libcurl-security.3: mention file descriptors and forks

... and move the security report section last.

Reported-by: Harry Sintonen
Closes #7270

configure.ac: make non-executable

it needs to be processed by autoconf or autoreconf, and doesn't have a
suitable shebang to be directly executed. other projects normally set
configu

configure.ac: make non-executable

it needs to be processed by autoconf or autoreconf, and doesn't have a
suitable shebang to be directly executed. other projects normally set
configure.ac -x.

Closes #7272

show more ...

configure: do not strip out debug flags

To allow users to set them when invoking configure without using
--with-debug.

Reported-by: Alex Xu
Fixes #7216
Closes #7267

libssh2: limit time a disconnect can take to 1 second

Closes #7271

TLS: prevent shutdown loops to get stuck

... by making sure the loops are only allowed to read the shutdown
traffic a limited number of times.

Reported-by: Harry Sintonen
Cl

TLS: prevent shutdown loops to get stuck

... by making sure the loops are only allowed to read the shutdown
traffic a limited number of times.

Reported-by: Harry Sintonen
Closes #7271

show more ...

hyper: propagate errors back up from read callbacks

Makes test 513 work with hyper

Closes #7266

KNOWN_BUGS: Negotiate on Windows fails

Closes #5881

KNOWN_BUGS: renames instead of locking for atomic operations

Closes #6882
Closes #6884

zuul: add two missing CI jobs

... that were configured, just not run

Closes #7261

idn: fix libidn2 with windows unicode builds

Unicode Windows builds use UTF-8 strings internally in libcurl,
so make sure to call the UTF-8 flavour of the libidn2 API. Also
document

idn: fix libidn2 with windows unicode builds

Unicode Windows builds use UTF-8 strings internally in libcurl,
so make sure to call the UTF-8 flavour of the libidn2 API. Also
document that Windows builds with libidn2 and UNICODE do expect
CURLOPT_URL as an UTF-8 string.

Reported-by: dEajL3kA on github
Assisted-by: Jay Satiro
Reviewed-by: Marcel Raad
Closes #7246
Fixes #7228

show more ...

curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE

They were never officially allowed and slipped in only due to sloppy
parsing. Spaces (ascii 32) should be correctly encoded (to

curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE

They were never officially allowed and slipped in only due to sloppy
parsing. Spaces (ascii 32) should be correctly encoded (to %20) before
being part of a URL.

The new flag bit CURLU_ALLOW_SPACE when a full URL is set, makes libcurl
allow spaces.

Updated test 1560 to verify.

Closes #7073

show more ...

RELEASE-NOTES: synced

... and bump to version 7.78.0 for the next planned release.

docs: Remove outdated curl tool limitation

- Document that HTTP/2 multiplexing is supported by the curl tool when
parallel transfers are used.

Supported since 7.66.0 via --par

docs: Remove outdated curl tool limitation

- Document that HTTP/2 multiplexing is supported by the curl tool when
parallel transfers are used.

Supported since 7.66.0 via --parallel, but the doc wasn't updated.

Closes https://github.com/curl/curl/pull/7259

show more ...

http2: Clarify 'Using HTTP2' verbose message

- Change phrasing from multi-use to multiplexing since the former may
not be as well understood.

Before: * Using HTTP2, server sup

http2: Clarify 'Using HTTP2' verbose message

- Change phrasing from multi-use to multiplexing since the former may
not be as well understood.

Before: * Using HTTP2, server supports multi-use

After: * Using HTTP2, server supports multiplexing

Bug: https://github.com/curl/curl/discussions/7255
Reported-by: David Hu

Closes https://github.com/curl/curl/pull/7258

show more ...

winbuild/README: VC should be set to 6 'or larger'

Previously it listed all versions up to 15 (missing 16) but this new
phrasing is more open ended.

Reported-by: Hugh Macdonald

winbuild/README: VC should be set to 6 'or larger'

Previously it listed all versions up to 15 (missing 16) but this new
phrasing is more open ended.

Reported-by: Hugh Macdonald
Fixes #7253
Closes #7254

show more ...

rustls: remove native_roots fallback

For the commandline tool, we expect to be passed
SSL_CONN_CONFIG(CAfile); for library use, the use should pass a set of
trusted roots (like in ot

rustls: remove native_roots fallback

For the commandline tool, we expect to be passed
SSL_CONN_CONFIG(CAfile); for library use, the use should pass a set of
trusted roots (like in other TLS backends).

This also removes a dependency on Security.framework when building on
macOS.

Closes #7250

show more ...

travis: remove jobs that have migrated to zuul

Closes #7245

CI: add jobs using Zuul

It also includes a few changes to get the builds going:
- Added autoconf to common dependencies
- Added automake to common dependencies
- Added libtool to

CI: add jobs using Zuul

It also includes a few changes to get the builds going:
- Added autoconf to common dependencies
- Added automake to common dependencies
- Added libtool to common dependencies
- Added libssl-dev to common dependencies

Co-authored-by: Albin Vass

Closes #7245

show more ...

netrc: skip 'macdef' definitions

Add test 494 to verify

Reported-by: Harry Sintonen
Fixes #7238
Closes #7244

multi: add scan-build-6 work-around in curl_multi_fdset

scan-build-6 otherwise warns, saying: warning: The left operand of '>='
is a garbage value otherwise, which is false.

Lat

multi: add scan-build-6 work-around in curl_multi_fdset

scan-build-6 otherwise warns, saying: warning: The left operand of '>='
is a garbage value otherwise, which is false.

Later scan-builds don't claim this on the same code.

Closes #7248

show more ...

asyn-ares: remove check for 'data' in Curl_resolver_cancel

It implied it would survive a NULL in there which it won't. Instead do
an assert.

Pointed out by scan-build.

asyn-ares: remove check for 'data' in Curl_resolver_cancel

It implied it would survive a NULL in there which it won't. Instead do
an assert.

Pointed out by scan-build.

Closes #7248

show more ...

url.c: remove two variable assigns that are never read

Pointed out by scan-build

Closes #7248

mqtt: add support for username and password

Minor-edits-by: Daniel Stenberg
Added test 2200 to 2205

Closes #7243

travis: remove the arm job

We do it on circle CI instead

CI: add .circleci/config.yml

Assisted-by: Gabriel Simmer

Closes #7239