RELEASE-NOTES: synced

and bump the tentative next release version to 7.85.1

2 files changed, 30 insertions, 361 deletions

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 36cd87e3b..99a4932e9 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -1,184 +1,27 @@
-curl and libcurl 7.85.0
+curl and libcurl 7.85.1
 
- Public curl releases:         210
+ Public curl releases:         211
  Command line options:         248
  curl_easy_setopt() options:   299
  Public functions in libcurl:  88
- Contributors:                 2690
+ Contributors:                 2692
 
 This release includes the following changes:
 
- o quic: add support via wolfSSL [142]
- o schannel: Add TLS 1.3 support [96]
- o setopt: add CURLOPT_PROTOCOLS_STR and CURLOPT_REDIR_PROTOCOLS_STR [30]
+ o
 
 This release includes the following bugfixes:
 
- o amigaos: fix threaded resolver on AmigaOS 4.x [133]
- o amissl: allow AmiSSL to be used with AmigaOS 4.x builds [115]
- o amissl: make AmiSSL v5 a minimum requirement [117]
- o asyn-ares: make a single alloc out of hostname + async data [123]
- o asyn-thread: fix socket leak on OOM [128]
- o asyn-thread: make getaddrinfo_complete return CURLcode [53]
- o base64: base64url encoding has no padding [41]
- o BUGS.md: improve language [62]
- o build: improve OS string in CMake and `config-win32.h` [15]
- o cert.d: clarify that escape character works for file paths [161]
- o cirrus.yml: replace py38-pip with py39-pip [63]
- o cirrus/freebsd-ci: bootstrap the pip installer [104]
- o cmake: add detection of threadsafe feature [163]
- o cmake: do not force Windows target versions [28]
- o cmake: fix build for mingw cross compile [33]
- o cmake: link curl to its dependencies with PRIVATE [57]
- o cmake: remove APPEND in export(TARGETS) [58]
- o cmake: set feature PSL if present [168]
- o cmake: support ngtcp2 boringssl backend [18]
- o cmdline-opts/gen.pl: improve performance [97]
- o config: remove the check for and use of SIZEOF_SHORT [129]
- o configure: -pthread not available on AmigaOS 4.x [118]
- o configure: check for the stdatomic.h header in configure [7]
- o configure: fix --disable-headers-api [55]
- o configure: fix broken m4 syntax in TLS options [145]
- o configure: fixup bsdsocket detection code for AmigaOS 4.x [110]
- o configure: if asked to use TLS, fail if no TLS lib was detected [156]
- o configure: introduce CURL_SIZEOF [130]
- o connect: add quic connection information [100]
- o connect: close the happy eyeballs loser connection when using QUIC [109]
- o connect: revert the use of IP*_RECVERR [102]
- o connect: set socktype/protocol correctly [114]
- o cookie: reject cookies with "control bytes" [152]
- o cookie: treat a blank domain in Set-Cookie: as non-existing [40]
- o cookie: use %zu to infof() for size_t values [26]
- o curl-compilers.m4: make icc use -diag* options and disable two warnings [84]
- o curl-config: quote directories with potential space [132]
- o curl-confopts: remove leftover AC_REQUIREs [91]
- o curl-functions.m4: check whether atomics can link [86]
- o curl-wolfssl.m4: add options header when building test code [87]
- o curl.h: CURLE_CONV_FAILED is obsoleted [4]
- o curl.h: include <sys/select.h> on SunOS [151]
- o curl: output warning when a cookie is dropped due to size [5]
- o curl: writeout: fix repeated header outputs [47]
- o Curl_close: call Curl_resolver_cancel to avoid memory-leak [124]
- o curl_easy_header: Add CURLH_PSEUDO to sanity check [94]
- o curl_mime_data.3: polish the wording [6]
- o curl_multi_timeout.3: clarify usage [48]
- o CURLINFO_SPEED_UPLOAD/DOWNLOAD.3: fix examples [121]
- o CURLOPT_BUFFERSIZE.3: add upload buffersize to see also [159]
- o CURLOPT_CONNECT_ONLY.3: clarify multi API use [64]
- o CURLOPT_SERVER_RESPONSE_TIMEOUT: the new name [16]
- o digest: fix memory leak, fix not quoted 'opaque' [66]
- o digest: fix missing increment of 'nc' value for auth-int [39]
- o digest: pass over leading spaces in qop values [119]
- o digest: reject broken header with session protocol but without qop [120]
- o docs/cmdline-opts/gen.pl: encode leading single and double quotes [138]
- o docs/cmdline-opts: fix example and categories for --form-escape [125]
- o docs/cmdline: mark fail and fail-with-body as mutually exclusive [98]
- o docs: add dns category to --resolve [95]
- o docs: explain curl_easy_escape/unescape curl handle is ignored [23]
- o docs: remove him/her/he/she from documentation [103]
- o doh: move doh related struct definitions to doh.h [45]
- o doh: use https protocol by default [51]
- o easy_lock.h: include sched.h if available to fix build [13]
- o easy_lock.h: use __asm__ instead of asm to fix build [11]
- o easy_lock: fix build for mingw [34]
- o easy_lock: fix build with icc [54]
- o easy_lock: fix the #ifdef conditional for ia32_pause [8]
- o easy_lock: switch to using atomic_int instead of bool [9]
- o easyoptions: fix icc warning [42]
- o escape: remove outdated comment [25]
- o examples/curlx.c: remove [150]
- o file: add handling of native AmigaOS paths [108]
- o file: fix icc enumerated type mixed with another type warning [92]
- o ftp: use a correct expire ID for timer expiry [88]
- o getinfo: return better error on NULL as first argument [21]
- o GHA: add two Intel compiler CI jobs [85]
- o GHA: move libressl CI from zuul to GitHub [144]
- o gha: move over ngtcp2-gnutls CI job from zuul [162]
- o GHA: mv CI torture test from Zuul [135]
- o h2h3: fix overriding the 'TE: Trailers' header [43]
- o hostip: resolve *.localhost to 127.0.0.1/::1 [127]
- o HTTP3.md: update to msh3 v0.4.0 [126]
- o http: typecast the httpreq assignment to avoid icc compiler warning [76]
- o http_aws_sigv4.c: remove two unused includes [36]
- o http_chunks: remove an assign + typecast [82]
- o hyper: customize test1274 to how hyper unfolds headers [131]
- o hyper: enable obs-folded multiline headers [101]
- o hyper: use wakers for curl pause/resume [2]
- o imap: use ISALNUM() for alphanumeric checks [134]
- o ldap: adapt to conn->port now being an 'int' [106]
- o lib/curl_path.c: add ISC to license expression [1]
- o lib3026: reduce the number of threads to 100 [44]
- o libcurl-security.3: fix typo on macro "SH_" [12]
- o libssh2: make atime/mtime date overflow return error [148]
- o libssh2: provide symlink name in SFTP dir listing [155]
- o libssh: ignore deprecation warnings [157]
- o libssh: make atime/mtime date overflow return error [149]
- o Makefile.m32: add `CURL_RC` and `CURL_STRIP` variables [ci skip] [17]
- o Makefile.m32: add `NGTCP2_LIBS` option [ci skip] [38]
- o makefile.m32: add support for custom ARCH [ci skip] [27]
- o Makefile.m32: allow -nghttp3/-ngtcp2 without -ssl [ci skip] [141]
- o Makefile.m32: do not set the libcurl.rc debug flag [ci skip] [3]
- o Makefile.m32: stop trying to build libcares.a [ci skip] [46]
- o memdebug: add annotation attributes [143]
- o mprintf: fix *dyn_vprintf() when out-of-memory [90]
- o mprintf: make dprintf_formatf never return negative [49]
- o msh3: fix the QUIC disconnect function [107]
- o multi: fix the return code from Curl_pgrsDone() [80]
- o multi: have curl_multi_remove_handle close CONNECT_ONLY transfer [136]
- o multi: use a pipe instead of a socketpair on apple platforms [154]
- o multi: use larger dns hash table for multi interface [140]
- o multi_wait: fix and improve Curl_poll error handling on Windows [146]
- o multi_wait: fix skipping to populate revents for extra_fds [147]
- o netrc.d: remove spurious quote [37]
- o netrc: Use the password from lines without login [166]
- o ngtcp2: Fix build error due to change in nghttp3 prototypes [61]
- o ngtcp2: fix incompatible function pointer types [10]
- o ngtcp2: Fix missing initialization of nghttp3_nv.flags [31]
- o ngtcp2: fix stall or busy loop on STOP_SENDING with upload data [19]
- o ngtcp2: implement cb_h3_stop_sending and cb_h3_reset_stream callbacks [59]
- o openssl: add `CURL_BORINGSSL_VERSION` to identify BoringSSL [24]
- o openssl: add cert path in error message [160]
- o openssl: add details to "unable to set client certificate" error [116]
- o openssl: fix BoringSSL symbol conflicts with LDAP and Schannel [52]
- o quiche: fix build failure [99]
- o select: do not return fatal error on EINTR from poll() [32]
- o sendf: fix paused header writes since after the header API [89]
- o sendf: make Curl_debug a void function [81]
- o sendf: skip storing HTTP headers if HTTP disabled [73]
- o sendf: store the header type in an unsigned char to avoid icc warnings [79]
- o splay: avoid using -1 in unsigned variable [78]
- o test3026: add support for Windows using native Win32 threads [65]
- o test3026: require 'threadsafe' [56]
- o test44[2-4]: add '--resolve' to the keywords [122]
- o tests/server/sockfilt.c: avoid race condition without a mutex [139]
- o tests: fix http2 tests to use CRLF headers [153]
- o tests: several enumerated type cleanups [67]
- o THANKS: merged two entries for Evgeny Grin
- o tidy-up: delete unused build configuration macros [93]
- o tool: reintroduce set file comment code for AmigaOS [111]
- o tool_cfgable: make 'synthetic_error' a plain bool [70]
- o tool_formparse: fix variable may be used before its value is set [72]
- o tool_getparam: make --doh-url "" switch it off [60]
- o tool_getparam: repair cleanarg [22]
- o tool_operate: better cleanup of easy handle in exit path [20]
- o tool_paramhlp: fix "enumerated type mixed with another type" [68]
- o tool_paramhlp: make check_protocol return ParameterError [71]
- o tool_progress: avoid division by zero in parallel progress meter [35]
- o tool_writeout: fix enumerated type mixed with another type [69]
- o trace: 0x7F character is non-printable [50]
- o unit1303: four tests should have TRUE for 'connecting' [158]
- o url: enumerated type mixed with another type [74]
- o url: really use the user provided in the url when netrc entry exists [165]
- o url: reject URLs with hostnames longer than 65535 bytes [137]
- o url: treat missing usernames in netrc as empty [167]
- o urldata: change second proxytype field to unsigned char to match [75]
- o urldata: make 'negnpn' use less storage [112]
- o urldata: make state.httpreq an unsigned char [77]
- o urldata: make three *_proto struct fields smaller [113]
- o urldata: move smaller fields down in connectdata struct [105]
- o urldata: reduce size of several struct fields [14]
- o vtls: make Curl_ssl_backend() return the enum type curl_sslbackend [83]
- o windows: improve random source [29]
+ o cmake: fix original MinGW builds [177]
+ o configure: fail if '--without-ssl' + explicit parameter for an ssl lib [164]
+ o CURLOPT_WILDCARDMATCH.3: Fix backslash escaping under single quotes [172]
+ o docs: remove mentions of deprecated '--without-openssl' parameter [170]
+ o manpages: Fix spelling of "allows to" -> "allows one to" [171]
+ o misc: spelling fixes [174]
+ o tests/certs/scripts: insert standard curl source headers [169]
+ o tool_operate: prevent over-queuing in parallel mode [176]
+ o tool_operate: reduce errorbuffer allocs [173]
+ o tool_progress: remove 'Qd' from the parallel progress bar [175]
 
 This release includes the following known bugs:
 
@@ -187,193 +30,19 @@ This release includes the following known bugs:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
-  Adam Sampson, Alessandro Ghedini, Alexandre Bury, Andreas Sommer,
-  Andrew Lambert, Axel Chong, Brad Forschinger, Brian Carpenter,
-  Cering on github, Chris Paulson-Ellis, Chris Young, Daniel Katz,
-  Daniel Stenberg, David Carlier, dEajL3kA on github, Domen Kožar,
-  Dominik Thalhammer, Don J Olmstead, Dustin Howett, Emanuele Torre,
-  Emil Engler, Érico Nogueira Rolim, Even Rouault, Evgeny Grin (Karlson2k),
-  Fabian Fischer, Fabian Keil, Gisle Vanem, Gwen Shapira, Harry Sintonen,
-  highmtworks on github, Ivan Tsybulin, Jacob Tolar, Jakub Zakrzewski,
-  Jilayne Lovejoy, Joshua Root, jurisuk on github, jvvprasad78 on github,
-  Kai Pastor, Litter White, lwthiker on github, Marcel Raad, Marc Hörsken,
-  Marco Kamner, MasterInQuestion on github, Matthew Thompson, Maxim Ivanov,
-  Michael Trebilcock, Michał Antoniak, Nao Yonashiro, Nick Banks,
-  Oliver Roberts, opensignature on github, Orgad Shaneh, Patrick Monnerat,
-  Philip H, privetryan on github, Ray Satiro, rcombs on github, Rosen Penev,
-  Ryan Schmidt, Ryan Sleevi, rzrymiak on github, Samuel Henrique,
-  Sean McArthur, Sergey Ogryzkov, Somnath Kundu, Stefan Eissing,
-  Sukanya Hanumanthu, Tatsuhiro Tsujikawa, Ted Lyngmo, TheKnarf on github,
-  Thomas Weißschuh, Tobias Nygren, Viktor Szakats, vlubart on github, Wu Zheng,
-  Wyatt O'Day, Xiaoke Wang, yiyuaner on github
-  (79 contributors)
+  ajak in #curl, Daniel Stenberg, James Fuller, justchen1369 on github,
+  Samuel Henrique, Viktor Szakats
+  (6 contributors)
 
 References to bug reports and discussions on issues:
 
- [1] = https://curl.se/bug/?i=9073
- [2] = https://curl.se/bug/?i=9070
- [3] = https://curl.se/bug/?i=9069
- [4] = https://curl.se/bug/?i=9067
- [5] = https://curl.se/bug/?i=9064
- [6] = https://curl.se/bug/?i=9063
- [7] = https://curl.se/bug/?i=9059
- [8] = https://curl.se/bug/?i=9058
- [9] = https://curl.se/bug/?i=9055
- [10] = https://curl.se/bug/?i=9056
- [11] = https://curl.se/bug/?i=9056
- [12] = https://curl.se/bug/?i=9057
- [13] = https://curl.se/bug/?i=9054
- [14] = https://curl.se/bug/?i=9106
- [15] = https://curl.se/bug/?i=9117
- [16] = https://curl.se/bug/?i=9104
- [17] = https://curl.se/bug/?i=9132
- [18] = https://curl.se/bug/?i=9065
- [19] = https://curl.se/bug/?i=9122
- [20] = https://curl.se/bug/?i=9114
- [21] = https://curl.se/bug/?i=9114
- [22] = https://curl.se/bug/?i=9128
- [23] = https://curl.se/bug/?i=9115
- [24] = https://curl.se/bug/?i=9113
- [25] = https://curl.se/bug/?i=9115
- [26] = https://curl.se/bug/?i=9095
- [27] = https://curl.se/bug/?i=9092
- [28] = https://curl.se/bug/?i=9046
- [29] = https://curl.se/bug/?i=9027
- [30] = https://curl.se/bug/?i=8992
- [31] = https://curl.se/bug/?i=9118
- [32] = https://bugs.archlinux.org/task/75201
- [33] = https://curl.se/bug/?i=9084
- [34] = https://curl.se/bug/?i=8997
- [35] = https://curl.se/bug/?i=9082
- [36] = https://curl.se/bug/?i=9080
- [37] = https://curl.se/bug/?i=9111
- [38] = https://curl.se/bug/?i=9109
- [39] = https://curl.se/bug/?i=9090
- [40] = https://curl.se/bug/?i=9164
- [41] = https://curl.se/bug/?i=9139
- [42] = https://curl.se/bug/?i=9176
- [43] = https://curl.se/bug/?i=9170
- [44] = https://curl.se/bug/?i=9172
- [45] = https://curl.se/bug/?i=9174
- [46] = https://curl.se/bug/?i=9169
- [47] = https://curl.se/bug/?i=9150
- [48] = https://curl.se/bug/?i=9155
- [49] = https://curl.se/bug/?i=9149
- [50] = https://curl.se/bug/?i=9162
- [51] = https://curl.se/bug/?i=9163
- [52] = https://curl.se/bug/?i=9110
- [53] = https://curl.se/bug/?i=9081
- [54] = https://curl.se/bug/?i=9081
- [55] = https://curl.se/bug/?i=9134
- [56] = https://curl.se/bug/?i=9141
- [57] = https://curl.se/bug/?i=9125
- [58] = https://curl.se/bug/?i=9124
- [59] = https://curl.se/bug/?i=9135
- [60] = https://curl.se/bug/?i=9207
- [61] = https://curl.se/bug/?i=9204
- [62] = https://curl.se/bug/?i=9205
- [63] = https://curl.se/bug/?i=9201
- [64] = https://curl.se/bug/?i=9244
- [65] = https://curl.se/bug/?i=9012
- [66] = https://curl.se/bug/?i=9199
- [67] = https://curl.se/bug/?i=9179
- [68] = https://curl.se/bug/?i=9179
- [69] = https://curl.se/bug/?i=9179
- [70] = https://curl.se/bug/?i=9179
- [71] = https://curl.se/bug/?i=9179
- [72] = https://curl.se/bug/?i=9179
- [73] = https://curl.se/bug/?i=9179
- [74] = https://curl.se/bug/?i=9179
- [75] = https://curl.se/bug/?i=9179
- [76] = https://curl.se/bug/?i=9179
- [77] = https://curl.se/bug/?i=9179
- [78] = https://curl.se/bug/?i=9179
- [79] = https://curl.se/bug/?i=9179
- [80] = https://curl.se/bug/?i=9179
- [81] = https://curl.se/bug/?i=9179
- [82] = https://curl.se/bug/?i=9179
- [83] = https://curl.se/bug/?i=9179
- [84] = https://curl.se/bug/?i=9179
- [85] = https://curl.se/bug/?i=9179
- [86] = https://curl.se/bug/?i=9190
- [87] = https://curl.se/bug/?i=9187
- [88] = https://curl.se/bug/?i=9184
- [89] = https://curl.se/bug/?i=9180
- [90] = https://curl.se/bug/?i=9185
- [91] = https://curl.se/bug/?i=9183
- [92] = https://curl.se/bug/?i=9181
- [93] = https://curl.se/bug/?i=9044
- [94] = https://curl.se/bug/?i=9235
- [95] = https://curl.se/bug/?i=9229
- [96] = https://curl.se/bug/?i=8419
- [97] = https://curl.se/bug/?i=9230
- [98] = https://curl.se/bug/?i=9221
- [99] = https://curl.se/bug/?i=9223
- [100] = https://curl.se/bug/?i=9286
- [101] = https://curl.se/bug/?i=9216
- [102] = https://curl.se/bug/?i=9209
- [103] = https://curl.se/bug/?i=9208
- [104] = https://curl.se/bug/?i=9213
- [105] = https://curl.se/bug/?i=9280
- [106] = https://curl.se/bug/?i=9281
- [107] = https://curl.se/bug/?i=8915
- [108] = https://curl.se/bug/?i=9259
- [109] = https://curl.se/bug/?i=9303
- [110] = https://curl.se/bug/?i=9268
- [111] = https://curl.se/bug/?i=9258
- [112] = https://curl.se/bug/?i=9279
- [113] = https://curl.se/bug/?i=9278
- [114] = https://curl.se/bug/?i=9274
- [115] = https://curl.se/bug/?i=9269
- [116] = https://curl.se/bug/?i=9228
- [117] = https://curl.se/bug/?i=9267
- [118] = https://curl.se/bug/?i=9266
- [119] = https://curl.se/bug/?i=9264
- [120] = https://curl.se/bug/?i=9077
- [121] = https://curl.se/bug/?i=9239
- [122] = https://curl.se/bug/?i=9250
- [123] = https://curl.se/bug/?i=9310
- [124] = https://curl.se/bug/?i=9310
- [125] = https://curl.se/bug/?i=9298
- [126] = https://curl.se/bug/?i=9297
- [127] = https://curl.se/bug/?i=9192
- [128] = https://curl.se/bug/?i=9310
- [129] = https://curl.se/bug/?i=9291
- [130] = https://curl.se/bug/?i=9291
- [131] = https://curl.se/bug/?i=9217
- [132] = https://curl.se/bug/?i=9253
- [133] = https://curl.se/bug/?i=9265
- [134] = https://curl.se/bug/?i=9289
- [135] = https://curl.se/bug/?i=9310
- [136] = https://curl.se/bug/?i=9335
- [137] = https://curl.se/bug/?i=9317
- [138] = https://curl.se/bug/?i=9352
- [139] = https://curl.se/bug/?i=9023
- [140] = https://curl.se/bug/?i=9376
- [141] = https://curl.se/bug/?i=9314
- [142] = https://curl.se/bug/?i=9290
- [143] = https://curl.se/bug/?i=9306
- [144] = https://curl.se/bug/?i=9309
- [145] = https://curl.se/bug/?i=9344
- [146] = https://curl.se/bug/?i=9372
- [147] = https://curl.se/bug/?i=9361
- [148] = https://curl.se/bug/?i=9328
- [149] = https://curl.se/bug/?i=9328
- [150] = https://curl.se/bug/?i=9330
- [151] = https://curl.se/bug/?i=9329
- [152] = https://curl.se/docs/CVE-2022-35252.html
- [153] = https://curl.se/bug/?i=9364
- [154] = https://curl.se/bug/?i=6132
- [155] = https://curl.se/bug/?i=9369
- [156] = https://curl.se/bug/?i=9367
- [157] = https://curl.se/bug/?i=9382
- [158] = https://curl.se/bug/?i=9356
- [159] = https://curl.se/bug/?i=9354
- [160] = https://curl.se/bug/?i=9349
- [161] = https://curl.se/bug/?i=9349
- [162] = https://curl.se/bug/?i=9331
- [163] = https://curl.se/bug/?i=9312
- [165] = https://curl.se/bug/?i=9243
- [166] = https://curl.se/bug/?i=9248
- [167] = https://curl.se/bug/?i=8653
- [168] = https://curl.se/bug/?i=9391
+ [164] = https://curl.se/bug/?i=9414
+ [169] = https://curl.se/bug/?i=9417
+ [170] = https://curl.se/bug/?i=9415
+ [171] = https://curl.se/bug/?i=9419
+ [172] = https://curl.se/bug/?i=9418
+ [173] = https://curl.se/bug/?i=9394
+ [174] = https://curl.se/bug/?i=9403
+ [175] = https://curl.se/bug/?i=9389
+ [176] = https://curl.se/bug/?i=8933
+ [177] = https://curl.se/bug/?i=9214
diff --git a/include/curl/curlver.h b/include/curl/curlver.h
index 3a3d16e85..41dfefe89 100644
--- a/include/curl/curlver.h
+++ b/include/curl/curlver.h
@@ -32,13 +32,13 @@
 
 /* This is the version number of the libcurl package from which this header
    file origins: */
-#define LIBCURL_VERSION "7.85.0-DEV"
+#define LIBCURL_VERSION "7.85.1-DEV"
 
 /* The numeric version number is also available "in parts" by using these
    defines: */
 #define LIBCURL_VERSION_MAJOR 7
 #define LIBCURL_VERSION_MINOR 85
-#define LIBCURL_VERSION_PATCH 0
+#define LIBCURL_VERSION_PATCH 1
 
 /* This is the numeric version of the libcurl version number, meant for easier
    parsing and comparisons by programs. The LIBCURL_VERSION_NUM define will
@@ -59,7 +59,7 @@
    CURL_VERSION_BITS() macro since curl's own configure script greps for it
    and needs it to contain the full number.
 */
-#define LIBCURL_VERSION_NUM 0x075500
+#define LIBCURL_VERSION_NUM 0x075501
 
 /*
  * This is the date and time when the full source package was created. The