RELEASE-NOTES: synced
curl 7.76.0 release
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index abb1426..ac43439 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -4,7 +4,7 @@
Command line options: 240
curl_easy_setopt() options: 288
Public functions in libcurl: 85
- Contributors: 2352
+ Contributors: 2356
This release includes the following changes:
@@ -17,6 +17,8 @@
This release includes the following bugfixes:
+ o CVE-2021-22876: strip credentials from the auto-referer header field [88]
+ o CVE-2021-22890: add 'isproxy' argument to Curl_ssl_get/addsessionid() [55]
o asyn-ares: use consistent resolve error message [37]
o BUG-BOUNTY: removed the cooperation mention
o build: delete unused feature guards [51]
@@ -30,6 +32,7 @@
o ci: stop building on freebsd-12-1 [38]
o cmake: fix import library name for non-MS compiler on Windows [10]
o cmake: use CMAKE_INSTALL_INCLUDEDIR indirection [49]
+ o cmake: support WinIDN [100]
o config: fix building SMB with configure using Win32 Crypto [91]
o config: fix detection of restricted Windows App environment
o configure: fail if --with-quiche is used and quiche isn't found [48]
@@ -41,6 +44,7 @@
o configure: s/AC_HELP_STRING/AS_HELP_STRING [110]
o cookies: Fix potential NULL pointer deref with PSL [66]
o curl: set CURLOPT_NEW_FILE_PERMS if requested [65]
+ o curl_easy_setopt.3: add curl_easy_option* functions to SEE ALSO
o curl_multibyte: always return a heap-allocated copy of string [29]
o curl_multibyte: fall back to local code page stat/access on Windows [8]
o Curl_timeleft: check both timeouts during connect [109]
@@ -58,6 +62,7 @@
o doh: Fix sharing user's resolve list with DOH handles [46]
o doh: Inherit CURLOPT_STDERR from user's easy handle [60]
o dynbuf: bump the max HTTP request to 1MB [39]
+ o examples: Remove threaded-shared-conn.c due to bug [119]
o file: Support unicode urls on windows [9]
o ftp: add 'list_only' to the transfer state struct [35]
o ftp: add 'prefer_ascii' to the transfer state struct [36]
@@ -75,6 +80,7 @@
o hsts: remove unused defines [93]
o http2: don't set KEEP_SEND when there's no more data to be sent [90]
o http2: fail if connection terminated without END_STREAM [97]
+ o http: cap body data amount during send speed limiting [116]
o http: do not add a referrer header with empty value [44]
o http: make 416 not fail with resume + CURLOPT_FAILONERRROR [108]
o http: remove superfluous NULL assign [75]
@@ -88,6 +94,7 @@
o libssh2:ssh_connect: clear session pointer after free [98]
o memdebug: close debug logfile explicitly on exit [28]
o mingw: enable using strcasecmp() [50]
+ o multi: close the connection when h2=>h1 downgrading [122]
o multi: do once-per-transfer inits in before_perform in DID state [54]
o multi: rename the multi transfer states [43]
o multi: update pending list when removing handle [82]
@@ -97,7 +104,9 @@
o ngtcp2: sync with recent API updates [113]
o openldap: avoid NULL pointer dereferences [102]
o openssl: adapt to v3's new const for a few API calls [86]
+ o openssl: ensure to check SSL_CTX_set_alpn_protos return values [121]
o openssl: remove get_ssl_version_txt in favor of SSL_get_version [67]
+ o openssl: set the transfer pointer for logging early [123]
o OS400: update for CURLOPT_AWS_SIGV4 [2]
o parse_proxy: fix a memory leak in the OOM path [41]
o pathhelp.pm: fix use of pwd -L in Msys environment
@@ -133,6 +142,7 @@
o urldata: don't touch data->set.httpversion at run-time [6]
o urldata: fix build without HTTP and MQTT [22]
o urldata: make 'actions[]' use unsigned char instead of int [47]
+ o urldata: merge "struct DynamicStatic" into "struct UrlState" [117]
o urldata: remove the 'rtspversion' field [15]
o urldata: remove the _ORIG suffix from string names [31]
o version.d: Add missing features to the features list [57]
@@ -146,18 +156,19 @@
advice from friends like these:
Ádler Jonas Gross, Alejandro Colomar, Alex Xu, Amaury Denoyelle, Andrei Bica,
- arvids-kokins-bidstack on github, awesomenode on github, Benbuck Nason,
- Bodo Bergmann, Carl Zogheib, Christian Schmitz, Dan Fandrich,
- Daniel Gustafsson, Daniel Stenberg, David Demelier, David Goerger,
+ Anthony Ramine, arvids-kokins-bidstack on github, awesomenode on github,
+ Benbuck Nason, Bodo Bergmann, Carl Zogheib, Christian Schmitz, Dan Fandrich,
+ Daniel Gustafsson, Daniel Stenberg, David Demelier, David Goerger, David Hu,
ebejan on github, Emil Engler, Fabian Keil, Firefox OS, Gisle Vanem,
Gregor Jasny, Ikko Ashimine, Jack Boos Yu, Jacob Hoffman-Andrews,
Jean-Philippe Menil, Joel Teichroeb, Johannes Lesr, Jonathan Watt,
Jon Rumsey, Jordan Brown, Joseph Chen, Jun-ya Kato, kokke on github,
- Lawrence Gripper, Manuj Bhatia, Marcel Raad, Marc Hörsken, Michael Brown,
- Michael Hordijk, Patrick Monnerat, Per Jensen, Ray Satiro, Robert Ronto,
- Sergei Nikulov, Simon Josefsson, Stephan Szabo, Tomas Berger, Viktor Szakats,
- Vincent Torri, Vladimir Varlamov, ZimCodes on github, ウさん
- (53 contributors)
+ Lawrence Gripper, Li Xinwei, Manuj Bhatia, Marcel Raad, Marc Hörsken,
+ Michael Brown, Michael Hordijk, Mingtao Yang, Oumph on github,
+ Patrick Monnerat, Per Jensen, Ray Satiro, Robert Ronto, Sergei Nikulov,
+ Simon Josefsson, Stephan Szabo, Tomas Berger, Viktor Szakats, Vincent Torri,
+ Vladimir Varlamov, ZimCodes on github, ウさん
+ (58 contributors)
References to bug reports and discussions on issues:
@@ -215,6 +226,7 @@
[52] = https://curl.se/bug/?i=6639
[53] = https://curl.se/bug/?i=6598
[54] = https://curl.se/bug/?i=6640
+ [55] = https://curl.se/docs/CVE-2021-22890.html
[56] = https://curl.se/bug/?i=6697
[57] = https://curl.se/bug/?i=6677
[58] = https://curl.se/bug/?i=6692
@@ -247,6 +259,7 @@
[85] = https://curl.se/bug/?i=6751
[86] = https://curl.se/bug/?i=6703
[87] = https://curl.se/bug/?i=6664
+ [88] = https://curl.se/docs/CVE-2021-22876.html
[89] = https://curl.se/bug/?i=6750
[90] = https://curl.se/bug/?i=6747
[91] = https://curl.se/bug/?i=6277
@@ -258,6 +271,7 @@
[97] = https://curl.se/bug/?i=6736
[98] = https://curl.se/bug/?i=6764
[99] = https://curl.se/bug/?i=6691
+ [100] = https://curl.se/bug/?i=6807
[101] = https://curl.se/bug/?i=6758
[102] = https://curl.se/bug/?i=6676
[103] = https://curl.se/bug/?i=6738
@@ -271,3 +285,9 @@
[111] = https://curl.se/bug/?i=6774
[112] = https://curl.se/bug/?i=6771
[113] = https://curl.se/bug/?i=6770
+ [116] = https://curl.se/mail/lib-2021-03/0042.html
+ [117] = https://curl.se/bug/?i=6798
+ [119] = https://curl.se/bug/?i=6795
+ [121] = https://curl.se/bug/?i=6794
+ [122] = https://curl.se/bug/?i=6788
+ [123] = https://curl.se/bug/?i=6783
