                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.79.0 (14 Sep 2021)

Daniel Stenberg (14 Sep 2021)
- RELEASE-NOTES: synced
  
  For the 7.79.0 release

- THANKS: add contributors from 7.79.0 release cycle

- FAQ: add two dev related questions
  
    8.1 Why does curl use C89?
    8.2 Will curl be rewritten?
  
  Spell-checked-by: Paul Johnson
  Closes #7715

- zuul.d/jobs: disable three tests for *-openssl-disable-proxy
  
  ... as they mysteriously seem to permfail without being related to
  proxy.
  
  Closes #7714

- [Patrick Monnerat brought this change]

  ftp,imap,pop3,smtp: reject STARTTLS server response pipelining
  
  If a server pipelines future responses within the STARTTLS response, the
  former are preserved in the pingpong cache across TLS negotiation and
  used as responses to the encrypted commands.
  
  This fix detects pipelined STARTTLS responses and rejects them with an
  error.
  
  CVE-2021-22947
  
  Bug: https://curl.se/docs/CVE-2021-22947.html

- [Patrick Monnerat brought this change]

  ftp,imap,pop3: do not ignore --ssl-reqd
  
  In imap and pop3, check if TLS is required even when capabilities
  request has failed.
  
  In ftp, ignore preauthentication (230 status of server greeting) if TLS
  is required.
  
  Bug: https://curl.se/docs/CVE-2021-22946.html
  
  CVE-2021-22946

- [z2_ on hackerone brought this change]

  mqtt: clear the leftovers pointer when sending succeeds
  
  CVE-2021-22945
  
  Bug: https://curl.se/docs/CVE-2021-22945.html

- zuul: bump the rustls job to use v0.7.2
  
  ... and add -lm when using a rust library.
  
  Closes #7701

- RELEASE-PROCEDURE: add release dates from now to 8.0.0 in 2023

- SECURITY-PROCESS: tweak a little to match current practices
  
  Closes #7713

- http_proxy: fix the User-Agent inclusion in CONNECT
  
  It should not refer to the uagent string that is allocated and created
  for the end server http request, as that pointer may be cleared on
  subsequent CONNECT requests.
  
  Added test case 1184 to verify.
  
  Reported-by: T200proX7 on github
  Fixes #7705
  Closes #7707

- Curl_hsts_loadcb: don't attempt to load if hsts wasn't inited
  
  Reported-by: Jonathan Cardoso
  Fixes #7710
  Closes #7711

- [Tatsuhiro Tsujikawa brought this change]

  ngtcp2: fix build with ngtcp2 and nghttp3
  
  ngtcp2_conn_client_new and nghttp3_conn_client_new are now macros.
  Check the wrapped functions instead.
  
  ngtcp2_stream_close callback now takes flags parameter.
  
  Closes #7709

- write-out.d: clarify size_download/upload
  
  They show the number of "body" bytes transfered.
  Fixes #7702
  Closes #7706

- http2: Curl_http2_setup needs to init stream data in all invokes
  
  Thus function was written to avoid doing multiple connection data
  initializations, which is fine, but since it also initiates stream
  related data it is crucial that it doesn't skip those even if called
  again for the same connection. Solved by moving the stream
  initializations before the "doing-it-again" check.
  
  Reported-by: Inho Oh
  Fixes #7630
  Closes #7692

- url: fix compiler warning in no-verbose builds
  
  Follow-up from 2f0bb864c12
  
  Closes #7700

- non-ascii: fix build errors from strerror fix
  
  Follow-up to 2f0bb864c12
  
  Closes #7697

- parse_args: redo the warnings for --remote-header-name combos
  
  ... to avoid the memory leak risk pointed out by scan-build.
  
  Follow-up from 7a3e981781d6c18a
  
  Closes #7698

- ngtcp2: adapt to new size defintions upstream
  
  Reviewed-by: Tatsuhiro Tsujikawa
  Closes #7699

- rustls: add strerror.h include
  
  Follow-up to 2f0bb864c12

- docs: the security list is reached at security at curl.se now
  
  Also update the FAQ section a bit to encourage users to rather submit
  security issues on hackerone than sending email.
  
  Closes #7689

Marc Hoersken (9 Sep 2021)
- runtests: add option -u to error on server unexpectedly alive
  
  Let's try to actually handle the server unexpectedly alive
  case by first making them visible on CI builds as failures.
  
  This is needed to detect issues with killing of the test
  servers completely including nested process chains with
  multiple PIDs per test server (including bash and perl).
  
  On Windows/cygwin platforms this is especially helpful with
  debugging PID mixups due to cygwin using its own PID space.
  
  Reviewed-by: Daniel Stenberg
  Closes #7180

Daniel Stenberg (9 Sep 2021)
- opts docs: unify phrasing in NAME header
  
  - avoid writing "set ..." or "enable/disable ..." or "specify ..."
    *All* options for curl_easy_setopt() are about setting or enabling
    things and most of the existing options didn't use that way of
    description.
  
  - start with lowercase letter, unless abbreviation. For consistency.
  
  - Some additional touch-ups
  
  Closes #7688

- strerror.h: remove the #include from files not using it

- lib: don't use strerror()
  
  We have and provide Curl_strerror() internally for a reason: strerror()
  is not necessarily thread-safe so we should always try to avoid it.
  
  Extended checksrc to warn for this, but feature the check disabled by
  default and only enable it in lib/
  
  Closes #7685

Daniel Gustafsson (8 Sep 2021)
- cirrus: Add FreeBSD 13.0 job and disable sanitizer build
  
  As alluded to the in the now removed comment, a 13.0 image became
  available and is now ready to be used.
  
  The sanitizer builds were running on the 12.1 image which since has
  been removed from the config, leaving the builds not running at all.
  When enabled it turns out that they don't actually work due to very
  long timeouts in executing the tests, so keep the disabled for now
  but a bit more controlled.
  
  Closes #7592

Daniel Stenberg (8 Sep 2021)
- copyrights: update copyright year ranges

- RELEASE-NOTES: synced

- INTERNALS: c-ares has a new home: c-ares.org

- docs: remove experimental mentions from HSTS and MQTT
  
  Reported-by: Jonathan Cardoso
  Bug: https://github.com/curl/curl/pull/6700#issuecomment-913792863
  Closes #7681

- [Cao ZhenXiang brought this change]

  curl: add warning for incompatible parameters usage
  
  --continue-at - and --remote-header-name are known incompatible parameters
  
  Closes #7674

- [git-bruh brought this change]

  examples/*hiperfifo.c: fix calloc arguments to match function proto
  
  Closes #7678

- INTERNALS: bump c-ares requirement to 1.16.0
  
  Since ba904db0705c93 we use ares_getaddrinfo, added in c-ares 1.16.0

- curl: stop retry if Retry-After: is longer than allowed
  
  If Retry-After: specifies a period that is longer than what fits within
  --retry-max-time, then stop retrying immediately.
  
  Added test 366 to verify.
  
  Reported-by: Kari Pahula
  Fixes #7675
  Closes #7676

- [Michał Antoniak brought this change]

  mbedtls: avoid using a large buffer on the stack
  
  Use dynamic memory allocation for the buffer used in checking "pinned
  public key". The PUB_DER_MAX_BYTES parameter with default settings is
  set to a value greater than 2kB.
  
  Co-authored-by: Daniel Stenberg
  Closes #7586

- configure: make --disable-hsts work
  
  The AC_ARG_ENABLE() macro itself uses a variable called
  'enable_[option]', so when our script also used a variable with that
  name for the purpose of storing what the user wants, it also
  accidentally made it impossible to switch off the feature with
  --disable-hsts. Fix this by renaming our variable.
  
  Reported-by: Michał Antoniak
  Fixes #7669
  Closes #7672

Jay Satiro (5 Sep 2021)
- config.d: note that curlrc is used even when --config
  
  Bug: https://github.com/curl/curl/pull/7666#issuecomment-912214751
  Reported-by: Viktor Szakats
  
  Closes https://github.com/curl/curl/pull/7667

Daniel Stenberg (4 Sep 2021)
- RELEASE-NOTES: synced

- test1173: check references to libcurl options
  
  ... that they refer to actual existing libcurl options.
  
  Reviewed-by: Daniel Gustafsson
  Closes #7656

- CURLOPT_UNIX_SOCKET_PATH.3: remove nginx reference, add see also
  
  Closes #7656

- opt-docs: verify man page sections + order
  
  In every libcurl option man page there are now 8 mandatory sections that
  must use the right name in the correct order and test 1173 verifies
  this. Only 14 man pages needed adjustments.
  
  The sections and the order is as follows:
  
   - NAME
   - SYNOPSIS
   - DESCRIPTION
   - PROTOCOLS
   - EXAMPLE
   - AVAILABILITY
   - RETURN VALUE
   - SEE ALSO
  
  Reviewed-by: Daniel Gustafsson
  Closes #7656

- opt-docs: make sure all man pages have examples
  
  Extended manpage-syntax.pl (run by test 1173) to check that every man
  page for a libcurl option has an EXAMPLE section that is more than two
  lines. Then fixed all errors it found and added examples.
  
  Reviewed-by: Daniel Gustafsson
  Closes #7656

- get.d: provide more useful examples
  
  Closes #7668

- page-header: add GOPHERS, simplify wording in the 1st para
  
  Closes #7665

- connect: get local port + ip also when reusing connections
  
  Regression. In d6a37c23a3c (7.75.0) we removed the duplicated storage
  (connection + easy handle), so this info needs be extracted again even
  for re-used connections.
  
  Add test 435 to verify
  
  Reported-by: Max Dymond
  Fixes #7660
  Closes #7662

Marcel Raad (2 Sep 2021)
- multi: fix compiler warning with `CURL_DISABLE_WAKEUP`
  
  `use_wakeup` is unused in this case.
  
  Closes https://github.com/curl/curl/pull/7661

Daniel Stenberg (1 Sep 2021)
- tests: adjust the tftpd output to work with hyper mode
  
  By making them look less like http headers, the hyper mode "tweak"
  doesn't interfere.
  
  Enable test 2002 and 2003 in hyper builds (and 1280 which is unrelated
  but should be enabled).
  
  Closes #7658

Daniel Gustafsson (1 Sep 2021)
- [Gisle Vanem brought this change]

  openssl: annotate SSL3_MT_SUPPLEMENTAL_DATA
  
  This adds support for the previously unhandled supplemental data which
  in -v output was printed like:
  
      TLSv1.2 (IN), TLS header, Unknown (23):
  
  These will now be printed with proper annotation:
  
      TLSv1.2 (OUT), TLS header, Supplemental data (23):
  
  Closes #7652
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (1 Sep 2021)
- curl.1: provide examples for each option
  
  The file format for each option now features a "Example:" header that
  can provide one or more examples that get rendered appropriately in the
  output. All options MUST have at least one example or gen.pl complains
  at build-time.
  
  This fix also does a few other minor format and consistency cleanups.
  
  Closes #7654

- progress: make trspeed avoid floats
  
  and compiler warnings for data conversions.
  
  Reported-by: Michał Antoniak
  Fixes #7645
  Closes #7653

- test365: verify response with chunked AND Content-Length headers

- http: ignore content-length if any transfer-encoding is used
  
  Fixes #7643
  Closes #7649

- RELEASE-NOTES: synced

- Revert "http2: skip immediate parsing of payload following protocol switch"
  
  This reverts commit 455a63c66f188598275e87d32de2c4e8e26b80cb.
  
  Reported-by: Tk Xiong
  Fixes #7633
  Closes #7648

- KNOWN_BUGS: HTTP/3 doesn't support client certs
  
  Closes #7625

- mailing lists: move from cool.haxx.se to lists.haxx.se

- http_proxy: only wait for writable socket while sending request
  
  Otherwise it would wait socket writability even after the entire CONNECT
  request has sent and make curl basically busy-loop while waiting for a
  response to come back.
  
  The previous fix attempt in #7484 (c27a70a591a4) was inadequate.
  
  Reported-by: zloi-user on github
  Reported-by: Oleguer Llopart
  Fixes #7589
  Closes #7647

- http: disallow >3-digit response codes
  
  Make the built-in HTTP parser behave similar to hyper and reject any
  HTTP response using more than 3 digits for the response code.
  
  Updated test 1432 accordingly.
  Enabled test 1432 in the hyper builds.
  
  Closes #7641

- [Tatsuhiro Tsujikawa brought this change]

  ngtcp2: stop buffering crypto data
  
  Stop buffering crypto data because libngtcp2 now buffers submitted
  crypto data.
  
  Closes #7637

- test1280: CRLFify the response to please hyper
  
  Closes #7639

- tests: enable test 1129 for hyper builds
  
  Closes #7638

- curl: better error message when -O fails to get a good name
  
  Due to how this currently works internally, it needs a working initial
  file name to store contents in, so it may still fail even with -J is
  used (and thus accepting a name from content-disposition:) if the file
  name part of the URL isn't "good enough".
  
  Fixes #7628
  Closes #7635

- curl_easy_setopt: tweak the string copy wording
  
  Reported-by: Yaobin Wen
  Fixes #7632
  Closes #7634

- RELEASE-NOTES: synced

- [Don J Olmstead brought this change]

  cmake: sync CURL_DISABLE options
  
  Adds the full listing of CURL_DISABLE options to the CMake build. Moves
  all option code, except for CURL_DISABLE_OPENSSL_AUTO_LOA_CONFIG which
  resides near OpenSSL configuration, to the same block of code. Also
  sorts the options here and in the cmake config header.
  
  Additionally sorted the CURL-DISABLE listing and fixed the
  CURL_DISABLE_POP3 option.
  
  Closes #7624

Jay Satiro (25 Aug 2021)
- KNOWN_BUGS: FTPS upload data loss with TLS 1.3
  
  Bug: https://github.com/curl/curl/issues/6149
  Reported-by: Bylon2@users.noreply.github.com
  
  Closes https://github.com/curl/curl/pull/7623

Daniel Stenberg (24 Aug 2021)
- cmake: avoid poll() on macOS
  
  ... like we do in configure builds. Since poll() on macOS is not
  reliable enough.
  
  Reported-by: marc-groundctl
  Fixes #7595
  Closes #7619

- c-hyper: handle HTTP/1.1 => HTTP/1.0 downgrade on reused connection
  
  Enable test 1074
  
  Closes #7617

- c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  
  Enable test 1130 and 1131
  
  Closes #7616

- [a1346054 brought this change]

  tests: be explicit about using 'python3' instead of 'python'
  
  This fixes running tests in virtualenvs (or on distros) that no longer
  have a symlink from python to python2 or python3.
  
  Closes #7602

- [a1346054 brought this change]

  scripts: invoke interpreters through /usr/bin/env
  
  Closes #7602

- DISABLED: enable 11 more tests for hyper builds
  
  Closes #7612

- setopt: enable CURLOPT_IGNORE_CONTENT_LENGTH for hyper
  
  Since this option is also used for FTP, it needs to work to set for
  applications even if hyper doesn't support it for HTTP. Verified by test
  1137.
  
  Updated docs to specify that the option doesn't work for HTTP when using
  the hyper backend.
  
  Closes #7614

- test1138: remove trailing space to make work with hyper
  
  Closes #7613

- libcurl-errors.3: clarify two CURLUcode errors
  
  CURLUE_BAD_HANDLE and CURLUE_BAD_PARTPOINTER should be for "bad" or
  wrong pointers in a generic sense, not just for NULL pointers.
  
  Reviewed-by: Jay Satiro
  
  Ref: #7605
  Closes #7611

Jay Satiro (23 Aug 2021)
- symbols-in-versions: fix CURLSSLBACKEND_QSOSSL last used version
  
  ... and also change the 'Removed' column name to 'Last' since that
  column is for the last version to contain the symbol.
  
  Closes https://github.com/curl/curl/pull/7609

Daniel Stenberg (23 Aug 2021)
- urlapi.c:seturl: assert URL instead of using if-check
  
  There's no code flow possible where this can happen. The assert makes
  sure it also won't be introduced undetected in the future.
  
  Closes #7610

- curl-openssl.m4: show correct output for OpenSSL v3
  
  Using 3.0.0 versions configure should now show this:
  
  checking for OpenSSL headers version... 3.0.0 - 0x300
  checking for OpenSSL library version... 3.0.0
  checking for OpenSSL headers and library versions matching... yes
  
  This output doesn't actually change what configure generates but is only
  "cosmetic".
  
  Reported-by: Randall S. Becker
  Fixes #7606
  Closes #7608

Jay Satiro (22 Aug 2021)
- mksymbolsmanpage.pl: Fix showing symbol's last used version
  
  Prior to this change the symbol's deprecated version was erroneously
  shown as its last used version.
  
  Bug: https://github.com/curl/curl/commit/4e53b94#commitcomment-55239509
  Reported-by: i-ky@users.noreply.github.com

Daniel Stenberg (21 Aug 2021)
- mksymbolsmanpage.pl: match symbols case insenitively
  
  Follow-up to 4e53b9430c750 which made this bug show.
  
  Reported-by: i-ky
  Bug: https://github.com/curl/curl/commit/4e53b9430c7504de8984796e2a2091ec16f27136#commitcomment-55239253
  Closes #7607

- asyn-ares: call ares_freeaddrinfo() to clean up addrinfo results
  
  As this leaks memory otherwise
  
  Follow-up to ba904db0705c931
  
  Closes #7599

- [Ehren Bendler brought this change]

  wolfssl: clean up wolfcrypt error queue
  
  If wolfSSL is built in certain ways (OPENSSL_EXTRA or Debug), the error
  queue gets added on to for each session and never freed. Fix it by
  calling ERR_clear_error() like in vtls/openssl when needed. This func is
  a no-op in wolfcrypt if the error queue is not enabled.
  
  Closes #7594

- man pages: remove trailing whitespaces
  
  Extended test 1173 (via the manpage-syntax.pl script) to detect and warn
  for them.
  
  Ref: #7602
  Reported-by: a1346054 on github
  Closes #7604

- mailmap: add Gleb Ivanovsky

- config.d: escape the backslash properly
  
  Closes #7603

- [Don J Olmstead brought this change]

  curl_setup.h: sync values for HTTP_ONLY
  
  The values for HTTP_ONLY differed between CMakeLists.txt and
  curl_setup.h. Sync them and sort the values in curl_setup.h to make it
  easier to spot differences.
  
  Closes #7601

Jay Satiro (21 Aug 2021)
- configure: set classic mingw minimum OS version to XP
  
  - If the user has not specified a minimum OS version (via WINVER or
    _WIN32_WINNT macros) then set it to Windows XP.
  
  Prior to this change classic MinGW defaulted the minimum OS version
  to Windows NT 4.0 which is way too old. At least Windows XP is needed
  for getaddrinfo (which resolves hostnames to IPv6 addresses).
  
  Ref: https://github.com/curl/curl/issues/7483#issuecomment-891597034
  
  Closes https://github.com/curl/curl/pull/7581

- schannel: Work around typo in classic mingw macro
  
  - Define ALG_CLASS_DHASH (the typo from the include) to ALG_CLASS_HASH.
  
  Prior to this change there was an incomplete fix to ignore the
  CALG_TLS1PRF macro on those versions of MinGW where it uses the
  ALG_CLASS_DHASH typoed macro.
  
  Ref: 48cf45c
  Ref: https://osdn.net/projects/mingw/ticket/38391
  Ref: https://github.com/curl/curl/issues/2924
  
  Closes https://github.com/curl/curl/pull/7580

Daniel Stenberg (20 Aug 2021)
- RELEASE-NOTES: synced

- http_proxy: fix user-agent and custom headers for CONNECT with hyper
  
  Enable test 287
  
  Closes #7598

- c-hyper: initial support for "dumping" 1xx HTTP responses
  
  With the use hyper_request_on_informational()
  
  Enable test 155 and 158
  
  Closes #7597

Marc Hoersken (18 Aug 2021)
- tests/*server.pl: flush output before executing subprocess
  
  Also avoid shell processes staying around by using exec.
  This is necessary to avoid output data being buffering
  inside the process chain of Perl, Bash/Shell and our
  test server binaries. On non-Windows systems the exec
  will also make the subprocess replace the intermediate
  shell, but on Windows it will at least bind the processes
  together since there is no real fork or exec available.
  
  See: https://cygwin.com/cygwin-ug-net/highlights.html
  and: https://docs.microsoft.com/cpp/c-runtime-library/exec-wexec-functions
  Ref: https://github.com/curl/curl/pull/7530#issuecomment-900949010
  
  Reviewed-by: Daniel Stenberg
  Reviewed-by: Jay Satiro
  Closes #7530

- CI: use GitHub Container Registry instead of Docker Hub
  
  Avoid limits on Docker Hub and improve image pull/download speed.
  
  Closes #7587

Daniel Stenberg (18 Aug 2021)
- openssl: when creating a new context, there cannot be an old one
  
  Remove the previous handling that would call SSL_CTX_free(), and instead
  add an assert that halts a debug build if there ever is a context
  already set at this point.
  
  Closes #7585

Jay Satiro (18 Aug 2021)
- KNOWN_BUGS: Renegotiate from server may cause hang for OpenSSL backend
  
  Closes https://github.com/curl/curl/issues/6785

Viktor Szakats (17 Aug 2021)
- docs/BINDINGS: URL update

Marc Hoersken (17 Aug 2021)
- tests/server/*.c: align handling of portfile argument and file
  
  1. Call the internal variable portname (like pidname) everywhere.
  2. Have a variable wroteportfile (like wrotepidfile) everywhere.
  3. Make sure the file is cleaned up on exit (like pidfile).
  4. Add parameter --portfile to usage outputs everywhere.
  
  Reviewed-by: Daniel Stenberg
  
  Replaces #7523
  Closes #7574

Daniel Gustafsson (17 Aug 2021)
- KNOWN_BUGS: Fix a number of typos in KNOWN_BUGS
  
  Fixes a set of typos found in section 11.3.

Daniel Stenberg (17 Aug 2021)
- getparameter: fix the --local-port number parser
  
  It could previously get tricked into parsing the uninitialized stack
  based buffer.
  
  Reported-by: Brian Carpenter
  Closes #7582

- KNOWN_BUGS: Can't use Secure Transport with Crypto Token Kit
  
  Closes #7048

- [Jan Verbeek brought this change]

  curl: add warning for ignored data after quoted form parameter
  
  In an argument like `-F 'x=@/etc/hostname;filename="foo"abc'` the `abc`
  is ignored. This adds a warning if the ignored data isn't all
  whitespace.
  
  Closes #7394

Jay Satiro (17 Aug 2021)
- codeql: fix error "Resource not accessible by integration"
  
  - Enable codeql writing security-events.
  
  GitHub set the default permissions to read, apparently since earlier
  this year.
  
  Ref: https://github.com/github/codeql-action/issues/464
  Ref: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
  
  Fixes https://github.com/curl/curl/issues/7575
  Closes https://github.com/curl/curl/pull/7576

- tool_operate: Fix --fail-early with parallel transfers
  
  - Abort via progress callback to fail early during parallel transfers.
  
  When a critical error occurs during a transfer (eg --fail-early
  constraint) then other running transfers will be aborted via progress
  callback and finish with error CURLE_ABORTED_BY_CALLBACK (42). In this
  case, the callback error does not become the most recent error and a
  custom error message is used for those transfers:
  
  curld --fail --fail-early --parallel
  https://httpbin.org/status/404 https://httpbin.org/delay/10
  
  curl: (22) The requested URL returned error: 404
  curl: (42) Transfer aborted due to critical error in another transfer
  
  > echo %ERRORLEVEL%
  22
  
  Fixes https://github.com/curl/curl/issues/6939
  Closes https://github.com/curl/curl/pull/6984

Daniel Stenberg (17 Aug 2021)
- [Sergey Markelov brought this change]

  sectransp: support CURLINFO_CERTINFO
  
  Fixes #4130
  Closes #7372

- ngtcp2: remove the acked_crypto_offset struct field init
  
  ... as it is gone from the API upstream.
  
  Closes #7578

- misc: update incorrect copyright year ranges
  
  Closes #7577

- KNOWN_BUGS: HTTP/3 quiche upload large file fails
  
  Closes #7532

- KNOWN_BUGS: CMake build with MIT Kerberos does not work
  
  Closes #6904

- TODO: add asynch getaddrinfo support
  
  Closes #6746

- RELEASE-NOTES: synced

- [Artur Sinila brought this change]

  http2: revert call the handle-closed function correctly on closed stream
  
  Reverts 252790c5335a221
  
  Assisted-by: Gergely Nagy
  Fixes #7400
  Closes #7525

- [Patrick Monnerat brought this change]

  auth: do not append zero-terminator to authorisation id in kerberos
  
  RFC4752 Section 3.1 states "The authorization identity is not terminated
  with a zero-valued (%x00) octet". Although a comment in code said it may
  be needed anyway, nothing confirms it. In addition, servers may consider
  it as part of the identity, causing a failure.
  
  Closes #7008

- [Patrick Monnerat brought this change]

  auth: use sasl authzid option in kerberos
  
  ... instead of deriving it from active ticket.
  Closes #7008

- [Patrick Monnerat brought this change]

  auth: we do not support a security layer after kerberos authentication
  
  Closes #7008

- [Patrick Monnerat brought this change]

  auth: properly handle byte order in kerberos security message
  
  Closes #7008

- [z2_ brought this change]

  x509asn1: fix heap over-read when parsing x509 certificates
  
  Assisted-by: Patrick Monnerat
  Closes #7536

- KNOWN_BUGS: Disconnects don't do verbose
  
  Closes #6995

- mailmap: fixup Michał Antoniak

- [Michał Antoniak brought this change]

  build: fix compiler warnings
  
  For when CURL_DISABLE_VERBOSE_STRINGS and DEBUGBUILD flags are both
  active.
  
  - socks.c : warning C4100: 'lineno': unreferenced formal parameter
    (co-authored by Daniel Stenberg)
  
  - mbedtls.c: warning C4189: 'port': local variable is initialized but
    not referenced
  
  - schannel.c: warning C4189: 'hostname': local variable is initialized
    but not referenced
  
  Cloes #7528

- [Gleb Ivanovsky brought this change]

  CODE_STYLE-md: fix bold font style
  
  Markdown gets confused with abundance of asterisks, so use underscores
  instead.
  
  Reviewed-by: Daniel Gustafsson
  Closes #7569

- [Gleb Ivanovsky brought this change]

  CODE_STYLE-md: add missing comma
  
  Reviewed-by: Daniel Gustafsson
  Closes #7570

- [Daniel Gustafsson brought this change]

  examples/ephiperfifo.c: simplify signal handler
  
  The signal handler registered for SIGINT is only handling SIGINT
  so there isn't much need for inspecting the signo.  While there,
  rename the handler to be more specific.
  
  g_should_exit should really be of sig_atomic_t type, but relying
  on autoconf in the examples seems like a bad idea so keep that
  for now.
  
  Reviewed-by: Daniel Stenberg
  Closes #7310

- c-hyper: initial step for 100-continue support
  
  Enabled test 154
  
  Closes #7568

- [Ikko Ashimine brought this change]

  vtls: fix typo in schannel_verify.c
  
  occurence -> occurrence
  
  Closes #7566

- [Emil Engler brought this change]

  curl_url_get.3: clarify about path and query
  
  The current man-page lacks some details regarding the obtained path and
  query.
  
  Closes #7563

- c-hyper: fix header value passed to debug callback
  
  Closes #7567

Viktor Szakats (12 Aug 2021)
