CI: update component versions

- ngtcp2: v1.4.0
- nghttp3: v1.2.0
- nghttp2: v1.61.0
- mod_h2: v2.0.27

Closes #13316

CMake: check fseeko after detecting HAVE_FILE_OFFSET_BITS

Closes #13264

http2: emit RST when client write fails

- When the writing of response data fails, reset the stream
and do not return a callback error to nghttp2. That would
be a fatal error for

http2: emit RST when client write fails

- When the writing of response data fails, reset the stream
and do not return a callback error to nghttp2. That would
be a fatal error for the connection and harm other requests.
- add test cases for various abort scenarios

Reported-by: Konstantin Kuzov
Fixes #13292
Closes #13298

show more ...

mbedtls: call mbedtls_ssl_setup() after RNG callback is set

Since mbedTLS v3.6.0, the RNG check added in ssl_conf_check() will fail
if no RNG is provided when calling mbedtls_ssl_setup()

mbedtls: call mbedtls_ssl_setup() after RNG callback is set

Since mbedTLS v3.6.0, the RNG check added in ssl_conf_check() will fail
if no RNG is provided when calling mbedtls_ssl_setup().

Therefore, mbedtls_ssl_conf_rng() needs to be called before the SSL
context is passed to mbedtls_ssl_setup().

Ref: https://github.com/Mbed-TLS/mbedtls/commit/b422cab052b51ec84758638d6783d6ba4fc60613

Signed-off-by: Kailun Qin <kailun.qin@intel.com>
Closes #13314

show more ...

NTLM_WB: drop support

The feature has not worked for months and has been marked as DEPRECATED
for six+ months.

Closes #13249

curl_trc: fix build error when lacking verbose messages

Follow-up from 0b28ece657b2273
Closes #13312

contrithanks: honor `CURLWWW` variable

Reviewed-by: Daniel Stenberg
Closes #13315

GHA: add shellcheck job and fix warnings, shell tidy-ups

Reviewed-by: Daniel Stenberg
Closes #13307

dist: do not require Perl in `maketgz`

Perl remains required for the tarball build process.

Follow-up to 860cd5fc2dc8e165fadd2c19a9b7c73b3ae5069d #13299

Reviewed-by: Daniel

dist: do not require Perl in `maketgz`

Perl remains required for the tarball build process.

Follow-up to 860cd5fc2dc8e165fadd2c19a9b7c73b3ae5069d #13299

Reviewed-by: Daniel Stenberg
Closes #13310

show more ...

RELEASE-NOTES: synced

docs/cmdline-opts: invoke managen using a relative path

... no need to use an absolute path, that makes the build unncessarily
fail if invoked using a different mount point. managen now

docs/cmdline-opts: invoke managen using a relative path

... no need to use an absolute path, that makes the build unncessarily
fail if invoked using a different mount point. managen now takes options
to find the input files.

Update test1478 to provide the dir arguments to managen

Closes #13281

show more ...

GHA: add valgrind to a wolfSSL build

Closes #13274

dist: `set -eu`, fix shellcheck, make reproducible and smaller tarballs

- set bash `-eu` and fix fallouts.
- fix shellcheck warnings.
- set and use `SOURCE_DATE_EPOCH` for reproducib

dist: `set -eu`, fix shellcheck, make reproducible and smaller tarballs

- set bash `-eu` and fix fallouts.
- fix shellcheck warnings.
- set and use `SOURCE_DATE_EPOCH` for reproducibility.
Authored-by: Daniel J. H.
Ref: #13280
- set `TZ=UTC` and `LC_ALL=C` for reproducibility.
- make file timestamps in tarball/zip reproducible.
- make directory timestamps in zip reproducible.
- make timestamps of tarballs/zip reproducible.
- make file order in tarball/zip reproducible.
- omit extra file metadata from zip for reproducibility.
- use maximum zip compression.
- use POSIX `ustar` tarball format to avoid supply chain vulnerability:
https://seclists.org/oss-sec/2021/q4/0
- make uid/gid in tarball reproducible.
- omit owner user/group names from tarball for reproducibility and privacy.
- omit current timestamp from .gz header for reproducibility.
- display SHA-256 hashes of produced tarballs/zip.
- fix whitespace.

`.tar.gz` also became smaller in the process: 4,462,311 -> 4,148,249 bytes (8.7.1)

Requires GNU tar, GNU date, `sha256sum`.

Reviewed-by: Daniel Stenberg
Ref: #13250
Closes #13299

show more ...

tests/http: fix compiler warning

- Init result code variable to fix clang warning that it may be used
uninitialized.

Fixes https://github.com/curl/curl/issues/13301
Closes

tests/http: fix compiler warning

- Init result code variable to fix clang warning that it may be used
uninitialized.

Fixes https://github.com/curl/curl/issues/13301
Closes https://github.com/curl/curl/pull/13304

show more ...

vquic: use new curl_int64_t type

- add curl_int64_t signed 64-bit type for lib use

- define CURL_PRId64, CURL_PRIu64 format ids

- use curl_int64_t in vquic

curl_in

vquic: use new curl_int64_t type

- add curl_int64_t signed 64-bit type for lib use

- define CURL_PRId64, CURL_PRIu64 format ids

- use curl_int64_t in vquic

curl_int64_t signed complements the existing curl_uint64_t unsigned.

Note that `curl_int64_t` and `int64_t` are assignable from each other
but not identical. Some platforms with 64 long type defint int64_t as
"long long" (staring at macOS) which messes up things like pointers and
format identifiers.

Closes https://github.com/curl/curl/pull/13293

show more ...

lib: use multi instead of multi_easy for the active multi

- Use data->multi and not data->multi_easy to refer to the active multi.

The easy handle's active multi is always data->mul

lib: use multi instead of multi_easy for the active multi

- Use data->multi and not data->multi_easy to refer to the active multi.

The easy handle's active multi is always data->multi.

This is a follow up to 757dfdf which changed curl so that an easy handle
used with the easy interface and then multi interface cannot have two
different multi handles associated with it at the same time
(data->multi_easy from the easy interface and data->multi from the multi
interface).

Closes https://github.com/curl/curl/pull/12665

show more ...

tidy-up: whitespace [ci skip]

makefile: remove the sorting from the vc-ide action

This target generates the MSVC project files. This change removes the
extra sorting and instead makes the script use the order of the

makefile: remove the sorting from the vc-ide action

This target generates the MSVC project files. This change removes the
extra sorting and instead makes the script use the order of the files as
listed in the variables - which are mostly sorted anyway.

This is an attempt to make the project file generation more easily
reproducible.

Ref: #13250
Closes #13294

show more ...

bearssl: fix compiler warnings

"variables may be uninitialized when used"

Fixes #13290
Closes #13297

DISTROS: Cygwin updates

Brought-by: Brian Inglis
Fixes #13258
Co-authored-by: Viktor Szakats
Closes #13279

lib: add trace support for client reads and writes

- add `CURL_TRC_READ()` and `CURL_TRC_WRITE()`
- use in generic client writers and readers, as well
as http headers, chunking and

lib: add trace support for client reads and writes

- add `CURL_TRC_READ()` and `CURL_TRC_WRITE()`
- use in generic client writers and readers, as well
as http headers, chunking and websockets

Closes #13223

show more ...

urldata: remove fields not used depending on used features

Reduced size of dynamically_allocated_data structure.

Reduced number of stored values in enum dupstring and enum dupblob.

urldata: remove fields not used depending on used features

Reduced size of dynamically_allocated_data structure.

Reduced number of stored values in enum dupstring and enum dupblob. This
affects the reduced array placed in the UserDefined structure.

Closes #13188

show more ...

cmake: enable `-pedantic-errors` for clang when `CURL_WERROR=ON`

clang doesn't have the issues of GCC and old CMake versions.

Note: This introduces asymmetry with autotools, which o

cmake: enable `-pedantic-errors` for clang when `CURL_WERROR=ON`

clang doesn't have the issues of GCC and old CMake versions.

Note: This introduces asymmetry with autotools, which only enables
this for GCC.

Reviewed-by: Daniel Stenberg
Closes #13286

show more ...

cmake: fix `CURL_WERROR=ON` for old CMake and use it in GHA/linux-old

- cmake: fix `-pedantic-errors` for old CMake with `CURL_WERROR=ON` set.

`-pedantic-errors` option throws a w

cmake: fix `CURL_WERROR=ON` for old CMake and use it in GHA/linux-old

- cmake: fix `-pedantic-errors` for old CMake with `CURL_WERROR=ON` set.

`-pedantic-errors` option throws a warning with GCC (all versions) and
makes `check_symbol_exists()` fail in CMake versions older than
v3.23.0 (2022-03-29), when CMake introduced a workaround:

https://gitlab.kitware.com/cmake/cmake/-/issues/13208
https://gitlab.kitware.com/cmake/cmake/-/commit/eeb45401163d831b8c841ef6eba81466b4067b68
https://gitlab.kitware.com/cmake/cmake/-/commit/1ab7c3cd28b27ca162c4559e1026e5cad1898ade

Follow-up to 3829759bd042c03225ae862062560f568ba1a231 #12489

- set `CURL_WERROR=ON` for the `linux-old` job in CI.

Closes #13282

show more ...

lib: use `#error` instead of invalid syntax in `curl_setup_once.h`

Reviewed-by: Daniel Stenberg
Closes #13287