Add some basic versioning for some workflows to check whether this is detected properly

Add renovate.json

vauth: make two functions void that always just returned OK

Removes the need to check return values when they can never fail.

Pointed out by CodeSonar

Closes #13621

setopt: remove check for 'option' that is always true

- make sure that passing in option set to NULL clears the fields
correctly

- remove the weird second take if Curl_parse_l

setopt: remove check for 'option' that is always true

- make sure that passing in option set to NULL clears the fields
correctly

- remove the weird second take if Curl_parse_login_details() returns
error

Follow-up to 7333faf00bf25db7cd1e0012d6b140

Spotted by CodeSonar

Closes #13619

show more ...

tests: tidy up types in server code

Cherry-picked from #13489
Closes #13610

setopt: make the setstropt_userpwd args compulsory

They were always used so no point in allowing them to be optional.

follow-up to 0e37b42dc956bd8a

Closes #13608
Review

setopt: make the setstropt_userpwd args compulsory

They were always used so no point in allowing them to be optional.

follow-up to 0e37b42dc956bd8a

Closes #13608
Reviewed-by: Daniel Gustafsson

show more ...

RELEASE-NOTES: synced

websocket: Avoid memory leak in error path

In the errorpath for randstr being too long to copy into the buffer
we leak the randstr when returning CURLE_FAILED_INIT. Fix by using
an

websocket: Avoid memory leak in error path

In the errorpath for randstr being too long to copy into the buffer
we leak the randstr when returning CURLE_FAILED_INIT. Fix by using
an explicit free on randstr in the errorpath.

Closes: #13602
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

show more ...

hsts: Remove single-use single-line function

The hsts_entry() function contains of a single line and is only
used in a single place in the code, so move the allocation into
hsts_crea

hsts: Remove single-use single-line function

The hsts_entry() function contains of a single line and is only
used in a single place in the code, so move the allocation into
hsts_create instead to improve code readability. C code usually
don't use the factory abstraction for object creation, and this
small example wasn't following our usual code style.

Closes: #13604
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

show more ...

lib: bump hash sizes to `size_t`

Follow-up to cc907e80a2498c0599253271a6f657f614b52a4e #13502
Cherry-picked from #13489
Closes #13601

tests: make the unit test result type `CURLcode`

Before this patch, the result code was a mixture of `int` and
`CURLcode`.

Also adjust casts and fix a couple of minor issues fou

tests: make the unit test result type `CURLcode`

Before this patch, the result code was a mixture of `int` and
`CURLcode`.

Also adjust casts and fix a couple of minor issues found along the way.

Cherry-picked from #13489
Closes #13600

show more ...

appveyor: tidy-ups

- delete a duplicate line.
- simplify a `make` call.
- merge two `if` branches.
- reorder autotools options for clarity.
- add `--enable-warnings` where mi

appveyor: tidy-ups

- delete a duplicate line.
- simplify a `make` call.
- merge two `if` branches.
- reorder autotools options for clarity.
- add `--enable-warnings` where missing (it's also the default.)
- add empty lines to YAML for readability.
- use lowercase install prefix/directory.

Closes #13598

show more ...

docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd

... since users might look for those terms in the manpage.

Closes #13590

setopt: warn on Curl_set*opt() uses not using the return value

And switch the invokes that would "set" NULL to instead just plainly
free the pointer, as those were otherwise the invokes

setopt: warn on Curl_set*opt() uses not using the return value

And switch the invokes that would "set" NULL to instead just plainly
free the pointer, as those were otherwise the invokes that would ignore
the return code. And possibly confuse static code analyzers.

Closes #13591

show more ...

autotools: delete unused functions

Closes #13605

examples: fix/silence `-Wsign-conversion`

- extend `FD_SET()` hack to all platforms (was only Cygwin).
Warnings may also happen in other envs, e.g. OmniOS.
Ref: https://github.co

examples: fix/silence `-Wsign-conversion`

- extend `FD_SET()` hack to all platforms (was only Cygwin).
Warnings may also happen in other envs, e.g. OmniOS.
Ref: https://github.com/libssh2/libssh2/actions/runs/8854199687/job/24316762831#step:3:2021

- tidy-up `CURLcode` vs `int` use.

- cast an unsigned to `long` before passing to `curl_easy_setopt()`.

Cherry-picked from #13489
Follow-up to 3829759bd042c03225ae862062560f568ba1a231 #12489
Closes #13501

show more ...

cmake: fix `HAVE_IOCTLSOCKET_FIONBIO` test with gcc 14

The function signature has had u_long flags since ever. This is how it
is defined in the documentation, and implemented in MinGW.

cmake: fix `HAVE_IOCTLSOCKET_FIONBIO` test with gcc 14

The function signature has had u_long flags since ever. This is how it
is defined in the documentation, and implemented in MinGW.

The code that uses ioctlsocket in nonblock.c also has unsigned long.

Error:
CurlTests.c:275:41: error: passing argument 3 of 'ioctlsocket' from incompatible pointer type [-Wincompatible-pointer-types]
275 | if(0 != ioctlsocket(0, FIONBIO, &flags))
| ^~~~~~
| |
| int *
In file included from CurlTests.c:266:
/opt/mxe/usr/i686-w64-mingw32.static/include/winsock2.h:1007:76: note: expected 'u_long *' {aka 'long unsigned int *'} but argument is of type 'int *'
1007 | WINSOCK_API_LINKAGE int WSAAPI ioctlsocket(SOCKET s,__LONG32 cmd,u_long *argp);
| ~~~~~~~~^~~~

Closes #13578

show more ...

ftp: fix build for CURL_DISABLE_VERBOSE_STRINGS

This is a follow-up to b7c7dffe which changed the FTP state change
verbose debug text (aka infof) to tracing debug text (aka trc).

ftp: fix build for CURL_DISABLE_VERBOSE_STRINGS

This is a follow-up to b7c7dffe which changed the FTP state change
verbose debug text (aka infof) to tracing debug text (aka trc).

Prior to this change if libcurl was without DEBUGBUILD and built with
CURL_DISABLE_VERBOSE_STRINGS (ie --disable-verbose) the build would
error.

Caught by Circle CI job openssl-no-verbose.

show more ...

lib: clear the easy handle's saved errno before transfer

- Clear data->state.os_errno before transfer.

- Explain the change in behavior in the CURLINFO_OS_ERRNO doc.

- Add

lib: clear the easy handle's saved errno before transfer

- Clear data->state.os_errno before transfer.

- Explain the change in behavior in the CURLINFO_OS_ERRNO doc.

- Add to the CURLINFO_OS_ERRNO doc the list of libcurl network-related
errors that may cause the errno to be saved.

data->state.os_errno is saved before libcurl returns a network-related
failure such as connection failure. It is accessible to the user via
CURLINFO_OS_ERRNO so they can get more information about the failure.

Prior to this change it wasn't cleared before transfer, so if a user
retrieved the saved errno it could be from a previous transfer. That is
because an errno is not always saved for network-related errors.

Closes https://github.com/curl/curl/pull/13574

show more ...

ftp: add tracing support

- add `Curl_trc_feat_ftp` for tracing via trace config
- add macro CURL_TRC_FTP(data, fmt, ...)
- replace DEBUGF(infof()) statements in ftp.c by CURL_TRC_FTP

ftp: add tracing support

- add `Curl_trc_feat_ftp` for tracing via trace config
- add macro CURL_TRC_FTP(data, fmt, ...)
- replace DEBUGF(infof()) statements in ftp.c by CURL_TRC_FTP()
- always trace FTP connection state

Closes #13580

show more ...

http: remove redundant check

Spotted by CodeSonar

Closes #13582

ldap: fix unused variables (seen on OmniOS)

```
../../lib/ldap.c: In function 'ldap_do':
../../lib/ldap.c:380:11: error: unused variable 'ldap_ca' [-Werror=unused-variable]

ldap: fix unused variables (seen on OmniOS)

```
../../lib/ldap.c: In function 'ldap_do':
../../lib/ldap.c:380:11: error: unused variable 'ldap_ca' [-Werror=unused-variable]
380 | char *ldap_ca = conn->ssl_config.CAfile;
| ^~~~~~~
../../lib/ldap.c:379:9: error: unused variable 'ldap_option' [-Werror=unused-variable]
379 | int ldap_option;
| ^~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/9033564377/job/24824192730#step:3:6059

Ref: #13583
Closes #13588

show more ...

url: make parse_login_details use memdup0

Also make the user and password arguments mandatory, since all code
paths in libcurl used them anyway.

Adapted unit test case 1620 to t

url: make parse_login_details use memdup0

Also make the user and password arguments mandatory, since all code
paths in libcurl used them anyway.

Adapted unit test case 1620 to the new rules.

Closes #13584

show more ...

digest: replace strcpy for empty string with simple assignment

Closes #13586

autotools: fix `HAVE_IOCTLSOCKET_FIONBIO` test for gcc 14

```
conftest.c:152:41: error: passing argument 3 of 'ioctlsocket' from incompatible pointer type [-Wincompatible-pointer-types]

autotools: fix `HAVE_IOCTLSOCKET_FIONBIO` test for gcc 14

```
conftest.c:152:41: error: passing argument 3 of 'ioctlsocket' from incompatible pointer type [-Wincompatible-pointer-types]
152 | if(0 != ioctlsocket(0, FIONBIO, &flags))
| ^~~~~~
| |
| int *
```

Reported-by: LigH
Fixes #13579
Closes #13587

show more ...