                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.65.1 (4 Jun 2019)

Daniel Stenberg (4 Jun 2019)
- RELEASE-NOTES: 7.65.1

- THANKS: new contributors from 7.65.1

Steve Holme (4 Jun 2019)
- [Frank Gevaerts brought this change]

  ssl: Update outdated "openssl-only" comments for supported backends
  
  These are for features that used to be openssl-only but were expanded
  over time to support other SSL backends.
  
  Closes #3985

Daniel Stenberg (4 Jun 2019)
- curl_share_setopt.3: improve wording [ci ship]
  
  Reported-by: Carlos ORyan

Steve Holme (4 Jun 2019)
- tool_parsecfg: Use correct return type for GetModuleFileName()
  
  GetModuleFileName() returns a DWORD which is a typedef of an unsigned
  long and not an int.
  
  Closes #3980

Daniel Stenberg (3 Jun 2019)
- TODO: "at least N milliseconds between requests" [ci skip]
  
  Suggested-by: dkwolfe4 on github
  Closes #3920

Steve Holme (2 Jun 2019)
- tests/server/.gitignore: Add socksd to the ignore list
  
  Missed in 04fd6755.
  
  Closes #3978

- tool_parsecfg: Fix control flow issue (DEADCODE)
  
  Follow-up to 8144ba38.
  
  Detected by Coverity CID 1445663
  Closes #3976

Daniel Stenberg (2 Jun 2019)
- [Sergey Ogryzkov brought this change]

  NTLM: reset proxy "multipass" state when CONNECT request is done
  
  Closes #3972

- test334: verify HTTP 204 response with chunked coding header
  
  Verifies that a bodyless response don't parse this content-related
  header.

- [Michael Kaufmann brought this change]

  http: don't parse body-related headers bodyless responses
  
  Responses with status codes 1xx, 204 or 304 don't have a response body. For
  these, don't parse these headers:
  
  - Content-Encoding
  - Content-Length
  - Content-Range
  - Last-Modified
  - Transfer-Encoding
  
  This change ensures that HTTP/2 upgrades work even if a
  "Content-Length: 0" or a "Transfer-Encoding: chunked" header is present.
  
  Co-authored-by: Daniel Stenberg
  Closes #3702
  Fixes #3968
  Closes #3977

- tls13-docs: mention it is only for OpenSSL >= 1.1.1
  
  Reported-by: Jay Satiro
  Co-authored-by: Jay Satiro
  Fixes #3938
  Closes #3946

- dump-header.d: spell out that no headers == empty file [ci skip]
  
  Reported-by: wesinator at github
  Fixes #3964
  Closes #3974

- singlesocket: use separate variable for inner loop
  
  An inner loop within the singlesocket() function wrongly re-used the
  variable for the outer loop which then could cause an infinite
  loop. Change to using a separate variable!
  
  Reported-by: Eric Wu
  Fixes #3970
  Closes #3973

- RELEASE-NOTES: synced

- [Josie Huddleston brought this change]

  http2: Stop drain from being permanently set on
  
  Various functions called within Curl_http2_done() can have the
  side-effect of setting the Easy connection into drain mode (by calling
  drain_this()).  However, the last time we unset this for a transfer (by
  calling drained_transfer()) is at the beginning of Curl_http2_done().
  If the Curl_easy is reused for another transfer, it is then stuck in
  drain mode permanently, which in practice makes it unable to write any
  data in the new transfer.
  
  This fix moves the last call to drained_transfer() to later in
  Curl_http2_done(), after the functions that could potentially call for a
  drain.
  
  Fixes #3966
  Closes #3967
  Reported-by: Josie-H

Steve Holme (29 May 2019)
- conncache: Remove the DEBUGASSERT on length check
  
  We trust the calling code as this is an internal function.
  
  Closes #3962

Jay Satiro (29 May 2019)
- [Gisle Vanem brought this change]

  system_win32: fix function prototype
  
  - Change if_nametoindex parameter type from char * to const char *.
  
  Follow-up to 09eef8af from this morning.
  
  Bug: https://github.com/curl/curl/commit/09eef8af#r33716067

Marcel Raad (29 May 2019)
- appveyor: add Visual Studio solution build
  
  Closes https://github.com/curl/curl/pull/3941

- appveyor: add support for other build systems
  
  Introduce BUILD_SYSTEM variable, which is currently always CMake.
  
  Closes https://github.com/curl/curl/pull/3941

Steve Holme (29 May 2019)
- url: Load if_nametoindex() dynamically from iphlpapi.dll on Windows
  
  This fixes the static dependency on iphlpapi.lib and allows curl to
  build for targets prior to Windows Vista.
  
  This partially reverts 170bd047.
  
  Fixes #3960
  Closes #3958

Daniel Stenberg (29 May 2019)
- http: fix "error: equality comparison with extraneous parentheses"

- parse_proxy: make sure portptr is initialized
  
  Reported-by: Benbuck Nason
  
  fixes #3959

- url: default conn->port to the same as conn->remote_port
  
  ... so that it has a sensible value when ConnectionExists() is called which
  needs it set to differentiate host "bundles" correctly on port number!
  
  Also, make conncache:hashkey() use correct port for bundles that are proxy vs
  host connections.
  
  Probably a regression from 7.62.0
  
  Reported-by: Tom van der Woerdt
  Fixes #3956
  Closes #3957

- conncache: make "bundles" per host name when doing proxy tunnels
  
  Only HTTP proxy use where multiple host names can be used over the same
  connection should use the proxy host name for bundles.
  
  Reported-by: Tom van der Woerdt
  Fixes #3951
  Closes #3955

- multi: track users of a socket better
  
  They need to be removed from the socket hash linked list with more care.
  
  When sh_delentry() is called to remove a sockethash entry, remove all
  individual transfers from the list first. To enable this, each Curl_easy struct
  now stores a pointer to the sockethash entry to know how to remove itself.
  
  Reported-by: Tom van der Woerdt and Kunal Ekawde
  
  Fixes #3952
  Fixes #3904
  Closes #3953

Steve Holme (28 May 2019)
- curl-win32.h: Enable Unix Domain Sockets based on the Windows SDK version
  
  Microsoft added support for Unix Domain Sockets in Windows 10 1803
  (RS4). Rather than expect the user to enable Unix Domain Sockets by
  uncommenting the #define that was added in 0fd6221f we use the RS4
  pre-processor variable that is present in newer versions of the
  Windows SDK.
  
  Closes #3939

Daniel Stenberg (28 May 2019)
- [Jonas Vautherin brought this change]

  cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  
  Closes #3945

Marcel Raad (27 May 2019)
- HAProxy tests: add keywords
  
  Add the proxy and haproxy keywords in order to be able to exclude or
  run these specific tests.
  
  Closes https://github.com/curl/curl/pull/3949

Daniel Stenberg (27 May 2019)
- [Maksim Stsepanenka brought this change]

  tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  
  Closes #3948

Kamil Dudka (27 May 2019)
- [Hubert Kario brought this change]

  nss: allow to specify TLS 1.3 ciphers if supported by NSS
  
  Closes #3916

Daniel Stenberg (26 May 2019)
- RELEASE-NOTES: synced

- [Jay Satiro brought this change]

  Revert all SASL authzid (new feature) commits
  
  - Revert all commits related to the SASL authzid feature since the next
    release will be a patch release, 7.65.1.
  
  Prior to this change CURLOPT_SASL_AUTHZID  / --sasl-authzid was destined
  for the next release, assuming it would be a feature release 7.66.0.
  However instead the next release will be a patch release, 7.65.1 and
  will not contain any new features.
  
  After the patch release after the reverted commits can be restored by
  using cherry-pick:
  
  git cherry-pick a14d72c a9499ff 8c1cc36 c2a8d52 0edf690
  
  Details for all reverted commits:
  
  Revert "os400: take care of CURLOPT_SASL_AUTHZID in curl_easy_setopt_ccsid()."
  
  This reverts commit 0edf6907ae37e2020722e6f61229d8ec64095b0a.
  
  Revert "tests: Fix the line endings for the SASL alt-auth tests"
  
  This reverts commit c2a8d52a1356a722ff9f4aeb983cd4eaf80ef221.
  
  Revert "examples: Added SASL PLAIN authorisation identity (authzid) examples"
  
  This reverts commit 8c1cc369d0c7163c6dcc91fd38edfea1f509ae75.
  
  Revert "curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool"
  
  This reverts commit a9499ff136d89987af885e2d7dff0a066a3e5817.
  
  Revert "sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID"
  
  This reverts commit a14d72ca2fec5d4eb5a043936e4f7ce08015c177.

- [dbrowndan brought this change]

  FAQ: more minor updates and spelling fixes
  
  Closes #3937

- RELEASE-NOTES: synced

- sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  
  Reported-by: smuellerDD on github
  Fixes #3932
  Closes #3933

GitHub (24 May 2019)
- [Gisle Vanem brought this change]

  Fix typo.

Daniel Stenberg (23 May 2019)
- tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  
  Reported-by: Marcel Raad
  Fixes #3926
  Closes #3929

Steve Holme (23 May 2019)
- winbuild: Use two space indentation
  
  Closes #3930

GitHub (23 May 2019)
- [Gisle Vanem brought this change]

  tool_parse_cfg: Avoid 2 fopen() for WIN32
  
  Using the memdebug.h mem-leak feature, I noticed 2 calls like:
    FILE tool_parsecfg.c:70 fopen("c:\Users\Gisle\AppData\Roaming\_curlrc","rt")
    FILE tool_parsecfg.c:114 fopen("c:\Users\Gisle\AppData\Roaming\_curlrc","rt")
  
  No need for 'fopen(), 'fclose()' and a 'fopen()' yet again.

Daniel Stenberg (23 May 2019)
- md4: include the mbedtls config.h to get the MD4 info

- md4: build correctly with openssl without MD4
  
  Reported-by: elsamuko at github
  Fixes #3921
  Closes #3922

Patrick Monnerat (23 May 2019)
- os400: take care of CURLOPT_SASL_AUTHZID in curl_easy_setopt_ccsid().

Daniel Stenberg (23 May 2019)
- .github/FUNDING: mention our opencollective "home" [ci skip]

Marcel Raad (23 May 2019)
- [Zenju brought this change]

  config-win32: add support for if_nametoindex and getsockname
  
  Closes https://github.com/curl/curl/pull/3923

Jay Satiro (23 May 2019)
- tests: Fix the line endings for the SASL alt-auth tests
  
  - Change data and protocol sections to CRLF line endings.
  
  Prior to this change the tests would fail or hang, which is because
  certain sections such as protocol require CRLF line endings.
  
  Follow-up to a9499ff from today which added the tests.
  
  Ref: https://github.com/curl/curl/pull/3790

Daniel Stenberg (23 May 2019)
- url: fix bad #ifdef
  
  Regression since e91e48161235272ff485.
  
  Reported-by: Tom Greenslade
  Fixes #3924
  Closes #3925

- Revert "progress: CURL_DISABLE_PROGRESS_METER"
  
  This reverts commit 3b06e68b7734cb10a555f9d7e804dd5d808236a4.
  
  Clearly this change wasn't good enough as it broke CURLOPT_LOW_SPEED_LIMIT +
  CURLOPT_LOW_SPEED_TIME
  
  Reported-by: Dave Reisner
  
  Fixes #3927
  Closes #3928

Steve Holme (22 May 2019)
- examples: Added SASL PLAIN authorisation identity (authzid) examples

- curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool

- sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  
  Added the ability for the calling program to specify the authorisation
  identity (authzid), the identity to act as, in addition to the
  authentication identity (authcid) and password when using SASL PLAIN
  authentication.
  
  Fixed #3653
  Closes #3790

Marc Hoersken (22 May 2019)
- tests: add support to test against OpenSSH for Windows
  
  Testing against OpenSSH for Windows requires v7.7.0.0 or newer
  due to the use of AllowUsers and DenyUsers. For more info see:
  https://github.com/PowerShell/Win32-OpenSSH/wiki/sshd_config

Daniel Stenberg (22 May 2019)
- bump: start on the next release

Marcel Raad (22 May 2019)
- examples: fix "clarify calculation precedence" warnings
  
  Closes https://github.com/curl/curl/pull/3919

- hiperfifo: remove unused variable
  
  Closes https://github.com/curl/curl/pull/3919

- examples: remove dead variable stores
  
  Closes https://github.com/curl/curl/pull/3919

- examples: reduce variable scopes
  
  Closes https://github.com/curl/curl/pull/3919

- http2-download: fix format specifier
  
  Closes https://github.com/curl/curl/pull/3919

Daniel Stenberg (22 May 2019)
- PolarSSL: deprecate support step 1. Removed from configure.
  
  Also removed mentions from most docs.
  
  Discussed: https://curl.haxx.se/mail/lib-2019-05/0045.html
  
  Closes #3888

- configure/cmake: check for if_nametoindex()
  
  - adds the check to cmake
  
  - fixes the configure check to work for cross-compiled windows builds
  
  Closes #3917

- parse_proxy: use the IPv6 zone id if given
  
  If the proxy string is given as an IPv6 numerical address with a zone
  id, make sure to use that for the connect to the proxy.
  
  Reported-by: Edmond Yu
  
  Fixes #3482
  Closes #3918

Version 7.65.0 (22 May 2019)

Daniel Stenberg (22 May 2019)
- RELEASE-NOTES: 7.65.0 release

- THANKS: from the 7.65.0 release-notes

- url: convert the zone id from a IPv6 URL to correct scope id
  
  Reported-by: GitYuanQu on github
  Fixes #3902
  Closes #3914

- configure: detect getsockname and getpeername on windows too
  
  Made detection macros for these two functions in the same style as other
  functions possibly in winsock in the hope this will work better to
  detect these functions when cross-compiling for Windows.
  
  Follow-up to e91e4816123
  
  Fixes #3913
  Closes #3915

Marcel Raad (21 May 2019)
- examples: remove unused variables
  
  Fixes Codacy/CppCheck warnings.
  
  Closes

Daniel Gustafsson (21 May 2019)
- udpateconninfo: mark variable unused
  
  When compiling without getpeername() or getsockname(), the sockfd
  paramter to Curl_udpateconninfo() became unused after commit e91e481612
  added ifdef guards.
  
  Closes #3910
  Fixes https://curl.haxx.se/dev/log.cgi?id=20190520172441-32196
  Reviewed-by: Marcel Raad, Daniel Stenberg

- ftp: move ftp_ccc in under featureflag
  
  Commit e91e48161235272ff485ff32bd048c53af731f43 moved ftp_ccc in under
  the FTP featureflag in the UserDefined struct, but vtls callsites were
  still using it unprotected.
  
  Closes #3912
  Fixes: https://curl.haxx.se/dev/log.cgi?id=20190520044705-29865
  Reviewed-by: Daniel Stenberg, Marcel Raad

Daniel Stenberg (20 May 2019)
- curl: report error for "--no-" on non-boolean options
  
  Reported-by: Olen Andoni
  Fixes #3906
  Closes #3907

- [Guy Poizat brought this change]

  mbedtls: enable use of EC keys
  
  Closes #3892

- lib1560: add tests for parsing URL with too long scheme
  
  Ref: #3905

- [Omar Ramadan brought this change]

  urlapi: increase supported scheme length to 40 bytes
  
  The longest currently registered URI scheme at IANA is 36 bytes long.
  
  Closes #3905
  Closes #3900

Marcel Raad (20 May 2019)
- lib: reduce variable scopes
  
  Fixes Codacy/CppCheck warnings.
  
  Closes https://github.com/curl/curl/pull/3872

- tool_formparse: remove redundant assignment
  
  Just initialize word_begin with the correct value.
  
  Closes https://github.com/curl/curl/pull/3873

- ssh: move variable declaration to where it's used
  
  This way, we need only one call to free.
  
  Closes https://github.com/curl/curl/pull/3873

- ssh-libssh: remove unused variable
  
  sock was only used to be assigned to fd_read.
  
  Closes https://github.com/curl/curl/pull/3873

Daniel Stenberg (20 May 2019)
- test332: verify the blksize fix

- tftp: use the current blksize for recvfrom()
  
  bug: https://curl.haxx.se/docs/CVE-2019-5436.html
  Reported-by: l00p3r on hackerone
  CVE-2019-5436

Daniel Gustafsson (19 May 2019)
- version: make ssl_version buffer match for multi_ssl
  
  When running a multi TLS backend build the version string needs more
  buffer space. Make the internal ssl_buffer stack buffer match the one
  in Curl_multissl_version() to allow for the longer string. For single
  TLS backend builds there is no use in extended to buffer. This is a
  fallout from #3863 which fixes up the multi_ssl string generation to
  avoid a buffer overflow when the buffer is too small.
  
  Closes #3875
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Steve Holme (18 May 2019)
- http_ntlm_wb: Handle auth for only a single request
  
  Currently when the server responds with 401 on NTLM authenticated
  connection (re-used) we consider it to have failed.  However this is
  legitimate and may happen when for example IIS is set configured to
  'authPersistSingleRequest' or when the request goes thru a proxy (with
  'via' header).
  
  Implemented by imploying an additional state once a connection is
  re-used to indicate that if we receive 401 we need to restart
  authentication.
  
  Missed in fe6049f0.

- http_ntlm_wb: Cleanup handshake after clean NTLM failure
  
  Missed in 50b87c4e.

- http_ntlm_wb: Return the correct error on receiving an empty auth message
  
  Missed in fe20826b as it wasn't implemented in http.c in b4d6db83.
  
  Closes #3894

Daniel Stenberg (18 May 2019)
- curl: make code work with protocol-disabled libcurl
  
  Closes #3844

- libcurl: #ifdef away more code for disabled features/protocols

- progress: CURL_DISABLE_PROGRESS_METER

- hostip: CURL_DISABLE_SHUFFLE_DNS

- netrc: CURL_DISABLE_NETRC

Viktor Szakats (16 May 2019)
- docs: Markdown and misc improvements [ci skip]
  
  Approved-by: Daniel Stenberg
  Closes #3896

- docs/RELEASE-PROCEDURE: link to live iCalendar [ci skip]
  
  Ref: https://github.com/curl/curl/commit/0af41b40b2c7bd379b2251cbe7cd618e21fa0ea1#commitcomment-33563135
  Approved-by: Daniel Stenberg
  Closes #3895

Daniel Stenberg (16 May 2019)
- travis: add an osx http-only build
  
  Closes #3887

- cleanup: remove FIXME and TODO comments
  
  They serve very little purpose and mostly just add noise. Most of them
  have been around for a very long time. I read them all before removing
  or rephrasing them.
  
  Ref: #3876
  Closes #3883

- curl: don't set FTP options for FTP-disabled builds
  
  ... since libcurl has started to be totally unaware of options for
  disabled protocols they now return error.
  
  Bug: https://github.com/curl/curl/commit/c9c5304dd4747cbe75d2f24be85920d572fcb5b8#commitcomment-33533937
  
  Reported-by: Marcel Raad
  Closes #3886

Steve Holme (16 May 2019)
- http_ntlm_wb: Move the type-2 message processing into a dedicated function
  
  This brings the code inline with the other HTTP authentication mechanisms.
  
  Closes #3890

Daniel Stenberg (15 May 2019)
- RELEASE-NOTES: synced

- docs/RELEASE-PROCEDURE: updated coming releases dates [ci skip]

- CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE [ci skip]
  
  Reported-by: Roy Bellingan
  Bug: #3885

- parse_proxy: use the URL parser API
  
  As we treat a given proxy as a URL we should use the unified URL parser
  to extract the parts out of it.
  
  Closes #3878

Steve Holme (15 May 2019)
- http_negotiate: Move the Negotiate state out of the negotiatedata structure
  
  Given that this member variable is not used by the SASL based protocols
  there is no need to have it here.
  
  Closes #3882

- http_ntlm: Move the NTLM state out of the ntlmdata structure
  
  Given that this member variable is not used by the SASL based protocols
  there is no need to have it here.

- url: Move the negotiate state type into a dedicated enum

- url: Remove duplicate clean up of the winbind variables in conn_shutdown()
  
  Given that Curl_disconnect() calls Curl_http_auth_cleanup_ntlm() prior
  to calling conn_shutdown() and it in turn performs this, there is no
  need to perform the same action in conn_shutdown().
  
  Closes #3881

Daniel Stenberg (14 May 2019)
- urlapi: require a non-zero host name length when parsing URL
  
  Updated test 1560 to verify.
  
  Closes #3880

- configure: error out if OpenSSL wasn't detected when asked for
  
  If --with-ssl is used and configure still couldn't enable SSL this
  creates an error instead of just silently ignoring the fact.
  
  Suggested-by: Isaiah Norton
  Fixes #3824
  Closes #3830

Daniel Gustafsson (14 May 2019)
- imap: Fix typo in comment

Steve Holme (14 May 2019)
- url: Remove unnecessary initialisation from allocate_conn()
  
  No need to set variables to zero as calloc() does this for us.
  
  Closes #3879

Daniel Stenberg (14 May 2019)
- CURLOPT_CAINFO.3: with Schannel, you want Windows 8 or later [ci skip]
  
  Clues-provided-by: Jay Satiro
  Clues-provided-by: Jeroen Ooms
  Fixes #3711
  Closes #3874

Daniel Gustafsson (13 May 2019)
- vtls: fix potential ssl_buffer stack overflow
  
  In Curl_multissl_version() it was possible to overflow the passed in
  buffer if the generated version string exceeded the size of the buffer.
  Fix by inverting the logic, and also make sure to not exceed the local
  buffer during the string generation.
  
  Closes #3863
  Reported-by: nevv on HackerOne/curl
  Reviewed-by: Jay Satiro
  Reviewed-by: Daniel Stenberg

Daniel Stenberg (13 May 2019)
- RELEASE-NOTES: synced

- appveyor: also build "/ci" branches like travis

- pingpong: disable more when no pingpong enabled

- proxy: acknowledge DISABLE_PROXY more

- parsedate: CURL_DISABLE_PARSEDATE

- sasl: only enable if there's a protocol enabled using it

- mime: acknowledge CURL_DISABLE_MIME

- wildcard: disable from build when FTP isn't present

- http: CURL_DISABLE_HTTP_AUTH

- base64: build conditionally if there are users

- doh: CURL_DISABLE_DOH

Steve Holme (12 May 2019)
- auth: Rename the various authentication clean up functions
  
  For consistency and to a avoid confusion.
  
  Closes #3869

Daniel Stenberg (12 May 2019)
- [Jay Satiro brought this change]

  docs/INSTALL: fix broken link [ci skip]
  
  Reported-by: Joombalaya on github
  Fixes #3818

Marcel Raad (12 May 2019)
- easy: fix another "clarify calculation precedence" warning
  
  I missed this one in commit 6b3dde7fe62ea5a557fd1fd323fac2bcd0c2e9be.

- build: fix "clarify calculation precedence" warnings
  
  Codacy/CppCheck warns about this. Consistently use parentheses as we
  already do in some places to silence the warning.
  
  Closes https://github.com/curl/curl/pull/3866

- cmake: restore C89 compatibility of CurlTests.c
  
  I broke it in d1b5cf830bfe169745721b21245d2217d2c2453e and
  97de97daefc2ed084c91eff34af2426f2e55e134.
  
  Reported-by: Viktor Szakats
  Ref: https://github.com/curl/curl/commit/97de97daefc2ed084c91eff34af2426f2e55e134#commitcomment-33499044
  Closes https://github.com/curl/curl/pull/3868

Steve Holme (11 May 2019)
- http_ntlm: Corrected the name of the include guard
  
  Missed in f0bdd72c.
  
  Closes #3867

- http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  
  Closes #3861

- http_negotiate: Don't expose functions when HTTP is disabled

Daniel Stenberg (11 May 2019)
- SECURITY-PROCESS: fix links [ci skip]

Marcel Raad (11 May 2019)
- CMake: suppress unused variable warnings
  
  I missed these in commit d1b5cf830bfe169745721b21245d2217d2c2453e.

Daniel Stenberg (11 May 2019)
- doh: disable DOH for the cases it doesn't work
  
  Due to limitations in Curl_resolver_wait_resolv(), it doesn't work for
  DOH resolves. This fix disables DOH for those.
  
  Limitation added to KNOWN_BUGS.
  
  Fixes #3850
  Closes #3857

Jay Satiro (11 May 2019)
- checksrc.bat: Ignore snprintf warnings in docs/examples
  
  .. because we allow snprintf use in docs/examples.
  
  Closes https://github.com/curl/curl/pull/3862

Steve Holme (10 May 2019)
- vauth: Fix incorrect function description for Curl_auth_user_contains_domain()
  
  ...and misalignment of these comments. From a78c61a4.
  
  Closes #3860

Jay Satiro (10 May 2019)
- Revert "multi: support verbose conncache closure handle"
  
  This reverts commit b0972bc.
  
  - No longer show verbose output for the conncache closure handle.
  
  The offending commit was added so that the conncache closure handle
  would inherit verbose mode from the user's easy handle. (Note there is
  no way for the user to set options for the closure handle which is why
  that was necessary.) Other debug settings such as the debug function
  were not also inherited since we determined that could lead to crashes
  if the user's per-handle private data was used on an unexpected handle.
  
  The reporter here says he has a debug function to capture the verbose
  output, and does not expect or want any output to stderr; however
  because the conncache closure handle does not inherit the debug function
  the verbose output for that handle does go to stderr.
  
  There are other plausible scenarios as well such as the user redirects
  stderr on their handle, which is also not inherited since it could lead
  to crashes when used on an unexpected handle.
  
  Short of allowing the user to set options for the conncache closure
  handle I don't think there's much we can safely do except no longer
  inherit the verbose setting.
  
  Bug: https://curl.haxx.se/mail/lib-2019-05/0021.html
  Reported-by: Kristoffer Gleditsch
  
  Ref: https://github.com/curl/curl/pull/3598
  Ref: https://github.com/curl/curl/pull/3618
  
  Closes https://github.com/curl/curl/pull/3856

Steve Holme (10 May 2019)
- ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup()
  
  From 6012fa5a.
  
  Closes #3858

Daniel Stenberg (9 May 2019)
- BUG-BOUNTY: minor formatting fixes [ci skip]

- RELEASE-NOTES: synced

- BUG-BOUNTY.md: add the Dropbox "bonus" extra payout ability [ci skip]
  
  Closes #3839

Kamil Dudka (9 May 2019)
- http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  
  Fixes #3726
  Closes #3849

- spnego_gssapi: fix return code on gss_init_sec_context() failure
  
  Fixes #3726
  Closes #3849

Steve Holme (9 May 2019)
- gen_resp_file.bat: Removed unnecessary @ from all but the first command
  
  There is need to use @ on every command once echo has been turned off.
  
  Closes #3854

Jay Satiro (8 May 2019)
- http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  
  - Do not switch to HTTP/2 for an HTTP proxy that is not tunnelling to
    the destination host.
  
  We already do something similar for HTTPS proxies by not sending h2. [1]
  
  Prior to this change setting CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE would
  incorrectly use HTTP/2 to talk to the proxy, which is not something we
  support (yet?). Also it's debatable whether or not that setting should
  apply to HTTP/2 proxies.
  
  [1]: https://github.com/curl/curl/commit/17c5d05
  
  Bug: https://github.com/curl/curl/issues/3570
  Bug: https://github.com/curl/curl/issues/3832
  
  Closes https://github.com/curl/curl/pull/3853

Marcel Raad (8 May 2019)
- travis: update mesalink build to xenial
  
  Closes https://github.com/curl/curl/pull/3842

Daniel Stenberg (8 May 2019)
- [Ricky Leverence brought this change]

  OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  
  Older versions of OpenSSL report FIPS availabilty via an OPENSSL_FIPS
  define. It uses this define to determine whether to publish -fips at
  the end of the version displayed. Applications that utilize the version
  reported by OpenSSL will see a mismatch if they compare it to what curl
  reports, as curl is not modifying the version in the same way. This
  change simply adds a check to see if OPENSSL_FIPS is defined, and will
  alter the reported version to match what OpenSSL itself provides. This
  only appears to be applicable in versions of OpenSSL <1.1.1
  
  Closes #3771

Kamil Dudka (7 May 2019)
- [Frank Gevaerts brought this change]

  nss: allow fifos and character devices for certificates.
  
  Currently you can do things like --cert <(cat ./cert.crt) with (at least) the
  openssl backend, but that doesn't work for nss because is_file rejects fifos.
  
  I don't actually know if this is sufficient, nss might do things internally
  (like seeking back) that make this not work, so actual testing is needed.
  
  Closes #3807

Daniel Gustafsson (6 May 2019)
- test2100: Fix typos in test description

Daniel Stenberg (6 May 2019)
- ssh: define USE_SSH if SSH is enabled (any backend)
