                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.72.0 (19 Aug 2020)

Daniel Stenberg (19 Aug 2020)
- RELEASE-NOTES: synced
  
  The curl 7.72.0 release

- THANKS: add names from curl 7.72.0 release

Jay Satiro (18 Aug 2020)
- KNOWN_BUGS: Schannel TLS 1.2 handshake bug in old Windows versions
  
  Reported-by: plujon@users.noreply.github.com
  
  Closes https://github.com/curl/curl/issues/5488

Daniel Stenberg (17 Aug 2020)
- Curl_easy: remember last connection by id, not by pointer
  
  CVE-2020-8231
  
  Bug: https://curl.haxx.se/docs/CVE-2020-8231.html
  
  Reported-by: Marc Aldorasi
  Closes #5824

- examples/rtsp.c: correct the copyright year

- RELEASE-PROCEDURE.md: add more future release dates

- [H3RSKO brought this change]

  docs: change "web site" to "website"
  
  According to wikipedia:
  
   While "web site" was the original spelling, this variant has become
   rarely used, and "website" has become the standard spelling
  
  Closes #5822

- [Bevan Weiss brought this change]

  CMake: don't complain about missing nroff
  
  The curl_nroff_check() was always being called, and complaining if
  *NROFF wasn't found, even when not making the manual.
  
  Only check for nroff (and complain) if actually making the manual
  
  Closes #5817

- [Brian Inglis brought this change]

  libtest/Makefile.am: add -no-undefined for libstubgss for Cygwin
  
  copy the LDFLAGS approach for adding same option with `libhostname` in
  `libtest/Makefile.am`:
  
  - init `libstubgss_la_LDFLAGS_EXTRA` variable,
  - add option to variable inside conditional,
  - use variable in `libstubgss_la_LDFLAGS`
  
  Fixes #5819
  Closes #5820

- docs: clarify MAX_SEND/RECV_SPEED functionality
  
  ... in particular what happens if the maximum speed limit is set to a
  value that's smaller than the transfer buffer size in use.
  
  Reported-by: Tomas Berger
  Fixes #5788
  Closes #5813

- test1140: compare stdout
  
  To make problems more immediately obvious when tests fail.
  
  Closes #5814

- asyn-ares: correct some bad comments
  
  Closes #5812

- [Emil Engler brought this change]

  docs: Add video link to docs/CONTRIBUTE.md
  
  Closes #5811

- curl-config: ignore REQUIRE_LIB_DEPS in --libs output
  
  Fixes a curl-config issue on cygwin by making sure REQUIRE_LIB_DEPS is
  not considered for the --libs output.
  
  Reported-by: ramsay-jones on github
  Assisted-by: Brian Inglis and Ken Brown
  Fixes #5793
  Closes #5808

- copyright: update/correct the year range on a few files

- scripts/copyright.pl: ignore .muse files

- [Emil Engler brought this change]

  multi: Remove 10-year old out-commented code
  
  The code hasn't been touched since 2010-08-18
  
  Closes #5805

- KNOWN_BUGS: A shared connection cache is not thread-safe
  
  Closes #4915
  Closes #5802

- CONTRIBUTE: extend git commit message description
  
  In particular how the first line works.
  
  Closes #5803

- RELEASE-NOTES: synced

- [Stefan Yohansson brought this change]

  transfer: move retrycount from connect struct to easy handle
  
  This flag was applied to the connection struct that is released on
  retry.  These changes move the retry counter into Curl_easy struct that
  lives across retries and retains the new connection.
  
  Reported-by: Cherish98 on github
  Fixes #5794
  Closes #5800

- libssh2: s/ssherr/sftperr/
  
  The debug output used ssherr instead of sftperr which not only outputs
  the wrong error code but also casues a warning on Windows.
  
  Follow-up to 7370b4e39f1
  
  Reported-by: Gisle Vanem
  Bug: https://github.com/curl/curl/commit/7370b4e39f1390e701f5b68d910c619151daf72b#r41334700
  Closes #5799

- ftp: don't do ssl_shutdown instead of ssl_close
  
  The shutdown function is for downgrading a connection from TLS to plain,
  and this is not requested here.
  
  Have ssl_close reset the TLS connection state.
  
  This partially reverts commit f002c850d98d
  
  Reported-by: Rasmus Melchior Jacobsen
  Reported-by: Denis Goleshchikhin
  Fixes #5797

Marc Hoersken (9 Aug 2020)
- CI/azure: fix test outcome values and use latest API version
  
  This makes sure that tests ignored or skipped are not shown
  just in the category "Other", but with their correct state.
  
  Closes #5796

- CI/azure: show runtime stats to investigate slowness
  
  Also avoid naming conflict of TFLAGS env and tflags variables.
  
  Closes #5776

Daniel Stenberg (8 Aug 2020)
- TLS naming: fix more Winssl and Darwinssl leftovers
  
  The CMake option is now called CMAKE_USE_SCHANNEL
  
  The winbuild flag is USE_SCHANNEL
  
  The CI jobs and build scripts only use the new names and the new name
  options
  
  Tests now require 'Schannel' (when necessary)
  
  Closes #5795

- smtp_parse_address: handle blank input string properly
  
  Closes #5792

- runtests: run the DICT server on a random port number
  
  Removed support for -b (base port number)
  
  Closes #5783

- RELEASE-NOTES: synced

- runtests: move the TELNET server to a dynamic port
  
  Rename the port variable to TELNETPORT to better match the existing
  pattern.
  
  Closes #5785

- ngtcp2: adapt to error code rename
  
  Closes #5786

- runtests: move the smbserver to use a dynamic port number
  
  Closes #5782

- runtests: run the http2 tests on a random port number
  
  Closes #5779

- gtls: survive not being able to get name/issuer
  
  Closes #5778

- runtests: move the gnutls-serv tests to a dynamic port
  
  Affects test 320, 321, 322 and 324.
  
  Closes #5778

- runtests: support dynamicly base64 encoded sections in tests
  
  This allows us to make test cases to use base64 at run-time and still
  use and verify information determined at run-time, such as the IMAP test
  server's port number in test 842.
  
  This change makes 12 tests run again that basically never ran since we
  moved to dynamic port numbers.
  
  ftpserver.pl is adjusted to load test instructions and test number from
  the preprocessed test file.
  
  FILEFORMAT.md now documents the new base64 encoding syntax.
  
  Reported-by: Marcel Raad
  Fixes #5761
  Closes #5775

- curl.1: add a few missing valid exit codes
  
  93 - 96 can be returned as well.
  
  Closes #5777

- TODO: Use multiple parallel transfers for a single download
  
  Closes #5774

- TODO: Set the modification date on an uploaded file
  
  Closes #5768

- [Thomas M. DuBuisson brought this change]

  CI: Add muse CI config
  
  Closes #5772

- [Thomas M. DuBuisson brought this change]

  travis/script.sh: fix use of `-n' with unquoted envvar
  
  Shellcheck tells us "-n doesn't work with unquoted arguments. quote or
  use [[ ]]."
  
  And testing shows:
  
  ```
  docker run --rm -it ubuntu bash
  root@fe85ce156856:/# [ -n $DOES_NOT_EXIST ] && echo "I ran"
  I ran
  root@fe85ce156856:/# [ -n "$DOES_NOT_EXIST" ] && echo "I ran"
  root@fe85ce156856:/#
  ```
  
  Closes #5773

- h2: repair trailer handling
  
  The previous h2 trailer fix in 54a2b63 was wrong and caused a
  regression: it cannot deal with trailers immediately when read since
  they may be read off the connection by the wrong 'data' owner.
  
  This change reverts the logic back to gathering all trailers into a
  single buffer, like before 54a2b63.
  
  Reported-by: Tadej Vengust
  Fixes #5663
  Closes #5769

Viktor Szakats (3 Aug 2020)
- windows: disable Unix Sockets for old mingw
  
  Classic mingw and 10y+ old versions of mingw-w64 don't ship with
  Windows headers having the typedef necessary for Unix Sockets
  support, so try detecting these environments to disable this
  feature.
  
  Ref: https://sourceforge.net/p/mingw-w64/mingw-w64/ci/cf6afc57179a5910621215f8f4037d406892072c/
  
  Reviewed-by: Daniel Stenberg
  
  Fixes #5674
  Closes #5758

Marcel Raad (3 Aug 2020)
- test1908: treat file as text
  
  Fixes the line endings on Windows.
  
  Closes https://github.com/curl/curl/pull/5767

- TrackMemory tests: ignore realloc and free in getenv.c
  
  These are only called for WIN32.
  
  Closes https://github.com/curl/curl/pull/5767

Daniel Stenberg (3 Aug 2020)
- tests/FILEFORMAT.md: mention %HTTP2PORT

- RELEASE-NOTES: synced

- tlsv1.3.d. only for TLS-using connections
  
  ... and rephrase that "not all" TLS backends support it.
  
  Closes #5764

- tls-max.d: this option is only for TLS-using connections
  
  Ref: #5763
  Closes #5764

Marcel Raad (2 Aug 2020)
- [Cameron Cawley brought this change]

  tool_doswin: Simplify Windows version detection
  
  Closes https://github.com/curl/curl/pull/5754

- [Cameron Cawley brought this change]

  win32: Add Curl_verify_windows_version() to curlx
  
  Closes https://github.com/curl/curl/pull/5754

- runtests.pl: treat LibreSSL and BoringSSL as OpenSSL
  
  This makes the tests that require the OpenSSL feature also run for
  those two compatible libraries.
  
  Closes https://github.com/curl/curl/pull/5762

Daniel Stenberg (1 Aug 2020)
- multi: Condition 'extrawait' is always true
  
  Reported by Codacy.
  
  Reviewed-by: Marcel Raad
  Closes #5759

Marcel Raad (1 Aug 2020)
- openssl: fix build with LibreSSL < 2.9.1
  
  `SSL_CTX_add0_chain_cert` and `SSL_CTX_clear_chain_certs` were
  introduced in LibreSSL 2.9.1 [0].
  
  [0] https://github.com/libressl-portable/openbsd/commit/0db809ee178457c8170abfae3931d7bd13abf3ef
  
  Closes https://github.com/curl/curl/pull/5757

Daniel Stenberg (1 Aug 2020)
- [Marc Aldorasi brought this change]

  multi_remove_handle: close unused connect-only connections
  
  Previously any connect-only connections in a multi handle would be kept
  alive until the multi handle was closed.  Since these connections cannot
  be re-used, they can be marked for closure when the associated easy
  handle is removed from the multi handle.
  
  Closes #5749

- checksrc: invoke script with -D to find .checksrc proper
  
  Without the -D command line option, checksrc.pl won't know which
  directory to load the ".checksrc" file from when building out of the
  source tree.
  
  Reported-by: Marcel Raad
  Fixes #5715
  Closes #5755

- [Carlo Marcelo Arenas Belón brought this change]

  buildconf: retire ares buildconf invocation
  
  no longer needed after 4259d2df7dd95637a4b1e3fb174fe5e5aef81069

- [Carlo Marcelo Arenas Belón brought this change]

  buildconf: excempt defunct reference to ACLOCAL_FLAGS
  
  retired with 09f278121e815028adb24d228d8092fc6cb022aa but kept around as
  the name is generic enough that it might be in use and relied upon from
  the environment.

- [Carlo Marcelo Arenas Belón brought this change]

  buildconf: avoid array concatenation in die()
  
  reported as error SC2145[1] by shellcheck, but not expected to cause
  any behavioural differences otherwise.
  
  [1] https://github.com/koalaman/shellcheck/wiki/SC2145
  
  Closes #5701

- travis: add ppc64le and s390x builds
  
  Closes #5752

Marc Hoersken (31 Jul 2020)
- connect: remove redundant message about connect failure
  
  Reviewed-by: Daniel Stenberg
  
  Closes #5708

- tests/sshserver.pl: fix compatibility with OpenSSH for Windows
  
  Follow up to #5721

- CI/azure: install libssh2 for use with msys2-based builds
  
  This enables building and running the SFTP tests.
  Unfortunately OpenSSH for Windows does not support SCP (yet).
  
  Reviewed-by: Daniel Stenberg
  
  Closes #5721

- CI/azure: increase Windows job timeout once again
  
  Avoid aborted jobs due to performance issues on Azure DevOps.
  
  Reviewed-by: Daniel Stenberg
  Reviewed-by: Jay Satiro
  
  Closes #5738

Jay Satiro (30 Jul 2020)
- TODO: Schannel: 'Add option to allow abrupt server closure'
  
  We should offer an option to allow abrupt server closures (server closes
  SSL transfer without sending a known termination point such as length of
  transfer or close_notify alert). Abrupt server closures are usually
  because of misconfigured or very old servers.
  
  Closes https://github.com/curl/curl/issues/4427

- url: fix CURLU and location following
  
  Prior to this change if the user set a URL handle (CURLOPT_CURLU) it was
  incorrectly used for the location follow, resulting in infinite requests
  to the original location.
  
  Reported-by: sspiri@users.noreply.github.com
  
  Fixes https://github.com/curl/curl/issues/5709
  Closes https://github.com/curl/curl/pull/5713

Daniel Stenberg (30 Jul 2020)
- RELEASE-NOTES: synced

- [divinity76 brought this change]

  docs: add date of 7.20 to CURLM_CALL_MULTI_PERFORM mentions
  
  it helps make it obvious that most developers don't have to care about
  the CURLM_CALL_MULTI_PERFORM value (last release using it is nearly 11
  years old, November 4 2009)
  
  Closes #5744

Jay Satiro (29 Jul 2020)
- tool_cb_wrt: fix outfile mode flags for Windows
  
  - Use S_IREAD and S_IWRITE mode permission flags to create the file
    on Windows instead of S_IRUSR, S_IWUSR, etc.
  
  Windows only accepts a combination of S_IREAD and S_IWRITE. It does not
  acknowledge other combinations, for which it may generate an assertion.
  
  This is a follow-up to 81b4e99 from yesterday, which improved the
  existing file check with -J.
  
  Ref: https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/open-wopen#remarks
  Ref: https://github.com/curl/curl/pull/5731
  
  Closes https://github.com/curl/curl/pull/5742

Daniel Stenberg (28 Jul 2020)
- checksrc: ban gmtime/localtime
  
  They're not thread-safe so they should not be used in libcurl code.
  
  Explictly enabled when deemed necessary and in examples and tests
  
  Reviewed-by: Nicolas Sterchele
  Closes #5732

- transfer: fix data_pending for builds with both h2 and h3 enabled
  
  Closes #5734

- curl_multi_setopt: fix compiler warning "result is always false"
  
  On systems with 32 bit long the expression is always false. Avoid
  the warning.
  
  Reported-by: Gisle Vanem
  Bug: https://github.com/curl/curl/commit/61a08508f6a458fe21bbb18cd2a9bac2f039452b#commitcomment-40941232
  Closes #5736

- curl: improve the existing file check with -J
  
  Previously a file that isn't user-readable but is user-writable would
  not be properly avoided and would get overwritten.
  
  Reported-by: BrumBrum on hackerone
  Assisted-by: Jay Satiro
  Bug: https://hackerone.com/reports/926638
  Closes #5731

- [Jonathan Nieder brought this change]

  multi: update comment to say easyp list is linear
  
  Since 09b9fc900 (multi: remove 'Curl_one_easy' struct, phase 1,
  2013-08-02), the easy handle list is not circular but ends with
  ->next pointing to NULL.
  
  Reported-by: Masaya Suzuki <masayasuzuki@google.com>
  Closes #5737

- CURLOPT_NOBODY.3: fix the syntax for referring to options
  
  As test 1140 fails otherwise!
  
  Follow-up to e1bac81cc815

- ngtcp2: store address in sockaddr_storage
  
  Reported-by: Tatsuhiro Tsujikawa
  Closes #5733

- CURLOPT_NOBODY.3: clarify what setting to 0 means
  
  ... and mention that HTTP with other methods than HEAD might get a body and
  there's no option available to stop that.
  
  Closes #5729

- setopt: unset NOBODY switches to GET if still HEAD
  
  Unsetting CURLOPT_NOBODY with 0L when doing HTTP has no documented
  action but before 7.71.0 that used to switch back to GET and with this
  change (assuming the method is still set to HEAD) this behavior is
  brought back.
  
  Reported-by: causal-agent on github
  Fixes #5725
  Closes #5728

- [Ehren Bendler brought this change]

  configure: cleanup wolfssl + pkg-config conflicts when cross compiling.
  
  Also choose a different wolfSSL function to test for NTLM support.
  
  Fixes #5605
  Closes #5682

- configure: show zstd "no" in summary when built without it
  
  Reported-by: Marc Hörsken
  Fixes #5720
  Closes #5730

- quiche: handle calling disconnect twice
  
  Reported-by: lilongyan-huawei on github
  Fixes #5726
  Closes #5727

- [Nicolas Sterchele brought this change]

  getinfo: reset retry-after value in initinfo
  
  - Avoid re-using retry_after value from preceding request
  - Add libtest 3010 to verify
  
  Reported-by: joey-l-us on github
  Fixes #5661
  Closes #5672

Marcel Raad (27 Jul 2020)
- WIN32: stop forcing narrow-character API
  
  Except where the results are only used for character output.
  getenv is not touched because it's part of the public API, and having
  it return UTF-8 instead of ANSI would be a breaking change.
  
  Fixes https://github.com/curl/curl/issues/5658
  Fixes https://github.com/curl/curl/issues/5712
  Closes https://github.com/curl/curl/pull/5718

Jay Satiro (27 Jul 2020)
- [Tobias Stoeckmann brought this change]

  mprintf: Fix stack overflows
  
  Stack overflows can occur with precisions for integers and floats.
  
  Proof of concepts:
  - curl_mprintf("%d, %.*1$d", 500, 1);
  - curl_mprintf("%d, %+0500.*1$f", 500, 1);
  
  Ideally, compile with -fsanitize=address which makes this undefined
  behavior a bit more defined for debug purposes.
  
  The format strings are valid. The overflows occur due to invalid
  arguments. If these arguments are variables with contents controlled
  by an attacker, the function's stack can be corrupted.
  
  Also see CVE-2016-9586 which partially fixed the float aspect.
  
  Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
  
  Closes https://github.com/curl/curl/pull/5722

- [Tobias Stoeckmann brought this change]

  mprintf: Fix dollar string handling
  
  Verify that specified parameters are in range. If parameters are too
  large, fail early on and avoid out of boundary accesses.
  
  Also do not read behind boundaries of illegal format strings.
  
  These are defensive measures since it is expected that format strings
  are well-formed. Format strings should not be modifiable by user
  input due to possible generic format string attacks.
  
  Closes https://github.com/curl/curl/pull/5722

Daniel Stenberg (26 Jul 2020)
- ntlm: free target_info before (re-)malloc
  
  OSS-Fuzz found a way this could get called again with the pointer still
  pointing to a malloc'ed memory, leading to a leak.
  
  Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24379
  
  Closes #5724

Marcel Raad (26 Jul 2020)
- CI/macos: set minimum macOS version
  
  This enables some deprecation warnings.
  Previously, autotools defaulted to 10.8.
  
  Closes https://github.com/curl/curl/pull/5723

Daniel Stenberg (26 Jul 2020)
- RELEASE-NOTES: synced

Marcel Raad (25 Jul 2020)
- CI/macos: enable warnings as errors for CMake builds
  
  Closes https://github.com/curl/curl/pull/5716

- CMake: fix test for warning suppressions
  
  GCC doesn't warn for unknown `-Wno-` options, except if there are other
  warnings or errors [0]. This was problematic with `CURL_WERROR` as that
  warning-as-error cannot be suppressed. Notably, this always happened
  with `-Wno-pedantic-ms-format` when not targeting Windows. So test for
  the positive form of the warning instead, which should always result in
  a diagnostic if unknown.
  
  [0] https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html
  
  Closes https://github.com/curl/curl/pull/5714

Jay Satiro (23 Jul 2020)
- curl.h: update CURLINFO_LASTONE
  
  CURLINFO_LASTONE should have been updated when
  CURLINFO_EFFECTIVE_METHOD was added.
  
  Reported-by: xwxbug@users.noreply.github.com
  
  Fixes https://github.com/curl/curl/issues/5711

Marc Hoersken (22 Jul 2020)
- CI/azure: unconditionally enable warnings-as-errors with autotools
  
  Reviewed-by: Marcel Raad
  
  Follow up to #5694
  Closes #5706

Marcel Raad (21 Jul 2020)
- doh: remove redundant cast
  
  Closes https://github.com/curl/curl/pull/5704

- CI/macos: unconditionally enable warnings-as-errors with autotools
  
  Previously, warnings were only visible in the output for most jobs.
  
  Closes https://github.com/curl/curl/pull/5694

- util: silence conversion warnings
  
  timeval::tv_usec might be a 32-bit integer and timespec::tv_nsec might
  be a 64-bit integer. This is the case when building for recent macOS
  versions, for example. Just treat tv_usec as an int, which should
  hopefully always be sufficient on systems with
  `HAVE_CLOCK_GETTIME_MONOTONIC`.
  
  Closes https://github.com/curl/curl/pull/5695

- md(4|5): don't use deprecated macOS functions
  
  They are marked as deprecated for -mmacosx-version-min >= 10.15,
  which might result in warnings-as-errors.
  
  Closes https://github.com/curl/curl/pull/5695

Daniel Stenberg (18 Jul 2020)
- strdup: remove the odd strlen check
  
  It confuses code analyzers with its use of -1 for unsigned value. Also,
  a check that's not normally used in strdup() code - and not necessary.
  
  Closes #5697

- [Alessandro Ghedini brought this change]

  travis: update quiche builds for new boringssl layout
  
  This is required after https://github.com/cloudflare/quiche/pull/593
  moved BoringSSL around slightly.
  
  This also means that Go is not needed to build BoringSSL anymore (the
  one provided by quiche anyway).
  
  Closes #5691

Marcel Raad (17 Jul 2020)
- configure: allow disabling warnings
  
  When using `--enable-warnings`, it was not possible to disable warnings
  via CFLAGS that got explicitly enabled. Now warnings are not enabled
  anymore if they are explicitly disabled (or enabled) in CFLAGS. This
  works for at least GCC, clang, and TCC as they have corresponding
  `-Wno-` options for every warning.
  
  Closes https://github.com/curl/curl/pull/5689

Daniel Stenberg (16 Jul 2020)
- ngtcp2: adjust to recent sockaddr updates
  
  Closes #5690

- page-header: provide protocol details in the curl.1 man page
  
  Add protocol and version specific information about all protocols curl
  supports.
  
  Fixes #5679
  Reported-by: tbugfinder on github
  Closes #5686

Daniel Gustafsson (16 Jul 2020)
- docs: Update a few leftover mentions of DarwinSSL
  
  Commit 76a9c3c4be10b3d4d379d5b23ca76806bbae536a renamed DarwinSSL to the
  more correct/common name Secure Transport, but a few mentions in the docs
  remained.
  
  Closes #5688
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (16 Jul 2020)
- file2memory: use a define instead of -1 unsigned value
  
  ... to use the maximum value for 'size_t' when detecting integer overflow.
  Changed the limit to max/4 as already that seems unreasonably large.
  
  Codacy didn't like the previous approach.
  
  Closes #5683

- CURL_PUSH_ERROROUT: allow the push callback to fail the parent stream
  
  ... by adding support for a new dedicated return code.
  
  Suggested-by: Jonathan Cardoso
  Assisted-by: Erik Johansson
  URL: https://curl.haxx.se/mail/lib-2020-06/0099.html
  Closes #5636

- [Baruch Siach brought this change]

  nss: fix build with disabled proxy support
  
  Avoid reference to fields that do not exist when CURL_DISABLE_PROXY is
  defined.
  
  Closes #5667

- test1139: make it display the difference on test failures

- test1119: verify stdout in the test
  
  So that failures will be displayed in the terminal, as it makes test failures
  visually displayed easier and faster.
  
  Closes #5644

- curl: add %{method} to the -w variables
  
  Gets the CURLINFO_EFFECTIVE_METHOD from libcurl.
  
  Added test 1197 to verify.

- CURLINFO_EFFECTIVE_METHOD: added
  
  Provide the HTTP method that was used on the latest request, which might
  be relevant for users when there was one or more redirects involved.
  
  Closes #5511

Viktor Szakats (14 Jul 2020)
- windows: add unicode to feature list
  
  Reviewed-by: Marcel Raad
  Reviewed-by: Marc Hörsken
  
  Closes #5491

Daniel Stenberg (14 Jul 2020)
- multi: remove two checks always true
  
  Detected by Codacy
  Closes #5676

Marc Hoersken (13 Jul 2020)
- workflows: limit what branches to run CodeQL on
  
  Align CodeQL action with existing CI actions:
  - Update branch filter to avoid duplicate CI runs.
  - Shorten workflow name due to informative job name.
  
  Reviewed-by: Daniel Stenberg
  
  Closes #5660

- appveyor: collect libcurl.dll variants with prefix or suffix
  
  On some platforms libcurl is build with a platform-specific
  prefix and/or a version number suffix.
  
  Assisted-by: Jay Satiro
  
  Closes #5659

Daniel Stenberg (12 Jul 2020)
- [ihsinme brought this change]

  socks: use size_t for size variable
  
  Use the unsigned type (size_t) in the arithmetic of pointers. In this
  context, the signed type (ssize_t) is used unnecessarily.
  
  Authored-by: ihsinme on github
  Closes #5654

- RELEASE-NOTES: synced
  
  ... and bumped to 7.72.0 as the next release version number

- [Gilles Vollant brought this change]

  content_encoding: add zstd decoding support
  
  include zstd curl patch for Makefile.m32 from vszakats
  and include Add CMake support for zstd from Peter Wu
  
  Helped-by: Viktor Szakats
  Helped-by: Peter Wu
  Closes #5453

- asyn.h: remove the Curl_resolver_getsock define
  
   - not used
   - used the wrong number of arguments
   - confused the Codeacy code analyzer
  
  Closes #5647

- [Nicolas Sterchele brought this change]

  configure.ac: Sort features name in summary
  
  - Same as protocols
  
  Closes #5656

- [Matthias Naegler brought this change]

  cmake: fix windows xp build
  
  Reviewed-by: Marcel Raad
  Closes #5662

- ngtcp2: update to modified qlog callback prototype
  
  Closes #5675

- transfer: fix memory-leak with CURLOPT_CURLU in a duped handle
  
  Added test case 674 to reproduce and verify the bug report.
  
  Fixes #5665
  Reported-by: NobodyXu on github
  Closes #5673

- [Baruch Siach brought this change]

  bearssl: fix build with disabled proxy support
  
  Avoid reference to fields that do not exist when CURL_DISABLE_PROXY is
  defined.
  
  Reviewed-by: Nicolas Sterchele
  Closes #5666

- RELEASE-NOTES: synced

Jay Satiro (11 Jul 2020)
- [Carlo Marcelo Arenas Belón brought this change]

  cirrus-ci: upgrade 11-STABLE to 11.4
  
  Meant to be the last of the 11 series and so make sure that all
  other references reflect all 11 versions so they can be retired
  together later.
  
  Closes https://github.com/curl/curl/pull/5668

- [Filip Salomonsson brought this change]

  CURLINFO_CERTINFO.3: fix typo
  
  Closes https://github.com/curl/curl/pull/5655

Daniel Stenberg (4 Jul 2020)
- http2: only do the *done() cleanups for HTTP
  
  Follow-up to ef86daf4d3
  
  Closes #5650
  Fixes #5646

- [Alex Kiernan brought this change]
