                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.77.0 (26 May 2021)

Daniel Stenberg (26 May 2021)
- RELEASE-NOTES: synced

- THANKS: added contributors from 7.77.0 cycle

- copyright: update copyright year ranges to 2021

- [Radek Zajic brought this change]

  hostip: fix broken macOS/CMake/GCC builds
  
  Follow-up to 31f631a142d855f06
  
  Fixes #7128
  Closes #7129

- TODO: netrc caching and sharing
  
  URL: https://curl.se/mail/archive-2021-05/0018.html

- [Orgad Shaneh brought this change]

  setopt: streamline ssl option code
  
  Make it use the same style as the code next to it
  
  Closes #7123

- [Radek Zajic brought this change]

  lib/hostip6.c: make NAT64 address synthesis on macOS work
  
  Closes #7121

- [ejanchivdorj brought this change]

  sectransp: fix EXC_BAD_ACCESS caused by uninitialized buffer
  
  When the SecCertificateCopyCommonName function fails, it leaves
  common_name in a invalid state so CFStringCompare uses the invalid
  result, causing EXC_BAD_ACCESS.
  
  The fix is to check the return value of the function before using the
  name.
  
  Closes #7126

- [Paweł Wegner brought this change]

  CMake: add CURL_ENABLE_EXPORT_TARGET option
  
  install(EXPORT ...) causes trouble when embedding curl dependencies
  which don't provide install(EXPORT ...) targets (e.g libressl and
  nghttp2) with cmake's add_subdirectory.
  
  Reviewed-by: Jakub Zakrzewski
  Closes #7060

- [Alessandro Ghedini brought this change]

  quiche: update for network path aware API
  
  Latest version of quiche requires the application to pass the peer
  address of received packets, and it provides the address for outgoing
  packets back.
  
  Closes #7120

- [Jacob Hoffman-Andrews brought this change]

  rustls: switch read_tls and write_tls to callbacks
  
  And update to 0.6.0, including a rename from session to connection for
  many fields.
  
  Closes #7071

- [Koichi Shiraishi brought this change]

  sectransp: fix 7f4a9a9b2a49 commit about missing comma
  
  Follow-up to 7f4a9a9b2a495
  
  Closes #7119

- [Harry Sintonen brought this change]

  openssl: associate/detach the transfer from connection
  
  CVE-2021-22901
  
  Bug: https://curl.se/docs/CVE-2021-22901.html

- [Harry Sintonen brought this change]

  telnet: check sscanf() for correct number of matches
  
  CVE-2021-22898
  
  Bug: https://curl.se/docs/CVE-2021-22898.html

- schannel: don't use static to store selected ciphers
  
  CVE-2021-22897
  
  Bug: https://curl.se/docs/CVE-2021-22897.html

- docs/tests: remove freenode references

- RELEASE-NOTES: synced

- [Sergey Markelov brought this change]

  NSS: make colons, commas and spaces valid separators in cipher list
  
  Fixes #7110
  Closes #7115

- curl: include libmetalink version in --version output
  
  Closes #7112

Jay Satiro (21 May 2021)
- [Matias N. Goldberg brought this change]

  cmake: Use multithreaded compilation on VS 2008+
  
  Multithreaded compilation has been supported since at least VS 2005 and
  been robustly stable since at least VS 2008
  
  Closes https://github.com/curl/curl/pull/7109

Daniel Stenberg (21 May 2021)
- [Matias N. Goldberg brought this change]

  cmake: fix two invokes result in different curl_config.h
  
  Fixes #7100
  Closes #7101
  
  Reviewed-by: Jakub Zakrzewski
  Signed-off-by: Matias N. Goldberg <dark_sylinc@yahoo.com.ar>

- [Peng-Yu Chen brought this change]

  cmake: detect CURL_SA_FAMILY_T
  
  Fixes #7049
  Closes #7065

- [Lucas Clemente Vella brought this change]

  CURLOPT_IPRESOLVE: preventing wrong IP version from being used
  
  In some situations, it was possible that a transfer was setup to
  use an specific IP version, but due do DNS caching or connection
  reuse, it ended up using a different IP version from requested.
  
  This commit changes the effect of CURLOPT_IPRESOLVE from simply
  restricting address resolution to preventing the wrong connection
  type being used, when choosing a connection from the pool, and
  to restricting what addresses could be used when establishing
  a new connection.
  
  It is important that all addresses versions are resolved, even if
  not used in that transfer in particular, because the result is
  cached, and could be useful for a different transfer with a
  different CURLOPT_IPRESOLVE setting.
  
  Closes #6853

- [Oliver Urbann brought this change]

  AmigaOS: add functions definitions for SHA256
  
  AmiSSL replaces many functions with macros. Curl requires pointer
  to some of these functions. Thus, we have to encapsulate these macros:
  SHA256_Init, SHA256_Update, SHA256_Final, X509_INFO_free.
  
  Bug: https://github.com/jens-maus/amissl/issues/15
  Co-authored-by: Daniel Stenberg <daniel@haxx.se>
  
  Closes #7099

- test2100: make it run with and require IPv6
  
  Closes #7083

- tests/getpart: generate output URL encoded for better diffs
  
  Closes #7083

- [Ryan Beck-Buysse brought this change]

  docs/TheArtOfHttpScripting: fix markdown links
  
  extra parens cause the links to be incorrectly formatted
  and inconsistent with the rest of the document.
  
  Signed-off-by: Ryan Beck-Buysse <rbuysse@gmail.com>
  Closes #7097

- RELEASE-NOTES: synced

- [Emil Engler brought this change]

  docs: replace dots with dashes in markdown enums
  
  We use dashes instead of dots nearly everywhere except for those few
  cases. This commit addresses this issues and brings more coherency into
  it.
  
  Closes #7093

- [Emil Engler brought this change]

  docs: improve INTERNALS.md regarding getsock cb
  
  This adds the I/O prefix to indicate that those "actions" are kind-of
  related to those found in select(2) or poll(2) (reading/writing).
  
  It also adds a note where the prototypes of those functions can be found
  in the source code.
  
  Closes #7092

- [Emil Engler brought this change]

  docs: document attach in INTERNALS.md
  
  The new field in the Curl_handler struct still lacks documentation. This
  adds it it from the information extracted from lib/urldata.h:797
  
  Closes #7091

- [Marc Aldorasi brought this change]

  config: remove now-unused macros
  
  Closes #7094

- [Marc Aldorasi brought this change]

  hostip.h: remove declaration of unimplemented function
  
  Closes #7094

- h3: add 'attach' callback to protocol handlers
  
  Follow-up to 0c55fbab45be
  
  Reviewed-by: Emil Engler
  Closes #7090

- wolfssl: remove SSLv3 support leftovers
  
  Closes #7088

- curl-wolfssl.m4: without custom include path, assume /usr/include
  
  ... so that we can point out the root of the OpenSSL emulation headers.
  Previously this used the '$includedir' variable which is wrong since
  that defaults to the dir where the current configure invoke will install
  the built libcurl headers: /usr/local by default.
  
  Fixes #7085
  Reported-by: Joel Jakobsson
  Closes #7087

- [Joel Depooter brought this change]

  data_pending: check only SECONDARY socket for FTP(S) transfers
  
  Check the FIRST for all other protocols.
  
  This fixes a timeout in an ftps download. The server sends a TLS
  close_notify message in the same packet as the file data. The
  close_notify seems to not be handled in the schannel_recv function, so
  libcurl is not aware that the server has closed the connection. Thus
  libcurl ends up waiting for action on the socket until a timeout is
  reached. With the secondary socket check added to the data_pending
  function, the close_notify is properly handled, and the ftps transfer
  terminates as expected.
  
  Fixes #7068
  Closes #7069

- github: inhibit deprecated declarations for clang on macOS
  
  ... as they otherwise cause ldap build errors in the CI.
  
  Fixes #7081
  Closes #7082

- conn: add 'attach' to protocol handler, make libssh2 use it
  
  The libssh2 backend has SSH session associated with the connection but
  the callback context is the easy handle, so when a connection gets
  attached to a transfer, the protocol handler now allows for a custom
  function to get used to set things up correctly.
  
  Reported-by: Michael O'Farrell
  Fixes #6898
  Closes #7078

- http2: make sure pause is done on HTTP
  
  Since the function is called for any protocol, we can't assume that the
  HTTP struct is there without first making sure it is HTTP.
  
  Reported-by: Denis Goleshchikhin
  Fixes #7079
  Closes #7080

- docs: cookies from HTTP headers need domain set
  
  ... or the cookies won't get sent. Push users to using the "Netscape"
  format instead, which curl uses when saving a cookie "jar".
  
  Reported-by: Martin Dorey
  Reviewed-by: Daniel Gustafsson
  Fixes #6723
  Closes #7077

- RELEASE-NOTES: synced

- github: add a workflow with libssh2 on macOS using cmake
  
  Closes #7047

- sws: allow HTTP requests up to 2MB in size
  
  To allow tests with slightly larger payloads. Like #7071 ...
  
  Closes #7075

Marc Hoersken (16 May 2021)
- CI/azure: increase verbosity and fix outdated task names
  
  Closes #7063

- CI/cirrus: add shared and static Windows release builds
  
  Azure Pipelines is currently being used for debug builds,
  let's also run some non-debug (release) Windows builds and
  make use of previously underutilized Cirrus CI for that.
  
  Reviewed-by: Marcel Raad
  
  Closes #6991

Daniel Stenberg (16 May 2021)
- CURLOPT_CAPATH.3: defaults to a path, not NULL
  
  Reported-by: Andrew Barnert
  
  Closes #7062

- [Jacob Hoffman-Andrews brought this change]

  c-hyper: handle body on HYPER_TASK_EMPTY
  
  Some of the time, we get a HYPER_TASK_EMPTY response before the status
  line, headers, and body have been read. Previously, that would cause us
  to poll again, leading to a 1 second timeout.
  
  The HYPER_TASK_EMPTY docs say:
  
     The value of this task is null (does not imply an error).
  
  So, if we receive a HYPER_TASK_EMPTY, continue on with processing the
  response.
  
  Reported-by: Kevin Burke
  Fixes #7064
  Closes #7070

- [Ikko Ashimine brought this change]

  tool_getparam: fix comment typo in tool_getparam.c
  
  enfore -> enforce
  
  Closes #7074

- mem-include-scan.pl: require a non-word letter before memory funcs
  
  ... so that ldap_memfree() for example doesn't match the scan for free.
  
  Closes #7061

- version: free the openldap info correctly
  
  ... to avoid memory leaks.
  
  Follow-up to: bf0feae7768d9
  Closes #7061

- dupset: remove totally off comment
  
  Closes #7067

- configure: if asked for, fail if ldap is not found
  
  Reported-by: Jakub Zakrzewski
  Fixes #7053
  Closes #7055

- version: add OpenLDAP version in the output
  
  Assisted-by: Howard Chu
  Closes #7054

Jay Satiro (13 May 2021)
- [Joel Depooter brought this change]

  schannel: Ensure the security context request flags are always set
  
  As of commit 54e7475, these flags would only be set when using a new
  credential handle. When re-using an existing credential handle, the
  flags would not be set.
  
  Closes https://github.com/curl/curl/pull/7051

Dan Fandrich (12 May 2021)
- tests: Fix some tag matching issues in a number of tests

Daniel Stenberg (12 May 2021)
- sasl: use 'unsigned short' to store mechanism
  
  ... saves a few bytes of struct size in memory and it only uses
  10 bits anyway.
  
  Closes #7045

- hostip: remove the debug code for LocalHost
  
  The Curl_resolv() had special code (when built in debug mode) for when
  resolving the host name "LocalHost" (using that exact casing). It would
  then get the host name from the --interface option instead.
  
  This development-only feature was not used by anything (anymore) and we
  have the --resolve feature if we want to play similar tricks properly
  going forward.
  
  Closes #7044

- progress: reset limit_size variables at transfer start
  
  Otherwise the old value would linger from a previous use and would mess
  up the network speed cap logic.
  
  Reported-by: Ymir1711 on github
  
  Fixes #7042
  Closes #7043

- RELEASE-NOTES: synced

- [Daniel Gustafsson brought this change]

  cookies: use CURLcode for cookie_output reporting
  
  Writing the cookie file has multiple error conditions, and was using an
  int with magic numbers to report the different error (which in turn were
  disregarded anyways). This moves reporting to use a CURLcode value.
  
  Lightly-touched-by: Daniel Stenberg
  
  Closes #7037
  Closes #6749

- [Daniel Gustafsson brought this change]

  cookies: make use of string duplication function
  
  strstore() is defined as a strdup which ensures to free the target
  pointer before duping the source char * into it. Make use of it in
  two more cases where it can simplify the code.

- [Daniel Gustafsson brought this change]

  cookies: refactor comments
  
  Comments in the cookie code were a bit all over the place in terms of
  style and wording. This takes a stab at cleaning them up by keeping to
  a single style and overall shape. Some comments are moved a little and
  some removed alltogether due to being redundant. No functional changes
  have been made,

- [Peng-Yu Chen brought this change]

  http2: skip immediate parsing of payload following protocol switch
  
  This is considered not harmful as a following http2_recv shall be
  called very soon.
  
  This is considered helpful in the specific situation where some
  servers (e.g. nghttpx v1.43.0) may fulfill stream 1 immediately
  following the return of HTTP status 101, other than waiting for
  the client-side connection preface to arrive.
  
  Fixes #7036
  Closes #7040

- [Peng-Yu Chen brought this change]

  http2: use nghttp2_session_upgrade2 instead of nghttp2_session_upgrade
  
  Following the upstream deprecation of nghttp2_session_upgrade.
  
  Also provides further checks for requests with the HEAD method.
  
  Closes #7041

- progress/trspeed: use a local convenient pointer to beautify code
  
  The function becomes easier to read and understand with less repetition.

- trspeed: use long double for transfer speed calculation

- progress: move transfer speed calc into function
  
  This silences two scan-build-11 warnings: "The result of the '/'
  expression is undefined"
  
  Bug: https://curl.se/mail/lib-2021-05/0022.html
  Closes #7035

- [Cameron Cawley brought this change]

  openssl: remove unneeded cast for CertOpenSystemStore()
  
  Closes #7025

- travis: disable the libssh build
  
  It can't run on focal and causes warnings on bionic. Since the focal
  failure started rather suddenly a while ago, we can suspect it might be
  temporary.
  
  Added "bring back the build" to the TODO document.
  
  Fixes #7011
  Closes #7012

- [Peng-Yu Chen brought this change]

  http: use calculated offsets inst of integer literals for header parsing
  
  Assumed to be a minor coding style improvement with no behavior change.
  
  A modern compiler is expected to have the calculation optimized during
  compilation. It may be deemed okay even if that's not the case, since
  the added overhead is considered very low.
  
  Closes #7032

- [Peng-Yu Chen brought this change]

  GIT-INFO: suggest using autoreconf instead of buildconf
  
  Follow-up to 85868537d
  
  Closes #7033

- http: deal with partial CONNECT sends
  
  Also added 'CURL_SMALLSENDS' to make Curl_write() send short packets,
  which helped verifying this even more.
  
  Add test 363 to verify.
  
  Reported-by: ustcqidi on github
  Fixes #6950
  Closes #7024

- HTTP3: make the ngtcp2 build use the quictls fork
  
  ... as ngtcp2 itself documents the build this way.
  
  Closes #7031

- http: limit the initial send amount to used upload buffer size
  
  Previously this logic would cap the send to CURL_MAX_WRITE_SIZE bytes,
  but for the situations where a larger upload buffer has been set, this
  function can benefit from sending more bytes. With default size used,
  this does the same as before.
  
  Also changed the storage of the size to an 'unsigned int' as it is not
  allowed to be set larger than 2M.
  
  Also added cautions to the man pages about changing buffer sizes in
  run-time.
  
  Closes #7022

- RELEASE-NOTES: synced

- ngtcp2: fix the cb_acked_stream_data_offset proto
  
  The 'datalen' value should be 64 bit, not size_t!
  
  Reported-by: Dmitry Karpov
  Bug: https://curl.se/mail/lib-2021-05/0019.html
  Closes #7027

- progress: when possible, calculate transfer speeds with microseconds
  
  ... this improves precision, especially for transfers in the few or even
  sub millisecond range.
  
  Reported-by: J. Bromley
  Fixes #7017
  Closes #7020

- http: reset the header buffer when sending the request
  
  A reused transfer handle could otherwise reuse the previous leftover
  buffer and havoc would ensue.
  
  Reported-by: sergio-nsk on github
  Fixes #7018
  Closes #7021

- curl_mprintf.3: add description
  
  These functions have existed in the API since the dawn of time. It is
  about time we describe how they work, even if we discourage users from
  using them.
  
  Closes #7010

- [Timothy Gu brought this change]

  URL-SYNTAX: update IDNA section for WHATWG spec changes
  
  WHATWG URL has dictated the use of Nontransitional Processing (IDNA
  2008) for several years now. Chrome (and derivatives) still use
  Transitional Processing, but Firefox and Safari have both switched.
  
  Also document the fact that winidn functions differently from libidn2
  here.
  
  Closes #7026

- [Calvin Buckley brought this change]

  INSTALL: add IBM i specific quirks
  
  Fixes #6830
  Closes #7013

- libcurl.3: mention the URL API
  
  To make it easier to find. Also a minor polish of libcurl-url.3
  
  Closes #7009

- GnuTLS: don't allow TLS 1.3 for versions that don't support it
  
  Follow-up to 781864bedbc5
  
  ... as they don't understand it and will return error at us!
  
  Closes #7014

Kamil Dudka (6 May 2021)
- tool_getparam: handle failure of curlx_convert_tchar_to_UTF8()
  
  Reported by GCC analyzer:
  
  Error: GCC_ANALYZER_WARNING (CWE-476):
  src/tool_getparam.c: scope_hint: In function 'parse_args'
  src/tool_getparam.c:2318:38: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL 'orig_opt'
  lib/curlx.h:56: included_from: Included from here.
  src/tool_getparam.c:28: included_from: Included from here.
  lib/curl_multibyte.h:70:51: note: in definition of macro 'curlx_convert_tchar_to_UTF8'
  src/tool_getparam.c:2316:16: note: in expansion of macro 'curlx_convert_tchar_to_UTF8'
  
  Reviewed-by: Marcel Raad
  Reviewed-by: Daniel Stenberg
  Closes #7023

Daniel Stenberg (6 May 2021)
- scripts/delta: also show total number of days

Marc Hoersken (5 May 2021)
- sockfilt: fix invalid increment of handles index variable nfd
  
  Only increment the array index if we actually stored a handle.
  
  Follow up to e917492048f4b85a0fd58a033d10072fc7666c3b
  Closes #6992

- sockfilt: avoid getting stuck waiting for writable socket
  
  Reset FD_WRITE event using the same approach as in multi.c
  
  Follow up to b36442b24305f3cda7c13cc64b46838995a4985b
  Closes #6992

Jay Satiro (5 May 2021)
- test678: Fix for Windows multibyte builds
  
  Follow-up to 77fc385 from yesterday.
  
  Bug: https://github.com/curl/curl/pull/6662#issuecomment-832966557
  Reported-by: Marc Hörsken

- [Dmitry Kostjuchenko brought this change]

  build: fix compilation for Windows UWP platform
  
  - Include afunix.h which is necessary for sockaddr_un when
    USE_UNIX_SOCKETS is defined on Windows.
  
  Closes https://github.com/curl/curl/pull/7006

Daniel Stenberg (5 May 2021)
- gnutls: make setting only the MAX TLS allowed version work
  
  Previously, settting only the max allowed TLS version, leaving the
  minimum one at default, didn't actually set it and left it to default
  (TLS 1.3) too!
  
  As a bonus, this change also removes the dead code handling of SSLv3
  since that version can't be set anymore (since eff614fb0242cb).
  
  Reported-by: Daniel Carpenter
  Fixes #6998
  Closes #7000

- openldap: replace ldap_ prefix on private functions
  
  Since openldap itself uses that prefix and with OpenĹDAP 2.5.4 (at
  least) there's a symbol collision because of that.
  
  The private functions now use the 'oldap_' prefix where it previously
  used 'ldap_'.
  
  Reported-by: 3eka on github
  Fixes #7004
  Closes #7005

Jay Satiro (5 May 2021)
- http2: fix potentially uninitialized variable
  
  introduced several days ago in 3193170. caught by visual studio linker.

- [Gilles Vollant brought this change]

  SSL: support in-memory CA certs for some backends
  
  - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to
    specify in-memory PEM certificates for OpenSSL, Schannel (Windows)
    and Secure Transport (Apple) SSL backends.
  
  Prior to this change PEM certificates could only be imported from a file
  and not from memory.
  
  Co-authored-by: moparisthebest@users.noreply.github.com
  
  Ref: https://github.com/curl/curl/pull/4679
  Ref: https://github.com/curl/curl/pull/5677
  Ref: https://github.com/curl/curl/pull/6109
  
  Closes https://github.com/curl/curl/pull/6662

Daniel Stenberg (4 May 2021)
- [David Cook brought this change]

  tests: ignore case of chunked hex numbers in tests
  
  When hyper is used, it emits uppercase hexadecimal numbers for chunked
  encoding lengths. Without hyper, lowercase hexadecimal numbers are used.
  This change adds preprocessor statements to tests where this is an
  issue, and adapts the fixtures to match.
  
  Closes #6987

- cmake: check for getppid and utimes
  
  ... as they're checked for in the configure script and are used by
  source code.
  
  Removed checks for perror, setvbuf and strlcat since those defines are
  not checked for in source code.
  
  Bonus: removed HAVE_STRLCPY from a few config-*.h files since that
  symbol is not used in source code.
  
  Closes #6997

- libtest: remove lib530.c
  
  Follow up from e50a877df when test 530 was removed. Since then this
  source file has not been used/needed.
  
  Closes #6999

- FILEFORMAT: mention sectransp as a feature
  
  Been supported since at least 40259ca65
  
  Closes #7001

- RELEASE-NOTES: synced

- libssh2: ignore timeout during disconnect
  
  ... to avoid memory leaks!
  
  libssh2 is tricky as we have to deal with the non-blockiness even in
  close and shutdown cases. In the cases when we shutdown after a timeout
  already expired, it is crucial that curl doen't let the timeout abort
  the shutdown process as that then leaks memory!
  
  Reported-by: Benjamin Riefenstahl
  Fixes #6990

- KNOWN_BUGS: add two HTTP/2 bugs

- KNOWN_BUGS: add three HTTP/3 issues
  
  ... and moved the HTTP/2 issues to its own section
  
  Closes #6606
  Closes #6510
  Closes #6494

- [ejanchivdorj brought this change]

  CURLcode: add CURLE_SSL_CLIENTCERT
  
  When a TLS server requests a client certificate during handshake and
  none can be provided, libcurl now returns this new error code
  CURLE_SSL_CLIENTCERT
  
  Only supported by Secure Transport and OpenSSL for TLS 1.3 so far.
  
  Closes #6721

- [Tobias Gabriel brought this change]

  .github/FUNDING: add link to GitHub sponsors
  
  Closes #6985

- [Harry Sintonen brought this change]

  krb5/name_to_level: replace checkprefix with curl_strequal
  
  Closes #6993

- [Harry Sintonen brought this change]

  Curl_input_digest: require space after Digest
  
  Closes #6993

- [Harry Sintonen brought this change]

  Curl_http_header: check for colon when matching Persistent-Auth
  
  Closes #6993

- [Harry Sintonen brought this change]

  Curl_http_input_auth: require valid separator after negotiation type
  
  Closes #6993

- http: fix the check for 'Authorization' with Bearer
  
  The code would wrongly check for it using an additional colon.
  
  Reported-by: Blake Burkhart
  Closes #6988

- [Kamil Dudka brought this change]

  http2: fix a resource leak in push_promise()
  
  ... detected by Coverity:
  
  Error: RESOURCE_LEAK (CWE-772):
  lib/http2.c:532: alloc_fn: Storage is returned from allocation function "duphandle".
  lib/http2.c:532: var_assign: Assigning: "newhandle" = storage returned from "duphandle(data)".
  lib/http2.c:552: noescape: Resource "newhandle" is not freed or pointed-to in "set_transfer_url".
  lib/http2.c:555: leaked_storage: Variable "newhandle" going out of scope leaks the storage it points to.
  
  Closes #6986

- [Kamil Dudka brought this change]

  http2: fix resource leaks in set_transfer_url()
  
  ... detected by Coverity:
  
  Error: RESOURCE_LEAK (CWE-772):
  lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
  lib/http2.c:486: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:488: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
  
  Error: RESOURCE_LEAK (CWE-772):
  lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
  lib/http2.c:493: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:495: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
  
  Error: RESOURCE_LEAK (CWE-772):
  lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
  lib/http2.c:500: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:502: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
  
  Error: RESOURCE_LEAK (CWE-772):
  lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()".
  lib/http2.c:505: noescape: Resource "u" is not freed or pointed-to in "curl_url_get". [Note: The source code implementation of the function has been overridden by a builtin model.]
  lib/http2.c:507: leaked_storage: Variable "u" going out of scope leaks the storage it points to.
  
  Closes #6986

- [Jacob Hoffman-Andrews brought this change]

  rustls: use ALPN
  
  Update required rustls to 0.5.0
  
  Closes #6960

- [MAntoniak brought this change]

  gskit: fix CURL_DISABLE_PROXY build
  
  Removed localfd and remotefd from ssl_backend_data (ued only with proxy
  connection). Function pipe_ssloverssl return always 0, when proxy is not
  used.
  
  Closes #6981

- [MAntoniak brought this change]

  gskit: fix undefined reference to 'conn'
  
  Closes #6980

- [Jacob Hoffman-Andrews brought this change]

  tls: add USE_HTTP2 define
  
  This abstracts across the two HTTP/2 backends: nghttp2 and Hyper.
  
  Add our own define for the "h2" ALPN protocol, so TLS backends can use
  it without depending on a specific HTTP backend.
  
  Closes #6959

- [Jacob Hoffman-Andrews brought this change]

  lib: fix 0-length Curl_client_write calls
  
  Closes #6954

- [Jacob Hoffman-Andrews brought this change]

  lib: remove strlen call from Curl_client_write
  
  At all call sites with an explicit 0 len, pass an appropriate nonzero
  len.
  
  Closes #6954

- [Ayushman Singh Chauhan brought this change]

  docs: camelcase it like GitHub everywhere
  
  Closes #6979

Jay Satiro (27 Apr 2021)
- [Lucas Servén Marín brought this change]

  docs: fix typo in fail-with-body doc
  
  This commit fixes a small typo in the documentation for the
  --fail-with-body flag.
