]
- o hostcheck: added a system include to define struct in_addr
- o winbuild: added warnless.c to fix build
- o Makefile.vc6: added warnless.c to fix build
- o smtp: Fixed login denied when server doesn't support AUTH capability [2]
- o smtp: Fixed login denied with a RFC-821 based server [2]
- o curl: stop interpreting IPv6 literals as glob patterns
- o http2: remove _DRAFT09 from the NPN_HTTP2 enum
- o http2: let openssl mention the exact protocol negotiated
- o http2+openssl: fix compiler warnings in ALPN using code
- o ftp: in passive data connect wait for happy eyeballs sockets [3]
- o HTTP: don't send Content-Length: 0 _and_ Expect: 100-continue [4]
- o http2: Compile with current nghttp2, which supports h2-11 [5]
- o http_negotiate_sspi: Fixed compilation when USE_HTTP_NEGOTIATE not defined
- o strerror: fix comment about vxworks' strerror_r buffer size [6]
- o url: only use if_nametoindex() if IFNAMSIZ is available
- o imap: Fixed untagged response detection when no data after command
- o various: fix possible dereference of null pointer
- o various: fix use of uninitialized variable
- o various: fix use of non-null terminated strings
- o telnet.c: check sscanf results before passing them to snprintf
- o parsedate.c: check sscanf result before passing it to strlen
- o sockfilt.c: free memory in case of memory allocation errors
- o sockfilt.c: ignore non-key-events and continue waiting for input
- o sockfilt.c: properly handle disk files, pipes and character input
- o sockfilt.c: fixed getting stuck waiting for MinGW stdin pipe
- o sockfilt.c: clean up threaded approach and add documentation
- o configure: use the nghttp2 path correctly with pkg-config [8]
- o curl_global_init_mem: bump initialized even if already initialized [9]
- o gtls: fix NULL pointer dereference [10]
- o cyassl: Use error-ssl.h when available
- o handler: make 'protocol' always specified as a single bit [11]
- o INFILESIZE: fields in UserDefined must not be changed run-time
- o openssl: biomem->data is not zero terminated
- o config-win32.h: Fixed HAVE_LONGLONG for Visual Studio .NET 2003 and up
- o curl_ntlm_core: Fixed use of long long for VC6 and VC7
- o
+ o openldap: check ldap_get_attribute_ber() results for NULL before using [50]
+ o FTP: reject path components with control codes [51]
+ o readwrite: make sure excess reads don't go beyond buffer end [52]
+ o lib555: drop text conversion and encode data as ascii codes [1]
+ o lib517: make variable static to avoid compiler warning
+ o lib544: sync ascii code data with textual data [1]
+ o GSKit: restore pinnedpubkey functionality [2]
+ o darwinssl: Don't import client certificates into Keychain on macOS [3]
+ o parsedate: fix date parsing for systems with 32 bit long [4]
+ o openssl: fix pinned public key build error in FIPS mode [5]
+ o SChannel/WinSSL: Implement public key pinning [6]
+ o cookies: remove verbose "cookie size:" output
+ o progress-bar: don't use stderr explicitly, use bar->out [7]
+ o Fixes for MSDOS
+ o build: open VC15 projects with VS 2017
+ o curl_ctype: private is*() type macros and functions [8]
+ o configure: set PATH_SEPARATOR to colon for PATH w/o separator [9]
+ o winbuild: make linker generate proper PDB [11]
+ o curl_easy_reset: clear digest auth state [12]
+ o curl/curl.h: fix comment typo for CURLOPT_DNS_LOCAL_IP6 [14]
+ o range: commonize FTP and FILE range handling [15]
+ o progress-bar docs: update to match implementation [16]
+ o fnmatch: do not match the empty string with a character set
+ o fnmatch: accept an alphanum to be followed by a non-alphanum in char set [17]
+ o build: fix termios issue on android cross-compile [18]
+ o getdate: return -1 for out of range [19]
+ o formdata: use the mime-content type function [20]
+ o time-cond: fix reading the file modification time on Windows [21]
+ o build-openssl.bat: Extend VC15 support to include Enterprise and Professional
+ o build-wolfssl.bat: Extend VC15 support to include Enterprise and Professional
+ o openssl: Don't add verify locations when verifypeer==0
+ o fnmatch: optimize processing of consecutive *s and ?s pattern characters [22]
+ o schannel: fix compiler warnings [23]
+ o content_encoding: Add "none" alias to "identity" [24]
+ o get_posix_time: only check for overflows if they can happen
+ o http_chunks: don't write chunks twice with CURLOPT_HTTP_TRANSFER_DECODING [25]
+ o README: language fix [26]
+ o sha256: build with OpenSSL < 0.9.8 [27]
+ o smtp: fix processing of initial dot in data [28]
+ o --tlsauthtype: works only if libcurl is built with TLS-SRP support [29]
+ o tests: new tests for http raw mode [30]
+ o libcurl-security.3: man page discussion security concerns when using libcurl
+ o curl_gssapi: make sure this file too uses our *printf()
+ o BINDINGS: fix curb link (and remove ruby-curl-multi)
+ o nss: use PK11_CreateManagedGenericObject() if available [31]
+ o travis: add build with iconv enabled [32]
+ o ssh: add two missing state names [33]
+ o CURLOPT_HEADERFUNCTION.3: mention folded headers
+ o http: fix the max header length detection logic [34]
+ o header callback: don't chop headers into smaller pieces [35]
+ o CURLOPT_HEADER.3: clarify problems with different data sizes
+ o curl --version: show PSL if the run-time lib has it enabled
+ o examples/sftpuploadresume: resume upload via CURLOPT_APPEND [36]
+ o Return error if called recursively from within callbacks [38]
+ o sasl: prefer PLAIN mechanism over LOGIN
+ o winbuild: Use CALL to run batch scripts [40]
+ o curl_share_setopt.3: connection cache is shared within multi handles
+ o winbuild: Use macros for the names of some build utilities [41]
+ o projects/README: remove reference to dead IDN link/package [42]
+ o lib655: silence compiler warning [43]
+ o configure: Fix version check for OpenSSL 1.1.1
+ o docs/MANUAL: formfind.pl is not accessible on the site anymore [44]
+ o unit1309: fix warning on Windows x64 [45]
+ o unit1307: proper cleanup on OOM to fix torture tests
+ o curl_ctype: fix macro redefinition warnings
+ o build: get CFLAGS (including -werror) used for examples and tests [46]
+ o NO_PROXY: fix for IPv6 numericals in the URL [47]
+ o krb5: use nondeprecated functions [48]
+ o winbuild: prefer documented zlib library names [49]
+ o http2: mark the connection for close on GOAWAY [53]
+ o limit-rate: kick in even before "limit" data has been received [54]
+ o HTTP: allow "header;" to replace an internal header with a blank one [55]
+ o http2: verbose output new MAX_CONCURRENT_STREAMS values
+ o SECURITY: distros' max embargo time is 14 days
+ o curl tool: accept --compressed also if Brotli is enabled and zlib is not
+ o WolfSSL: adding TLSv1.3 [56]
+ o checksrc.pl: add -i and -m options
+ o CURLOPT_COOKIEFILE.3: "-" as file name means stdin