Commit Graph

36026 Commits

Author SHA1 Message Date
Daniel Stenberg
11b991232f RELEASE-NOTES: synced
curl 8.16.0 release
curl-8_16_0
2025-09-10 07:43:09 +02:00
Daniel Stenberg
bee4ee6141 VERSIONS: update past versions 2025-09-10 07:43:09 +02:00
Daniel Stenberg
85ba1b8067 THANKS: names from the 8.16.0 cycle 2025-09-10 07:41:00 +02:00
Viktor Szakats
61759a9843 pytest: bind to localhost
Pointed out by CodeQL

Fixes https://github.com/curl/curl/security/code-scanning/298

Closes #18506
2025-09-10 00:55:07 +02:00
renovate[bot]
82449d4d91 GHA: update github/codeql-action digest to d3678e2
Closes #18507
2025-09-09 23:47:41 +02:00
Viktor Szakats
c70f7b7a7c GHA/codeql: scan GHA workflows and Python
Closes #18504
2025-09-09 21:51:09 +02:00
renovate[bot]
522c991336 Dockerfile: update debian:bookworm-slim Docker digest to df52e55
Closes #18499
2025-09-09 15:28:00 +02:00
Viktor Szakats
9863599d69 lib: introduce CURL_ACCEPT()
To avoid overriding the system symbol `accept`, which is a macro on some
systems (AIX), and thus can't be called via the `(function)` PP trick.

It's also problematic to reset such macro to its original value.

Follow-up to 3bb5e58c10 #17827
Reported-by: Andrew Kirillov
Fixes #18500
Closes #18501
Closes #18502
2025-09-09 15:17:34 +02:00
Daniel Stenberg
f8ff233cdf _ENVIRONMENT.md: document NETRC
Follow-up to 378713deb2

Closes #18497
2025-09-08 22:45:30 +02:00
Daniel Stenberg
32909591d2 docs: put <> within backticks in titles
To render better markdown. Make managen warn if present "unticked" and
unescaped.

Closes #18498
2025-09-08 22:42:53 +02:00
Stefan Eissing
e3c06ccc66 vquic: replace assert
Replace the hard assert in case not all data is send on UDP
(which should never happen), with an error return.

Closes #18495
2025-09-08 16:05:27 +02:00
Daniel Stenberg
84db7a9eae ws: get a new mask for each new outgoing frame
Reported-by: Calvin Ruocco
Closes #18496
2025-09-08 16:04:16 +02:00
Andrew
7c9878ff0c curl_setup.h: include limits.h before testing for #ifndef SSIZE_MAX
Ref: 93f333c18f #18426 #18406
Fixes #18493
Closes #18494
2025-09-08 14:52:55 +02:00
Daniel Stenberg
07a688135d KNOWN_BUGS: OpenSSL-QUIC problems on google.com
Closes #18336
Closes #18492
2025-09-08 11:45:33 +02:00
Daniel Stenberg
34fd7e8d2d RELEASE-PROCEDURE.md: drop the _newslog edit mention
Because that file has now been removed from the website repository
2025-09-08 11:12:47 +02:00
Daniel Stenberg
455afa1de5 RELEASE-PROCEDURE.md: remove some old release dates, add some new 2025-09-08 10:14:12 +02:00
Daniel Stenberg
3b2cfa55a0 mailmap: unify on James 2025-09-08 09:26:22 +02:00
Viktor Szakats
93bc523541 GHA/linux: run on .md file changes
To execute runtests on Markdown files. E.g. test 1275.

Bug: https://github.com/curl/curl/pull/18486#issuecomment-3263681032

Closes #18487
2025-09-07 22:21:04 +02:00
Viktor Szakats
7f7db9e372 lib: fix broken link in comment 2025-09-07 19:19:05 +02:00
Viktor Szakats
10e9d512e5 BINDINGS: point a link to archive.org
The original website is hosting different content now.

Closes #18489
2025-09-07 18:59:11 +02:00
Viktor Szakats
ce62f0f9a1 VULN-DISCLOSURE-POLICY: make it pass test 1275
```
test 1275...[Verify capital letters after period in markdown files]
 ../../docs/VULN-DISCLOSURE-POLICY.md:426:55:error: lowercase daily after period
 * regular communication from communication leader (ex. daily update)
```
Ref: https://github.com/curl/curl/actions/runs/17527331816/job/49779555753?pr=18485

Also: add ending slashes to 2 URLs.

Follow-up to 6905370df5 #18483
Closes #18486
2025-09-07 12:39:44 +02:00
Viktor Szakats
b85cb8cb4e openldap: fix -Wtentative-definition-compat
It's a `-Weverything` warning that appeared in llvm/clang 21.

```
lib/openldap.c:1297:19: warning: duplicate declaration of 'ldapsb_tls' is invalid in C++ [-Wtentative-definition-compat]
 1297 | static Sockbuf_IO ldapsb_tls =
      |                   ^
lib/openldap.c:499:19: note: previous declaration is here
  499 | static Sockbuf_IO ldapsb_tls;
      |                   ^
```

Reported-by: correctmost on github
Fixes #18470
Cherry-picked from #18477
Closes #18485
2025-09-07 12:36:44 +02:00
Jim Fuller
6905370df5 docs: add major incident section to vuln disclosure policy
Closes #18483
2025-09-06 12:20:45 +02:00
Daniel Stenberg
6420c52294 RELEASE-NOTES: synced 2025-09-06 12:12:55 +02:00
Stefan Eissing
0b09132877 websocket: handling of PONG frames
The auto PONG frames were inserted into the connection at the time
a PING had been decoded, irregardless if an upstream frame was just
in the middle of being assembled.

Add PONG frames only to the buffer if there is no frame currently
assemebled and, if it is, set the control frame aside. This control
frame is then added on the first opportunity of a "clean" send buffer.

There is only a single control frame set aside at a time. This means
a double PING will, when the PONG cannot be sent right away, only
send the last PONG.

I imagine this is fine. We want to prevent the endless buffering of
PONG frames on a connection where the server sends but does no receives.

Reported-by: Calvin Ruocco
Fixes #16706
Closes #18479
2025-09-05 13:17:39 +02:00
renovate[bot]
4c0da28231 gha: Update actions/labeler action to v6 2025-09-04 13:03:47 -07:00
Viktor Szakats
ec9cb618a0 spacecheck: warn for 3+ empty lines in a row, fix fallouts
Closes #18478
2025-09-04 20:37:51 +02:00
Stefan Eissing
5fa4fb0c13 websocket: reset upload_done when sending data
Sending websocket data did not clear the "upload_done" flag of
the initial HTTP Upgrade request, leading to KEEP_SEND never be
cleared. This caused the socket to be polled for INOUT after all
the websocket data had been sent. A busy loop.

Closes #18476
2025-09-04 14:47:15 +02:00
Daniel Stenberg
f333a73892 top-complexity: set threshold to 70
Closes #18475
2025-09-04 10:06:13 +02:00
Daniel Stenberg
1edead4360 rtsp: split out a subfunction from rtsp_do
Takes complexity down from 71 to 52.

Closes #18471
2025-09-04 08:31:27 +02:00
Daniel Stenberg
31659b4a7a http_add_connection_hd: respect previous error
Pointed out by CodeSonar

Closes #18472
2025-09-04 08:26:17 +02:00
Viktor Szakats
5ef4451f7b cmake: fix setting LTO properties on the wrong targets
Follow-up to ae1a861bd6 #17043

Closes #18469
2025-09-03 18:35:31 +02:00
Viktor Szakats
0b0f3d937c lib: drop UNUSED_PARAM macro
Added in 2011, but has seen little use in the code. The necessary
compiler feature is missing in some compilers (e.g. MSVC), thus in most
places the portable `(void)` cast is used in addition.

Also:
- vtls/rustls: silence unused argument warning with `(void)`.
  Necessary for MSVC, for example.

Ref: ee4ed46128

Closes #18455
2025-09-03 16:33:05 +02:00
Viktor Szakats
49145249be tidy-up: drop stray "unused" comments
Closes #18453
2025-09-03 16:31:16 +02:00
Stefan Eissing
24badd29f5 multi: limit-rate revisited
Tweaks around handling of --limit-rate:

* tracing: trace outstanding timeouts by name
* multi: do not mark transfer as dirty that have
  an EXPIRE_TOOFAST set
* multi: have one static function to asses speed limits
* multi: when setting EXPIRE_TOOFAST remove the transfers
  from the dirty set
* progress: rename vars and comment on how speed limit
  timeouts are calculated, for clarity
* transfer: when speed limiting, exit the receive loop
  after a quarter of the limit has been received, not
  on the first chunk received.
* cf-ip-happy.c: clear EXPIRE_HAPPY_EYEBALLS on connect
* scorecard: add --limit-rate parameter to test with
  speed limits in effect

Closes #18454
2025-09-03 15:53:41 +02:00
renovate[bot]
2ebb966e08 GHA: update nghttp2/nghttp2 to v1.67.0
Closes #18456
2025-09-03 15:51:43 +02:00
Daniel Stenberg
de86c2483f test763: verify IDN hostname with zero width characters only
Bonus: fix memory leak in exit path from 967a626af4

Closes #18465
2025-09-03 15:49:54 +02:00
Daniel Stenberg
71c9706959 tests: remove the 'none' server
Only actually needed servers should be listed and none is then implied
if no servers are listed.

Outputs a warning if "none" is still set as a server.

Closes #18466
2025-09-03 14:30:10 +02:00
David Zhuang
c278c508e2 http: do the cookie list access under lock
A previous refactor of cookie logic changed Curl_cookie_getlist to no
longer return a list of copied cookies, but instead return a linked list
pointing to existing cookies. The returned linked list is accessed
outside of the scope of the cookie share lock in http_cookies, which
leads to issues if the shared cookie list is modified at the same time.
This is the relevant commit: be39ed1

Closes #18457
2025-09-03 12:54:31 +02:00
renovate[bot]
5e6bc73570 GHA: Update cloudflare/quiche to v0.24.6
Closes #18464
2025-09-03 12:52:04 +02:00
Stefan Eissing
9f1102cf74 pytest: add tests for getting a non-existing ftp file
Check that return code is 78.

Closes #18463
2025-09-03 12:51:00 +02:00
Daniel Stenberg
967a626af4 idn: reject conversions that end up as a zero length hostname
Reported-by: RepoRascal on hackerone
Closes #18462
2025-09-03 11:55:23 +02:00
renovate[bot]
8603d5262b GHA: update awslabs/aws-lc to v1.60.0
Closes #18458
2025-09-03 11:37:42 +02:00
Daniel Stenberg
765b5ab0cd tool_getparam: warn on more unicode prefixes
If a string argument is expected and the first two bytes are 0xe2 ex80
and the third has the 7th bit set, that's enough for curl to warn.

Previously we tried to detect and warn only for the unicode double
quote, but users might use single quotes, other quotes or even lead the
argument with one of the "zero widths" characters. This is an attempt to
detect many of those. Without triggering for "normal" IDN hostnames.

Closes #18459
2025-09-03 11:35:10 +02:00
Daniel Stenberg
4c70b71ba4 RELEASE-NOTES: synced 2025-09-03 08:36:55 +02:00
Jay Satiro
c72bb7aec4 projects: fix Windows project 'clean' function
- Fix generate.bat "-clean" option.

- Change version template substitutes to match old files, eg go back to
  using format version "11.00" instead of "11.0".

- Limit the vcxproj filters file types that are filtered to c, h, rc.

- Get rid of the tmpl extension from template files and add a README
  to the tmpl directory explaining the purpose of the files.

- gitignore VCxx directories entirely rather than individual file types.

- Do not remove the VC directories during clean, instead remove just the
  generated project files.

Removing the VC directories has the unwanted behavior of removing files
other than those generated. Visual Studio will generate its own
preference files (like if you have some debug arguments in your .suo)
and those files sit in the VC directories. We ignore those files since
they are the user's files and should not be deleted. Also the user may
have their own untracked files that we shouldn't be deleting.

Follow-up to 57d349fe which consolidated the project templates.

Assisted-by: Viktor Szakats

Closes https://github.com/curl/curl/pull/18412
2025-09-02 10:34:48 -04:00
Florian Friedrich
ad42850b23 docs: fix typo (staring -> starting)
Closes #18450
2025-09-02 10:11:51 +02:00
Michał Petryka
37c6744997 .editorconfig: add
This allows IDEs that support this standard to automatically use the
correct formatting options.

Closes #18409
2025-09-02 08:36:40 +02:00
Daniel Stenberg
f8e6e11725 parsedate: make Curl_getdate_capped able to return epoch
By returning error separately on parse errors and avoiding magic
numbers, this function can now return 0 or -1 as proper dates when such
a date string is provided.

Closes #18445
2025-09-02 07:55:34 +02:00
Stefan Eissing
4d040c71d7 Curl_http(), decomplexify
Split out adding of individual request headers into a switch. Check
the connection http version only on fresh connections, use separate
methods.

Add TE: header directly without allocation. Add bit for indicating
Connection: header has been added and custom headers should not do
that again.

Closes #18444
2025-09-02 07:54:46 +02:00