                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.67.0 (5 Nov 2019)

Daniel Stenberg (5 Nov 2019)
- RELEASE-NOTES: synced
  
  The 7.67.0 release

- THANKS: add new names from 7.67.0

- configure: only say ipv6 enabled when the variable is set
  
  Previously it could say "IPv6: enabled" at the end of the configure run
  but the define wasn't set because of a missing getaddrinfo().
  
  Reported-by: Marcel Raad
  Fixes #4555
  Closes #4560

Marcel Raad (2 Nov 2019)
- certs/Server-localhost-lastSAN-sv: regenerate with sha256
  
  All other certificates were regenerated in commit ba782baac30, but
  this one was missed.
  Fixes test3001 on modern systems.
  
  Closes https://github.com/curl/curl/pull/4551

Daniel Stenberg (2 Nov 2019)
- [Vilhelm Prytz brought this change]

  copyrights: update all copyright notices to 2019 on files changed this year
  
  Closes #4547

- [Bastien Bouclet brought this change]

  mbedtls: add error message for cert validity starting in the future
  
  Closes #4552

Jay Satiro (1 Nov 2019)
- schannel_verify: Fix concurrent openings of CA file
  
  - Open the CA file using FILE_SHARE_READ mode so that others can read
    from it as well.
  
  Prior to this change our schannel code opened the CA file without
  sharing which meant concurrent openings (eg an attempt from another
  thread or process) would fail during the time it was open without
  sharing, which in curl's case would cause error:
  "schannel: failed to open CA file".
  
  Bug: https://curl.haxx.se/mail/lib-2019-10/0104.html
  Reported-by: Richard Alcock

Daniel Stenberg (31 Oct 2019)
- gtls: make gnutls_bye() not wait for response on shutdown
  
  ... as it can make it wait there for a long time for no good purpose.
  
  Patched-by: Jay Satiro
  Reported-by: Bylon2 on github
  Adviced-by: Nikos Mavrogiannopoulos
  
  Fixes #4487
  Closes #4541

- [Michał Janiszewski brought this change]

  appveyor: publish artifacts on appveyor
  
  This allows obtaining upstream builds of curl directly from appveyor for
  all the available configurations
  
  Closes #4509

- url: make Curl_close() NULLify the pointer too
  
  This is the common pattern used in the code and by a unified approach we
  avoid mistakes.
  
  Closes #4534

- [Trivikram Kamat brought this change]

  INSTALL: add missing space for configure commands
  
  Closes #4539

- url: Curl_free_request_state() should also free doh handles
  
  ... or risk DoH memory leaks.
  
  Reported-by: Paul Dreik
  Fixes #4463
  Closes #4527

- examples: remove the "this exact code has not been verified"
  
  ... as really confuses the reader to not know what to believe!

- [Trivikram Kamat brought this change]

  HTTP3: fix typo somehere1 > somewhere1
  
  Closes #4535

Jay Satiro (28 Oct 2019)
- [Javier Blazquez brought this change]

  HTTP3: fix invalid use of sendto for connected UDP socket
  
  On macOS/BSD, trying to call sendto on a connected UDP socket fails
  with a EISCONN error. Because the singleipconnect has already called
  connect on the socket when we're trying to use it for QUIC transfers
  we need to use plain send instead.
  
  Fixes #4529
  Closes https://github.com/curl/curl/pull/4533

Daniel Stenberg (28 Oct 2019)
- RELEASE-NOTES: synced

- [Javier Blazquez brought this change]

  HTTP3: fix Windows build
  
  The ngtcp2 QUIC backend was using the MSG_DONTWAIT flag for send/recv
  in order to perform nonblocking operations. On Windows this flag does
  not exist. Instead, the socket must be set to nonblocking mode via
  ioctlsocket.
  
  This change sets the nonblocking flag on UDP sockets used for QUIC on
  all platforms so the use of MSG_DONTWAIT is not needed.
  
  Fixes #4531
  Closes #4532

Marcel Raad (27 Oct 2019)
- appveyor: add --disable-proxy autotools build
  
  This would have caught issue #3926.
  
  Also make formatting more consistent.
  
  Closes https://github.com/curl/curl/pull/4526

Daniel Stenberg (25 Oct 2019)
- appveyor: make winbuilds with DEBUG=no/yes and VS 2015/2017
  
  ... and invoke "curl -V" once done
  
  Co-Authored-By: Jay Satiro
  
  Closes #4523

- [Francois Rivard brought this change]

  schannel: reverse the order of certinfo insertions
  
  Fixes #4518
  Closes #4519

Marcel Raad (24 Oct 2019)
- test1591: fix spelling of http feature
  
  The test never got run because the feature name is `http` in lowercase.
  
  Closes https://github.com/curl/curl/pull/4520

Daniel Stenberg (23 Oct 2019)
- [Michał Janiszewski brought this change]

  appveyor: Use two parallel compilation on appveyor with CMake
  
  Appveyor provides 2 CPUs for each builder[1], make sure to use parallel
  compilation, when running with CMake. CMake learned this new option in
  version 3.12[2] and the version provided by appveyor is fresh enough.
  
  Curl doesn't really take that long to build and it is using the slowest
  builder available, msbuild, so expect only a moderate improvement in
  build times.
  
  [1] https://www.appveyor.com/docs/build-environment/
  [2] https://cmake.org/cmake/help/v3.12/release/3.12.html
  
  Closes #4508

- conn-reuse: requests wanting NTLM can reuse non-NTLM connections
  
  Added test case 338 to verify.
  
  Reported-by: Daniel Silverstone
  Fixes #4499
  Closes #4514

Marcel Raad (23 Oct 2019)
- tests: add missing proxy features

Daniel Stenberg (22 Oct 2019)
- RELEASE-NOTES: synced

Marcel Raad (21 Oct 2019)
- tests: use %FILE_PWD for file:// URLs
  
  This way, we always have exactly one slash after the host name, making
  the tests pass when curl is compiled with the MSYS GCC.
  
  Closes https://github.com/curl/curl/pull/4512

- tests: add `connect to non-listen` keywords
  
  These tests try to connect to ports nothing is listening on.
  
  Closes https://github.com/curl/curl/pull/4511

- runtests: get textaware info from curl instead of perl
  
  The MSYS system on Windows can run the test suite for curl built with
  any toolset. When built with the MSYS GCC, curl uses Unix line endings,
  while it uses Windows line endings when built with the MinGW GCC, and
  `^O` reports 'msys' in both cases. Use the curl executable itself to
  determine the line endings instead, which reports 'x86_64-pc-msys' when
  built with the MSYS GCC.
  
  Closes https://github.com/curl/curl/pull/4506

Daniel Stenberg (20 Oct 2019)
- [Michał Janiszewski brought this change]

  appveyor: Add MSVC ARM64 build
  
  Closes #4507

- http2_recv: a closed stream trumps pause state
  
  ... and thus should return 0, not EAGAIN.
  
  Reported-by: Tom van der Woerdt
  Fixes #4496
  Closes #4505

- http2: expire a timeout at end of stream
  
  To make sure that transfer is being dealt with. Streams without
  Content-Length need a final read to notice the end-of-stream state.
  
  Reported-by: Tom van der Woerdt
  Fixes #4496

Dan Fandrich (18 Oct 2019)
- travis: Add an ARM64 build
  
  Test 323 is failing for some reason, so disable it there for now.

Marcel Raad (18 Oct 2019)
- examples/sslbackend: fix -Wchar-subscripts warning
  
  With the `isdigit` implementation that comes with MSYS2, the argument
  is used as an array subscript, resulting in a -Wchar-subscripts
  warning. `isdigit`'s behavior is undefined if the argument is negative
  and not EOF [0]. As done in lib/curl_ctype.h, cast the `char` variable
  to `unsigned char` to avoid that.
  
  [0] https://en.cppreference.com/w/c/string/byte/isdigit
  
  Closes https://github.com/curl/curl/pull/4503

Daniel Stenberg (18 Oct 2019)
- configure: remove all cyassl references
  
  In particular, this removes the case where configure would find an old
  cyall installation rather than a wolfssl one if present. The library is
  named wolfssl in modern days so there's no real need to keep support for
  the former.
  
  Reported-by: Jacob Barthelmeh
  Closes #4502

Marcel Raad (17 Oct 2019)
- test1162: disable MSYS2's POSIX path conversion
  
  This avoids MSYS2 converting the backslasb in the URL to a slash,
  causing the test to fail.

Daniel Stenberg (17 Oct 2019)
- RELEASE-NOTES: synced

Jay Satiro (16 Oct 2019)
- CURLOPT_TIMEOUT.3: Clarify transfer timeout time includes queue time
  
  Prior to this change some users did not understand that the "request"
  starts when the handle is added to the multi handle, or probably they
  did not understand that some of those transfers may be queued and that
  time is included in timeout.
  
  Reported-by: Jeroen Ooms
  
  Fixes https://github.com/curl/curl/issues/4486
  Closes https://github.com/curl/curl/pull/4489

- [Stian Soiland-Reyes brought this change]

  tool_operate: Fix retry sleep time shown to user when Retry-After
  
  - If server header Retry-After is being used for retry sleep time then
    show that value to the user instead of the normal retry sleep time.
  
  This is a follow-up to 640b973 (7.66.0) which changed curl tool so that
  the value from Retry-After header overrides other retry timing options.
  
  Closes https://github.com/curl/curl/pull/4498

Daniel Stenberg (16 Oct 2019)
- url: normalize CURLINFO_EFFECTIVE_URL
  
  The URL extracted with CURLINFO_EFFECTIVE_URL was returned as given as
  input in most cases, which made it not get a scheme prefixed like before
  if the URL was given without one, and it didn't remove dotdot sequences
  etc.
  
  Added test case 1907 to verify that this now works as intended and as
  before 7.62.0.
  
  Regression introduced in 7.62.0
  
  Reported-by: Christophe Dervieux
  Fixes #4491
  Closes #4493

Marcel Raad (16 Oct 2019)
- tests: line ending fixes for Windows
  
  Mark some files as text.
  
  Closes https://github.com/curl/curl/pull/4490

- tests: use proxy feature
  
  This makes the tests succeed when using --disable-proxy.
  
  Closes https://github.com/curl/curl/pull/4488

- smbserver: fix Python 3 compatibility
  
  Python 2's `ConfigParser` module is spelled `configparser` in Python 3.
  
  Closes https://github.com/curl/curl/pull/4484

- security: silence conversion warning
  
  With MinGW-w64, `curl_socket_t` is is a 32 or 64 bit unsigned integer,
  while `read` expects a 32 bit signed integer.
  Use `sread` instead of `read` to use the correct parameter type.
  
  Closes https://github.com/curl/curl/pull/4483

- connect: silence sign-compare warning
  
  With MinGW-w64 using WinSock, `curl_socklen_t` is signed, while the
  result of `sizeof` is unsigned.
  
  Closes https://github.com/curl/curl/pull/4483

Daniel Stenberg (13 Oct 2019)
- TODO: Handle growing SFTP files
  
  Closes #4344

- KNOWN_BUGS: remove "CURLFORM_CONTENTLEN in an array"
  
  The curl_formadd() function is deprecated and shouldn't be used so the
  real fix for applications is to switch to the curl_mime_* API.

- KNOWN_BUGS: "LDAP on Windows does authentication wrong"
  
  Closes #3116

- appveyor: add a winbuild that uses VS2017
  
  Closes #4482

- [Harry Sintonen brought this change]

  socketpair: fix include and define for older TCP header systems
  
  fixed build for systems that need netinet/in.h for IPPROTO_TCP and are
  missing INADDR_LOOPBACK
  
  Closes #4480

- socketpair: fix double-close in error case
  
  Follow-up to bc2dbef0afc08

- gskit: use the generic Curl_socketpair

- asyn-thread: make use of Curl_socketpair() where available

- socketpair: an implemention for Windows and more
  
  Curl_socketpair() is designed to be used and work everywhere if there's
  no native version or the native version isn't good enough.
  
  Closes #4466

- RELEASE-NOTES: synced

- connect: return CURLE_OPERATION_TIMEDOUT for errno == ETIMEDOUT
  
  Previosly all connect() failures would return CURLE_COULDNT_CONNECT, no
  matter what errno said.
  
  This makes for example --retry work on these transfer failures.
  
  Reported-by: Nathaniel J. Smith
  Fixes #4461
  Clsoes #4462

- cirrus: switch off blackhole status on the freebsd CI machines

- tests: use port 2 instead of 60000 for a safer non-listening port
  
  ... when the tests want "connection refused".

- KNOWN_BUGS: IDN tests failing on Windows
  
  Closes #3747

Dan Fandrich (9 Oct 2019)
- cirrus: Increase the git clone depth.
  
  If more commits are submitted to master between the time of triggering
  the first Cirrus build and the time the final build gets started, the
  desired commit is no longer at HEAD and the build will error out.
  [skip ci]

Daniel Stenberg (9 Oct 2019)
- docs: make sure the --no-progress-meter docs file is in dist too

- docs: document it as --no-progress-meter instead of the reverse
  
  Follow-up to 93373a960c3bb4
  
  Reported-by: infinnovation-dev on github
  Fixes #4474
  Closes #4475

Dan Fandrich (9 Oct 2019)
- cirrus: Switch the FreeBSD 11.x build to 11.3 and add a 13.0 build.
  
  Also, select the images using image_family to get the latest snapshots
  automatically.
  [skip ci]

Daniel Stenberg (8 Oct 2019)
- curl: --no-progress-meter
  
  New option that allows a user to ONLY switch off curl's progress meter
  and leave everything else in "talkative" mode.
  
  Reported-by: Piotr Komborski
  Fixes #4422
  Closes #4470

- TODO: Consult %APPDATA% also for .netrc
  
  Closes #4016

- CURLOPT_TIMEOUT.3: remove the mention of "minutes"
  
  ... just say that limiting operations risk aborting otherwise fine
  working transfers. If that means seconds, minutes or hours, we leave to
  the user.
  
  Reported-by: Martin Gartner
  Closes #4469

- [Andrei Valeriu BICA brought this change]

  docs: added multi-event.c example
  
  Similar to multi-uv.c but using libevent 2. This is a simpler libevent
  integration example then hiperfifo.c.
  
  Closes #4471

Jay Satiro (5 Oct 2019)
- [Nicolas brought this change]

  ldap: fix OOM error on missing query string
  
  - Allow missing queries, don't return NO_MEMORY error in such a case.
  
  It is acceptable for there to be no specified query string, for example:
  
  curl ldap://ldap.forumsys.com
  
  A regression bug in 1b443a7 caused this issue.
  
  This is a partial fix for #4261.
  
  Bug: https://github.com/curl/curl/issues/4261#issuecomment-525543077
  Reported-by: Jojojov@users.noreply.github.com
  Analyzed-by: Samuel Surtees
  
  Closes https://github.com/curl/curl/pull/4467

- [Paul B. Omta brought this change]

  build: Remove unused HAVE_LIBSSL and HAVE_LIBCRYPTO defines
  
  Closes https://github.com/curl/curl/pull/4460

Daniel Stenberg (5 Oct 2019)
- RELEASE-NOTES: synced

- [Stian Soiland-Reyes brought this change]

  curl: ensure HTTP 429 triggers --retry
  
  This completes #3794.
  
  Also make sure the new tests from #4195 are enabled
  
  Closes #4465

Marcel Raad (4 Oct 2019)
- [apique brought this change]

  winbuild: add ENABLE_UNICODE option
  
  Fixes https://github.com/curl/curl/issues/4308
  Closes https://github.com/curl/curl/pull/4309

Daniel Stenberg (4 Oct 2019)
- ngtcp2: adapt to API change
  
  Closes #4457

- cookies: change argument type for Curl_flush_cookies
  
  The second argument is really a 'bool' so use that and pass in TRUE/FALSE
  to make it clear.
  
  Closes #4455

- http2: move state-init from creation to pre-transfer
  
  To make sure that the HTTP/2 state is initialized correctly for
  duplicated handles. It would otherwise easily generate "spurious"
  PRIORITY frames to get sent over HTTP/2 connections when duplicated easy
  handles were used.
  
  Reported-by: Daniel Silverstone
  Fixes #4303
  Closes #4442

- urlapi: fix use-after-free bug
  
  Follow-up from 2c20109a9b5d04
  
  Added test 663 to verify.
  
  Reported by OSS-Fuzz
  Bug: https://crbug.com/oss-fuzz/17954
  
  Closes #4453

- [Paul Dreik brought this change]

  cookie: avoid harmless use after free
  
  This fix removes a use after free which can be triggered by
  the internal cookie fuzzer, but otherwise is probably
  impossible to trigger from an ordinary application.
  
  The following program reproduces it:
  
          curl_global_init(CURL_GLOBAL_DEFAULT);
          CURL*  handle=curl_easy_init();
          CookieInfo* info=Curl_cookie_init(handle,NULL,NULL,false);
          curl_easy_setopt(handle, CURLOPT_COOKIEJAR, "/dev/null");
          Curl_flush_cookies(handle, true);
          Curl_cookie_cleanup(info);
          curl_easy_cleanup(handle);
          curl_global_cleanup();
  
  This was found through fuzzing.
  
  Closes #4454

- [Denis Chaplygin brought this change]

  docs: add note on failed handles not being counted by curl_multi_perform
  
  Closes #4446

- CURLMOPT_MAX_CONCURRENT_STREAMS.3: fix SEE ALSO typo

- [Niall brought this change]

  ESNI: initial build/setup
  
  Closes #4011

- RELEASE-NOTES: synced

- redirect: when following redirects to an absolute URL, URL encode it
  
  ... to make it handle for example (RFC violating) embeded spaces.
  
  Reported-by: momala454 on github
  Fixes #4445
  Closes #4447

- urlapi: fix URL encoding when setting a full URL

- tool_operate: rename functions to make more sense

- curl: create easy handles on-demand and not ahead of time
  
  This should again enable crazy-large download ranges of the style
  [1-10000000] that otherwise easily ran out of memory starting in 7.66.0
  when this new handle allocating scheme was introduced.
  
  Reported-by: Peter Sumatra
  Fixes #4393
  Closes #4438

- [Kunal Ekawde brought this change]

  CURLMOPT_MAX_CONCURRENT_STREAMS: new setopt
  
  Closes #4410

- chunked-encoding: stop hiding the CURLE_BAD_CONTENT_ENCODING error
  
  Unknown content-encoding would get returned as CURLE_WRITE_ERROR if the
  response is chunked-encoded.
  
  Reported-by: Ilya Kosarev
  Fixes #4310
  Closes #4449

Marcel Raad (1 Oct 2019)
- checksrc: fix uninitialized variable warning
  
  The loop doesn't need to be executed without a file argument.
  
  Closes https://github.com/curl/curl/pull/4444

- urlapi: fix unused variable warning
  
  `dest` is only used with `ENABLE_IPV6`.
  
  Closes https://github.com/curl/curl/pull/4444

- lib: silence conversion warnings
  
  Closes https://github.com/curl/curl/pull/4444

- AppVeyor: add 32-bit MinGW-w64 build
  
  With WinSSL and testing enabled so that it would have detected most of
  the warnings fixed in [0] and [1].
  
  [0] https://github.com/curl/curl/pull/4398
  [1] https://github.com/curl/curl/pull/4415
  
  Closes https://github.com/curl/curl/pull/4433

- AppVeyor: remove MSYS2_ARG_CONV_EXCL for winbuild
  
  It's only used for MSYS2 with MinGW.
  
  Closes

Daniel Stenberg (30 Sep 2019)
- [Emil Engler brought this change]

  git: add tests/server/disabled to .gitignore
  
  Closes #4441

- altsvc: accept quoted ma and persist values
  
  As mandated by the spec. Test 1654 is extended to verify.
  
  Closes #4443

- mailmap: a Lucas fix

Alessandro Ghedini (29 Sep 2019)
- [Lucas Pardue brought this change]

  quiche: update HTTP/3 config creation to new API

Daniel Stenberg (29 Sep 2019)
- BINDINGS: PureBasic, Net::Curl for perl and Nim

- BINDINGS: Kapito is an Erlang library, basically a binding

- BINDINGS: added clj-curl
  
  Reported-by: Lucas Severo

- [Jay Satiro brought this change]

  docs: disambiguate CURLUPART_HOST is for host name (ie no port)
  
  Closes #4424

- cookies: using a share with cookies shouldn't enable the cookie engine
  
  The 'share object' only sets the storage area for cookies. The "cookie
  engine" still needs to be enabled or activated using the normal cookie
  options.
  
  This caused the curl command line tool to accidentally use cookies
  without having been told to, since curl switched to using shared cookies
  in 7.66.0.
  
  Test 1166 verifies
  
  Updated test 506
  
  Fixes #4429
  Closes #4434

- setopt: handle ALTSVC set to NULL

- RELEASE-NOTES: synced

- [grdowns brought this change]

  INSTALL: add vcpkg installation instructions
  
  Closes #4435

- [Zenju brought this change]

  FTP: add test for FTPFILE_NOCWD: Avoid redundant CWDs
  
  Add libtest 661
  
  Closes #4417

- [Zenju brought this change]

  FTP: url-decode path before evaluation
  
  Closes #4428

Marcel Raad (27 Sep 2019)
- tests: fix narrowing conversion warnings
  
  `timediff_t` is 64 bits wide also on 32-bit systems since
  commit b1616dad8f0.
  
  Closes https://github.com/curl/curl/pull/4415

Jay Satiro (27 Sep 2019)
- [julian brought this change]

  vtls: Fix comment typo about macosx-version-min compiler flag
  
  Closes https://github.com/curl/curl/pull/4425

Daniel Stenberg (26 Sep 2019)
- [Yechiel Kalmenson brought this change]

  README: minor grammar fix
  
  Closes #4431

- [Spezifant brought this change]

  HTTP3: fix prefix parameter for ngtcp2 build
  
  Closes #4430

- quiche: don't close connection at end of stream!

- quiche: set 'drain' when returning without having drained the queues

- Revert "FTP: url-decode path before evaluation"
  
  This reverts commit 2f036a72d543e96128bd75cb0fedd88815fd42e2.

- HTTP3: merged and simplified the two 'running' sections

- HTTP3: show an --alt-svc using example too

- [Zenju brought this change]

  FTP: url-decode path before evaluation
  
  Closes #4423

- openssl: use strerror on SSL_ERROR_SYSCALL
  
  Instead of showing the somewhat nonsensical errno number, use strerror()
  to provide a more relatable error message.
  
  Closes #4411

- HTTP3: update quic.aiortc.org + add link to server list
  
  Reported-by: Jeremy Lainé

Jay Satiro (26 Sep 2019)
- url: don't set appconnect time for non-ssl/non-ssh connections
  
  Prior to this change non-ssl/non-ssh connections that were reused set
  TIMER_APPCONNECT [1]. Arguably that was incorrect since no SSL/SSH
  handshake took place.
  
  [1]: TIMER_APPCONNECT is publicly known as CURLINFO_APPCONNECT_TIME in
  libcurl and %{time_appconnect} in the curl tool. It is documented as
  "the time until the SSL/SSH handshake is completed".
  
  Reported-by: Marcel Hernandez
  
  Ref: https://github.com/curl/curl/issues/3760
  
  Closes https://github.com/curl/curl/pull/3773

Daniel Stenberg (25 Sep 2019)
- ngtcp2: remove fprintf() calls
  
  - convert some of them to H3BUF() calls to infof()
  - remove some of them completely
  - made DEBUG_HTTP3 defined only if CURLDEBUG is set for now
  
  Closes #4421

- [Jay Satiro brought this change]

  url: fix the NULL hostname compiler warning case
  
  Closes #4403

- [Jay Satiro brought this change]

  travis: move the go install to linux-only
  
  ... to repair the build again
  Closes #4403

- altsvc: correct the #ifdef for the ngtcp2 backend

- altsvc: save h3 as h3-23
  
  Follow-up to d176a2c7e5

- urlapi: question mark within fragment is still fragment
  
  The parser would check for a query part before fragment, which caused it
  to do wrong when the fragment contains a question mark.
  
  Extended test 1560 to verify.
  
  Reported-by: Alex Konev
  Fixes #4412
  Closes #4413

- [Alex Samorukov brought this change]

  HTTP3.md: move -p for mkdir, remove -j for make
  
  - mkdir on OSX/Darwin requires `-p` argument before dir
  
  - portabbly figuring out number of cores is an exercise for somewhere
    else
  
  Closes #4407

Patrick Monnerat (24 Sep 2019)
- os400: getpeername() and getsockname() return ebcdic AF_UNIX sockaddr,
  
  As libcurl now uses these 2 system functions, wrappers are needed on os400
  to convert returned AF_UNIX sockaddrs to ascii.
  
  This is a follow-up to commit 7fb54ef.
  See also #4037.
  Closes #4214

Jay Satiro (24 Sep 2019)
- [Lucas Pardue brought this change]

  strcase: fix raw lowercasing the letter X
  
  Casing mistake in Curl_raw_tolower 'X' wasn't lowercased as 'x' prior to
  this change.
  
  Follow-up to 0023fce which added the function several days ago.
  
  Ref: https://github.com/curl/curl/pull/4401#discussion_r327396546
  
  Closes https://github.com/curl/curl/pull/4408

Daniel Stenberg (23 Sep 2019)
- http2: Expression 'stream->stream_id != - 1' is always true
  
  PVS-Studio warning
  Fixes #4402

- http2: A value is being subtracted from the unsigned variable
  
  PVS-Studio warning
  Fixes #4402

- libssh: part of conditional expression is always true: !result
  
  PVS-Studio warning
  Fixed #4402

- libssh: part of conditional expression is always true
  
  PVS-Studio warning
  Fixes #4402

- libssh: The expression is excessive or contains a misprint
  
  PVS-Studio warning
  Fixes #4402

- quiche: The expression must be surrounded by parentheses
  
  PVS-Studio warning
  Fixes #4402

- vauth: The parameter 'status' must be surrounded by parentheses
  
  PVS-Studio warning
  Fixes #4402

- [Paul Dreik brought this change]

  doh: allow only http and https in debug mode
  
  Otherwise curl may be told to use for instance pop3 to
  communicate with the doh server, which most likely
  is not what you want.
  
  Found through fuzzing.
  
  Closes #4406

- [Paul Dreik brought this change]

  doh: return early if there is no time left
  
  Closes #4406

- [Barry Pollard brought this change]

  http: lowercase headernames for HTTP/2 and HTTP/3
  
  Closes #4401
  Fixes #4400

Marcel Raad (23 Sep 2019)
- vtls: fix narrowing conversion warnings
  
  Curl_timeleft returns `timediff_t`, which is 64 bits wide also on
  32-bit systems since commit b1616dad8f0.
  
  Closes https://github.com/curl/curl/pull/4398

Daniel Stenberg (23 Sep 2019)
- [Joel Depooter brought this change]

  winbuild: Add manifest to curl.exe for proper OS version detection
  
  This is a small fix to commit ebd213270a017a6830928ee2e1f4a9cabc799898
  in pull request #1221. That commit added the CURL_EMBED_MANIFEST flag to
  CURL_RC_FLAGS. However, later in the file CURL_RC_FLAGS is
  overwritten. The fix is to append values to CURL_RC_FLAGS instead of
  overwriting
  
  Closes #4399

- RELEASE-NOTES: synced

Marcel Raad (22 Sep 2019)
- openssl: fix compiler warning with LibreSSL
  
  It was already fixed for BoringSSL in commit a0f8fccb1e0.
  LibreSSL has had the second argument to SSL_CTX_set_min_proto_version
  as uint16_t ever since the function was added in [0].
