Pending RELEASE-NOTES for the upcoming release

This is work in progress and seeing changes before the release goes public on 2026-12-09.

Changes:

Bugfixes:

• altsvc: cap 'ma' values at two years maximum
• API: readonly calls and callbacks
• apple sectrust: require OCSP for cert-status
• autotools: drop adjacent duplicate `LDFLAGS` from `libcurl.pc`
• autotools: drop adjacent duplicate `LIBS` from `libcurl.pc`
• cert-status: tests and fixes
• CMake/unix-cache.cmake: document BSD version requirements for two features
• cmake: drop duplicate deduplication of linker flags
• cmake: fix detecting `netinet/ip.h` on OpenBSD, FreeBSD <14.3 (HTTP/3)
• cmake: fix preconditions for option `CURL_STATIC_CRT=ON`
• cmake: omit pthread dependency when building with AWS-LC 5.6.0+ and mingw-w64
• cmake: revert to use pthreads for mingw-w64 gcc AWS-LC builds
• cmake: silence MSVC linker warning in debug builds with `CURL_DROP_UNUSED=ON`
• conncache: poll an idle connection for pending input on every reuse
• connect: bound post-connect blocking connects by their own start
• connect: tweak the timeout handling
• cookie: reload complete self-generated cookie jar rows
• cshutdown: fix event handling
• curl: apply --hsts to ipfs:// and ipns:// gateway requests
• curl_getdate.md: clarify that the weekday name means nothing
• curl_memrchr: keep reverse searches within the buffer
• curl_setup.h: fix dangling pointer in Unicode `CURL_DUMP_MODULE_PATHS()` (Windows)
• cw-pause: only pass EOS with the last flushed piece
• DEPENDENCIES.md: document LibreSSL 3.4.1+ as required (due to TLSv1.3 API)
• docs: clarify WebSocket send retries after CURLE_AGAIN
• docs: document curl_easy_send retry arg restrictions
• docs: encourage verifying tarball before unpacking
• doh: inherit the CURLOPT_DNS_* options from the mother transfer
• examples: simplify timeout handling in multi-uv.c
• file: reject a -Y range larger than the file
• formdata: reject NULL filename and buffer name options
• ftp: return the error from an invalid range on download
• getinfo: clarify invalid URL handling for CURLINFO_EFFECTIVE_URL
• gtls/sectrust: fix ocsp checks
• http2: do not let a rate limit enlarge the stream window
• http2: fail the parent transfer on CURL_PUSH_ERROROUT
• http: protocol filters
• http: use memchr() in Curl_verify_header
• imap: fail on multiple literals in custom FETCH response
• INSTALL-CMAKE.md: update 'Testing' section
• INSTALL.md: various updates and improvements
• libssh2: make the knownhost name check also verify length
• libssh: refuse SCP downloads large than CURL_OFF_T_MAX
• macos: handle close during connect
• mk-ca-bundle.pl: add `-x` option to exclude specific CA roots
• mk-ca-bundle.pl: include SHA-256 fingerprint for each CA root
• mk-ca-bundle.pl: restore option for NSS repo
• msvc: replace debug CRT GUI popups with stderr output
• multi: return the error from curl_multi_socket_all
• multi: undo the counters when curl_multi_add_handle fails
• ngh2: a shim in front of nghttp2 calls
• openssl: avoid CA caching for providers
• openssl: avoid OpenSSL API namespace for local fallback symbol
• parsedate: minor simplifications
• pingpong: allow impa to add a prefix directly
• processhelp.pm: improve task info in trace output (Windows)
• proxy: fix 0.0.0.0/0 and ::/0 CIDR matching
• pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont. 2)
• pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont.)
• pytest: don't use a regex for a simple string search
• pytest: timeline check time_queue
• rtsp: refuse doing uploads with CRLF conversions
• runtests: add `-S` option to show success logs
• runtests: add with/without-server test feature tags
• runtests: disable test server log output on feature detection
• runtests: enable retries for threaded tests
• runtests: pass `--disable` to more curl feature detection invocations
• runtests: retrieve curl version without using disk files
• rustls: reject retries shorter than buffered plaintext
• setopt: fix setting `CURLWS_NOAUTOPONG` with compilers lacking C99 bool type
• setopt: keep a paused transfer paused when the speed limit is changed
• share: connection pool shutdowns
• slist: duplicate lists in linear time
• socketpair: fix compiler warning `-Wunreachable-code`
• telnet: return errors when poll or reading the input fails
• test-linter.pl: detect duplicate sections and superfluous comments
• test1488: drop unused C preprocessor logic
• test2501, test2502: add missing `nghttpx-h3` feature
• test3230: delete local edit committed by accident
• test3500: delete redundant feature requirement
• test776: delete long-running, flaky, NTLM stress test
• test: fix test_60_h3_proxy.py to include scheme in log line
• test_06_eyeballs: silence Code Quality warning
• tests/data: delete repetitive comments
• tests/data: drop stray `data` section, merge duplicate `features` sections
• tests/server: fix crashing with VS2013 and earlier
• tests/servers.pm: minor improvements
• tests: drop unused includes
• tests: move non-libtest `libtest/*.pl` scripts one level up
• tests: use %TESTNUMBER more instead of the actual test number
• testutil: better function implementation
• tidy-up: perl formatting nits
• tidy-up: simplify CRTDBG logic in `generate.bat`
• tool: append buffered response headers in constant time
• tool: preserve absent schemes when appending upload filenames
• tool: reject more than 2 GB of data to URL encode
• tool_cb_hdr: do not truncate existing file on filename-less C-D header
• tool_cb_hdr: treat an empty -J filename as no filename
• tool_getparam: preserve field names for empty URL-encoded files
• tool_getpass: keep the last character when there is no newline
• tool_operhlp: trim remote filename separators in linear time
• tool_parsecfg: accept indented options and CRLF line endings again
• tool_parsecfg: count skipped lines in config file line numbers
• tool_writeout_json: escape bytes that are not UTF-8
• transfer: drop a pending read rewind when a new transfer starts
• urlapi: check host for bad content after IDN decode
• urlapi: do not add the zone id twice to a set IPv6 host
• urlapi: do not pass a NULL path to printf for file URLs
• urldata: move OpenSSL provider state to OpenSSL context struct
• VERSIONS: add the new rock-solid curl releases
• vtls: encode session peer key fields unambiguously
• vtls_scache: add auto-client awareness to session key
• vtls_scache: add scheme name to session key
• vtls_scache: if using native-ca, use that in key
• VULN-DISCLOSURE-POLICY.md: officially don't care for old issues
• VULN-DISCLOSURE-POLICY.md: take severity < HIGH to GitHub
• wolfssl: get the public key to pin from wolfSSL
• wolfssl: require a peer certificate when verifying
• ws: mask outgoing payload in chunks
• x509: verify that ASN.1 parsing does not get out of sync
• x509asn1: free the field buffer when a public key value fails to convert

Contributors:

11soda11, akashdeshmukh-git, AP, Armaan Sandhu, Autofix powered by AI, Bootherr on hackerone, Dan Fandrich, Daniel McCarney, Daniel Stenberg, Daniel Wade, David H-yan, David H_YAN, Derek Martin, Jeremy Levartovsky, Johnny Kao, Jon DeVree, Kartatz on github, Khaled, Martin Mirchev, Martin Vlach, Máté Szabó, matty69v, Max Dymond, Michiel van Slobbe, Mihai-Gabriel Marin, Nora Qiu, Patrick Monnerat, pszemus, Ray Satiro, renovate[bot], revolik on hackerone, Rhino, Roger Light, Samuel Henrique, Stefan Eissing, Stephen Augustus, stze on hackerone, Sujit Jaunjal, trestoncuzzort, Umut, vansukmbg on hackerone, Vasiliy-Kkk, Viktor Szakats, Zefan Xu, Zheng Yu