                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 8.5.0 (6 Dec 2023)

Daniel Stenberg (6 Dec 2023)

- RELEASE-NOTES: synced

  The curl 8.5.0 release.

Dan Fandrich (5 Dec 2023)

- github/labeler: switch from the beta to labeler v5

  Some keys were renamed and the dot option was made default.

  Closes #12458

Daniel Stenberg (5 Dec 2023)

- DEPRECATE: remove NTLM_WB in June 2024

  Ref: https://curl.se/mail/lib-2023-12/0010.html

  Closes #12451

Jacob Hoffman-Andrews (4 Dec 2023)

- rustls: implement connect_blocking

  Closes #11647

Daniel Stenberg (4 Dec 2023)

- examples/rtsp-options.c: add

  Just a bare bones RTSP example using CURLOPT_RTSP_SESSION_ID and
  CURLOPT_RTSP_REQUEST set to CURL_RTSPREQ_OPTIONS.

  Closes #12452

Stefan Eissing (4 Dec 2023)

- ngtcp2: ignore errors on unknown streams

  - expecially in is_alive checks on connections, we might
    see incoming packets on streams already forgotten and closed,
    leading to errors reported by nghttp3. Ignore those.

  Closes #12449

Daniel Stenberg (4 Dec 2023)

- docs: make all examples in all libcurl man pages compile

  Closes #12448

- checksrc.pl: support #line instructions

  makes it identify the correct source file and line

- GHA/man-examples: verify libcurl man page examples

- verify-examples.pl: verify that all man page examples compile clean

- RELEASE-NOTES: synced

Graham Campbell (2 Dec 2023)

- http3: bump ngtcp2 and nghttp3 versions

  nghttp3 v1.1.0
  ngtcp2 v1.1.0

  In docs and CI

  Closes #12446

- CI/quiche: use `3.1.4+quic` consistently in CI workflows

  Closes #12447

Viktor Szakats (2 Dec 2023)

- test1545: disable deprecation warnings

  Fixes:
  https://ci.appveyor.com/project/curlorg/curl/builds/48631551/job/bhx74e0i66yr
  p6pk#L1205

  Same with details:
  https://ci.appveyor.com/project/curlorg/curl/builds/48662893/job/ol8a78q9gmil
  b6wt#L1263
  ```
  tests/libtest/lib1545.c:38:3: error: 'curl_formadd' is deprecated: since 7.56
  .0. Use curl_mime_init() [-Werror=deprecated-declarations]
     38 |   curl_formadd(&m_formpost, &lastptr, CURLFORM_COPYNAME, "file",
        |   ^~~~~~~~~~~~
  [...]
  ```

  Follow-up to 07a3cd83e0456ca17dfd8c3104af7cf45b7a1ff5 #12421

  Fixes #12445
  Closes #12444

Daniel Stenberg (2 Dec 2023)

- INSTALL: update list of ports and CPU archs

- symbols-in-versions: the CLOSEPOLICY options are deprecated

  The were used with the CURLOPT_CLOSEPOLICY option, which *never* worked.

z2_ (1 Dec 2023)

- build: fix builds that disable protocols but not digest auth

  - Build base64 functions if digest auth is not disabled.

  Prior to this change if some protocols were disabled but not digest auth
  then a build error would occur due to missing base64 functions.

  Fixes https://github.com/curl/curl/issues/12440
  Closes https://github.com/curl/curl/pull/12442

Michał Antoniak (1 Dec 2023)

- connect: reduce number of transportation providers

  Use only the ones necessary - the ones that are built-in. Saves a few
  bytes in the resulting code.

  Closes #12438

David Benjamin (1 Dec 2023)

- vtls: consistently use typedef names for OpenSSL structs

  The foo_st names don't appear in OpenSSL public API documentation. The
  FOO typedefs are more common. This header was already referencing
  SSL_CTX via <openssl/ssl.h>. There is a comment about avoiding
  <openssl/x509v3.h>, but OpenSSL actually declares all the typedefs in
  <openssl/ossl_typ.h>, which is already included by <openssl/ssl.h> (and
  every other OpenSSL header), so just use that. Though I've included it
  just to be explicit.

  (I'm also fairly sure including <openssl/ssl.h> already triggers the
  Schannel conflicts anyway. The comment was probably just out of date.)

  Closes #12439

Lau (1 Dec 2023)

- libcurl-security.3: fix typo

  Fixed minimal typo.

  Closes #12437

Stefan Eissing (1 Dec 2023)

- ngtcp2: fix races in stream handling

  - fix cases where ngtcp2 invokes callbacks on streams that
    nghttp3 has already forgotten. Ignore the NGHTTP3_ERR_STREAM_NOT_FOUND
    in these cases as it is normal behaviour.

  Closes #12435

Emanuele Torre (1 Dec 2023)

- tool_writeout_json: fix JSON encoding of non-ascii bytes

  char variables if unspecified can be either signed or unsigned depending
  on the platform according to the C standard; in most platforms, they are
  signed.

  This meant that the  *i<32  waas always true for bytes with the top bit
  set. So they were always getting encoded as \uXXXX, and then since they
  were also signed negative, they were getting extended with 1s causing
  '\xe2' to be expanded to \uffffffe2, for example:

    $ curl --variable 'v=“' --expand-write-out '{{v:json}}\n' file:///dev/nul
  l
    \uffffffe2\uffffff80\uffffff9c

  I fixed this bug by making the code use explicitly unsigned char*
  variables instead of char* variables.

  Test 268 verifies

  Reported-by: iconoclasthero
  Closes #12434

Stefan Eissing (1 Dec 2023)

- cf-socket: TCP trace output local address used in connect

  Closes #12427

Jay Satiro (1 Dec 2023)

- CURLINFO_PRETRANSFER_TIME_T.3: fix time explanation

  - Change CURLINFO_PRETRANSFER_TIME_T explanation to say that it
    includes protocol-specific instructions that trigger a transfer.

  Prior to this change it explicitly said that it did not include those
  instructions in the time, but that is incorrect.

  The change is a copy of the fixed explanation already in
  CURLINFO_PRETRANSFER_TIME, fixed by ec8dcd7b.

  Reported-by: eeverettrbx@users.noreply.github.com

  Fixes https://github.com/curl/curl/issues/12431
  Closes https://github.com/curl/curl/pull/12432

Daniel Stenberg (30 Nov 2023)

- multi: during ratelimit multi_getsock should return no sockets

  ... as there is nothing to wait for then, it just waits. Otherwise, this
  causes much more CPU work and updates than necessary during ratelimit
  periods.

  Ref: https://curl.se/mail/lib-2023-11/0056.html
  Closes #12430

Dmitry Karpov (30 Nov 2023)

- transfer: abort pause send when connection is marked for closing

  This handles cases of some bi-directional "upgrade" scenarios
  (i.e. WebSockets) where sending is paused until some "upgrade" handshake
  is completed, but server rejects the handshake and closes the
  connection.

  Closes #12428

Daniel Stenberg (28 Nov 2023)

- RELEASE-NOTES: synced

- openssl: when a session-ID is reused, skip OCSP stapling

  Fixes #12399
  Reported-by: Alexey Larikov
  Closes #12418

- test1545: test doing curl_formadd twice with missing file

  Reproduces #12410
  Verifies the fix
  Closes #12421

- Curl_http_body: cleanup properly when Curl_getformdata errors

  Reported-by: yushicheng7788 on github
  Based-on-work-by: yushicheng7788 on github
  Fixes #12410
  Closes #12421

- test1477: verify that libcurl-errors.3 and public headers are synced

  The script errorcodes.pl extracts all error codes from all headers and
  checks that they are all documented, then checks that all documented
  error codes are also specified in a header file.

  Closes #12424

- libcurl-errors.3: sync with current public headers

  Closes #12424

Stefan Eissing (28 Nov 2023)

- test459: fix for parallel runs

  - change warniing message to work better with varying filename
    length.
  - adapt test output check to new formatting

  Follow-up to 97ccc4479f77ba3191c6
  Closes #12423

Daniel Stenberg (27 Nov 2023)

- tool_cb_prg: make the carriage return fit for wide progress bars

  When the progress bar was made max width (256 columns), the fly()
  function attempted to generate its output buffer too long so that the
  trailing carriage return would not fit and then the output would show
  wrongly. The fly function is called when the expected total transfer is
  unknown, which could be one or more progress calls before the actual
  progress meter get shown when the expected transfer size is provided.

  This new take also replaces the msnprintf() call with a much simpler
  memset() for speed.

  Reported-by: Tim Hill
  Fixes #12407
  Closes #12415

- tool_parsecfg: make warning output propose double-quoting

  When the config file parser detects a word that *probably* should be
  quoted, mention double-quotes as a possible remedy.

  Test 459 verifies.

  Proposed-by: Jiehong on github
  Fixes #12409
  Closes #12412

Jay Satiro (26 Nov 2023)

- curl.rc: switch out the copyright symbol for plain ASCII

  .. like we already do for libcurl.rc.

  libcurl.rc copyright symbol used to cause a "non-ascii 8-bit codepoint"
  warning so it was switched to ascii.

  Ref: https://github.com/curl/curl/commit/1ca62bb5#commitcomment-133474972

  Suggested-by: Robert Southee

  Closes https://github.com/curl/curl/pull/12403

Daniel Stenberg (26 Nov 2023)

- conncache: use the closure handle when disconnecting surplus connections

  Use the closure handle for disconnecting connection cache entries so
  that anything that happens during the disconnect is not stored and
  associated with the 'data' handle which already just finished a transfer
  and it is important that details from the unrelated disconnect does not
  taint meta-data in the data handle.

  Like storing the response code.

  This also adjust test 1506. Unfortunately it also removes a key part of
  the test that verifies that a connection is closed since when this
  output vanishes (because the closure handle is used), we don't know
  exactly that the connection actually gets closed in this test...

  Reported-by: ohyeaah on github
  Fixes #12367
  Closes #12405

- RELEASE-NOTES: synced

Stefan Eissing (24 Nov 2023)

- quic: make eyeballers connect retries stop at weird replies

  - when a connect immediately goes into DRAINING state, do
    not attempt retries in the QUIC connection filter. Instead,
    return CURLE_WEIRD_SERVER_REPLY
  - When eyeballing, interpret CURLE_WEIRD_SERVER_REPLY as an
    inconclusive answer. When all addresses have been attempted,
    rewind the address list once on an inconclusive answer.
  - refs #11832 where connects were retried indefinitely until
    the overall timeout fired

  Closes #12400

Daniel Stenberg (24 Nov 2023)

- CI: verify libcurl function SYNPOSIS sections

  With the .github/scripits/verify-synopsis.pl script

  Closes #12402

- docs/libcurl: SYNSOPSIS cleanup

  - use the correct include file
  - make sure they are declared as in the header file
  - fix minor nroff syntax mistakes (missing .fi)

  These are verified by verify-synopsis.pl, which extracts the SYNPOSIS
  code and runs it through gcc.

  Closes #12402

- sendf: fix comment typo

- fopen: allocate the dir after fopen

  Move the allocation of the directory name down to after the fopen() call
  to allow that shortcut code path to avoid a superfluous malloc+free
  cycle.

  Follow-up to 73b65e94f35311

  Closes #12398

Stefan Eissing (24 Nov 2023)

- transfer: cleanup done+excess handling

  - add `SingleRequest->download_done` as indicator that
    all download bytes have been received
  - remove `stop_reading` bool from readwrite functions
  - move excess body handling into client download writer

  Closes #12371

Daniel Stenberg (23 Nov 2023)

- fopen: create new file using old file's mode

  Because the function renames the temp file to the target name as a last
  step, if the file was previously owned by a different user, not ORing
  the old mode could otherwise end up creating a file that was no longer
  readable by the original owner after save.

  Reported-by: Loïc Yhuel
  Fixes #12299
  Closes #12395

- test1476: require proxy

  Follow-up from 323df4261c3542

  Closes #12394

- fopen: create short(er) temporary file name

  Only using random letters in the name plus a ".tmp" extension. Not by
  appending characters to the final file name.

  Reported-by: Maksymilian Arciemowicz

  Closes #12388

Stefan Eissing (23 Nov 2023)

- tests: git ignore generated second-hsts.txt file

  File is generated in test lib1900

  Follow-up to 7cb03229d9e9c5

  Closes #12393

Viktor Szakats (23 Nov 2023)

- openssl: enable `infof_certstack` for 1.1 and LibreSSL 3.6

  Lower the barrier to enable `infof_certstack()` from OpenSSL 3 to
  OpenSSL 1.1.x, and LibreSSL 3.6 or upper.

  With the caveat, that "group name" and "type name" are missing from
  the log output with these TLS backends.

  Follow-up to b6e6d4ff8f253c8b8055bab9d4d6a10f9be109f3 #12030

  Reviewed-by: Daniel Stenberg
  Closes #12385

Daniel Stenberg (23 Nov 2023)

- urldata: fix typo in comment

- CI: codespell

  The list of words to ignore is in the file
  .github/scripts/codespell-ignore.txt

  Closes #12390

- lib: fix comment typos

  Five separate ones, found by codespell

  Closes #12390

- test1476: verify cookie PSL mixed case

- cookie: lowercase the domain names before PSL checks

  Reported-by: Harry Sintonen

  Closes #12387

Viktor Szakats (23 Nov 2023)

- openssl: fix building with v3 `no-deprecated` + add CI test

  - build quictls with `no-deprecated` in CI to have test coverage for
    this OpenSSL 3 configuration.

  - don't call `OpenSSL_add_all_algorithms()`, `OpenSSL_add_all_digests()`.
    The caller code is meant for OpenSSL 3, while these two functions were
    only necessary before OpenSSL 1.1.0. They are missing from OpenSSL 3
    if built with option `no-deprecated`, causing build errors:
    ```
    vtls/openssl.c:4097:3: error: call to undeclared function 'OpenSSL_add_all_
  algorithms'; ISO C99 and later do not   support implicit function declaration
  s [-Wimplicit-function-declaration]
    vtls/openssl.c:4098:3: error: call to undeclared function 'OpenSSL_add_all_
  digests'; ISO C99 and later do not   support implicit function declarations [
  -Wimplicit-function-declaration]
    ```
    Ref: https://ci.appveyor.com/project/curlorg/curl-for-win/builds/48587418?f
  ullLog=true#L7667

    Regression from b6e6d4ff8f253c8b8055bab9d4d6a10f9be109f3 #12030
    Bug: https://github.com/curl/curl/issues/12380#issuecomment-1822944669
    Reviewed-by: Alex Bozarth

  - vquic/curl_ngtcp2: fix using `SSL_get_peer_certificate` with
    `no-deprecated` quictls 3 builds.
    Do it by moving an existing solution for this from `vtls/openssl.c`
    to `vtls/openssl.h` and adjusting caller code.
    ```
    vquic/curl_ngtcp2.c:1950:19: error: implicit declaration of function 'SSL_g
  et_peer_certificate'; did you mean   'SSL_get1_peer_certificate'? [-Wimplicit
  -function-declaration]
    ```
    Ref: https://github.com/curl/curl/actions/runs/6960723097/job/18940818625#s
  tep:24:1178

  - curl_ntlm_core: fix `-Wunused-parameter`, `-Wunused-variable` and
    `-Wunused-function` when trying to build curl with NTLM enabled but
    without the necessary TLS backend (with DES) support.

  Closes #12384

- curl.h: delete Symbian OS references

  curl deprecated Symbian OS in 3d64031fa7a80ac4ae3fd09a5939196268b92f81
  via #5989. Delete references to it from public headers, because there
  is no fresh release to use those headers with.

  Reviewed-by: Dan Fandrich
  Reviewed-by: Jay Satiro
  Closes #12378

- windows: use built-in `_WIN32` macro to detect Windows

  Windows compilers define `_WIN32` automatically. Windows SDK headers
  or build env defines `WIN32`, or we have to take care of it. The
  agreement seems to be that `_WIN32` is the preferred practice here.
  Make the source code rely on that to detect we're building for Windows.

  Public `curl.h` was using `WIN32`, `__WIN32__` and `CURL_WIN32` for
  Windows detection, next to the official `_WIN32`. After this patch it
  only uses `_WIN32` for this. Also, make it stop defining `CURL_WIN32`.

  There is a slight chance these break compatibility with Windows
  compilers that fail to define `_WIN32`. I'm not aware of any obsolete
  or modern compiler affected, but in case there is one, one possible
  solution is to define this macro manually.

  grepping for `WIN32` remains useful to discover Windows-specific code.

  Also:

  - extend `checksrc` to ensure we're not using `WIN32` anymore.

  - apply minor formatting here and there.

  - delete unnecessary checks for `!MSDOS` when `_WIN32` is present.

  Co-authored-by: Jay Satiro
  Reviewed-by: Daniel Stenberg

  Closes #12376

Stefan Eissing (22 Nov 2023)

- url: ConnectionExists revisited

  - have common pattern of `if not match, continue`
  - revert pages long if()s to return early
  - move dead connection check to later since it may
    be relatively expensive
  - check multiuse also when NOT building with NGHTTP2
  - for MULTIUSE bundles, verify that the inspected
    connection indeed supports multiplexing when in use
    (bundles may contain a mix of connection, afaict)

  Closes #12373

Daniel Stenberg (22 Nov 2023)

- CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range

  ... or use the default value.

  Also clarify the documentation language somewhat.

  Closes #12382

- urldata: make maxconnects a 32 bit value

  "2^32 idle connections ought to be enough for anybody"

  Closes #12375

- FEATURES: update the URL phrasing

  The URL is length limited since a while back so "no limit" simply is not
  true anymore. Mention the URL RFC standard used instead.

  Closes #12383

- wolfssh: remove redundant static prototypes

  vssh/wolfssh.c:346:18: error: redundant redeclaration of ‘wscp_recv’ [-We
  rror=redundant-decls]

  Closes #12381

- setopt: remove superfluous use of ternary expressions

  Closes #12374

- mime: store "form escape" as a single bit

  Closes #12374

- setopt: check CURLOPT_TFTP_BLKSIZE range on set

  ... instead of later when the transfer is about to happen.

  Closes #12374

Viktor Szakats (21 Nov 2023)

- build: add more picky warnings and fix them

  Enable more picky compiler warnings. I've found these options in the
  nghttp3 project when implementing the CMake quick picky warning
  functionality for it [1].

  `-Wunused-macros` was too noisy to keep around, but fixed a few issues
  it revealed while testing.

  - autotools: reflect the more precisely-versioned clang warnings.
    Follow-up to 033f8e2a08eb1d3102f08c4d8c8e85470f8b460e #12324
  - autotools: sync between clang and gcc the way we set `no-multichar`.
  - autotools: avoid setting `-Wstrict-aliasing=3` twice.
  - autotools: disable `-Wmissing-noreturn` for MSYS gcc targets [2].
    It triggers in libtool-generated stub code.

  - lib/timeval: delete a redundant `!MSDOS` guard from a `WIN32` branch.

  - lib/curl_setup.h: delete duplicate declaration for `fileno`.
    Added in initial commit ae1912cb0d494b48d514d937826c9fe83ec96c4d
    (1999-12-29). This suggests this may not be needed anymore, but if
    it does, we may restore this for those specific (non-Windows) systems.
  - lib: delete unused macro `FTP_BUFFER_ALLOCSIZE` since
    c1d6fe2aaa5a26e49a69a4f2495b3cc7a24d9394.
  - lib: delete unused macro `isxdigit_ascii` since
    f65f750742068f579f4ee6d8539ed9d5f0afcb85.
  - lib/mqtt: delete unused macro `MQTT_HEADER_LEN`.
  - lib/multi: delete unused macro `SH_READ`/`SH_WRITE`.
  - lib/hostip: add `noreturn` function attribute via new `CURL_NORETURN`
    macro.
  - lib/mprintf: delete duplicate declaration for `Curl_dyn_vprintf`.
  - lib/rand: fix `-Wunreachable-code` and related fallouts [3].
  - lib/setopt: fix `-Wunreachable-code-break`.
  - lib/system_win32 and lib/timeval: fix double declarations for
    `Curl_freq` and `Curl_isVistaOrGreater` in CMake UNITY mode [4].
  - lib/warnless: fix double declarations in CMake UNITY mode [5].
    This was due to force-disabling the header guard of `warnless.h` to
    to reapply it to source code coming after `warnless.c` in UNITY
    builds. This reapplied declarations too, causing the warnings.
    Solved by adding a header guard for the lines that actually need
    to be reapplied.
  - lib/vauth/digest: fix `-Wunreachable-code-break` [6].
  - lib/vssh/libssh2: fix `-Wunreachable-code-break` and delete redundant
    block.
  - lib/vtls/sectransp: fix `-Wunreachable-code-break` [7].
  - lib/vtls/sectransp: suppress `-Wunreachable-code`.
    Detected in `else` branches of dynamic feature checks, with results
    known at compile-time, e.g.
    ```c
    if(SecCertificateCopySubjectSummary)  /* -> true */
    ```
    Likely fixable as a separate micro-project, but given SecureTransport
    is deprecated anyway, let's just silence these locally.
  - src/tool_help: delete duplicate declaration for `helptext`.
  - src/tool_xattr: fix `-Wunreachable-code`.
  - tests: delete duplicate declaration for `unitfail` [8].
  - tests: delete duplicate declaration for `strncasecompare`.
  - tests/libtest: delete duplicate declaration for `gethostname`.
    Originally added in 687df5c8c39c370a59999b9afc0917d808d978b7
    (2010-08-02).
    Got complicated later: c49e9683b85ba9d12cbb6eebc4ab2c8dba68fbdc
    If there are still systems around with warnings, we may restore the
    prototype, but limited for those systems.
  - tests/lib2305: delete duplicate declaration for
    `libtest_debug_config`.
  - tests/h2-download: fix `-Wunreachable-code-break`.

  [1] https://github.com/ngtcp2/nghttp3/blob/a70edb08e954d690e8fb2c1df999b5a056
  f8bf9f/cmake/PickyWarningsC.cmake
  [2] https://ci.appveyor.com/project/curlorg/curl/builds/48553586/job/3qkgjaui
  qla5fj45?fullLog=true#L1675
  [3] https://github.com/curl/curl/actions/runs/6880886309/job/18716044703?pr=1
  2331#step:7:72
      https://github.com/curl/curl/actions/runs/6883016087/job/18722707368?pr=1
  2331#step:7:109
  [4] https://ci.appveyor.com/project/curlorg/curl/builds/48555101/job/9g15qkrr
  iklpf1ut#L204
  [5] https://ci.appveyor.com/project/curlorg/curl/builds/48555101/job/9g15qkrr
  iklpf1ut#L218
  [6] https://github.com/curl/curl/actions/runs/6880886309/job/18716042927?pr=1
  2331#step:7:290
  [7] https://github.com/curl/curl/actions/runs/6891484996/job/18746659406?pr=1
  2331#step:9:1193
  [8] https://github.com/curl/curl/actions/runs/6882803986/job/18722082562?pr=1
  2331#step:33:1870

  Closes #12331

Daniel Stenberg (21 Nov 2023)

- transfer: avoid unreachable expression

  If curl_off_t and size_t have the same size (which is common on modern
  64 bit systems), a condition cannot occur which Coverity pointed
  out. Avoid the warning by having the code conditionally only used if
  curl_off_t actually is larger.

  Follow-up to 1cd2f0072fa482e25baa2

  Closes #12370

Stefan Eissing (21 Nov 2023)

- transfer: readwrite improvements

  - changed header/chunk/handler->readwrite prototypes to accept `buf`,
    `blen` and a `pconsumed` pointer. They now get the buffer to work on
    and report back how many bytes they consumed
  - eliminated `k->str` in SingleRequest
  - improved excess data handling to properly calculate with any body data
    left in the headerb buffer
  - eliminated `k->badheader` enum to only be a bool

  Closes #12283

Daniel Stenberg (21 Nov 2023)

- RELEASE-NOTES: synced

Jiří Hruška (21 Nov 2023)

- transfer: avoid calling the read callback again after EOF

  Regression since 7f43f3dc5994d01b12 (7.84.0)

  Bug: https://curl.se/mail/lib-2023-11/0017.html

  Closes #12363

Daniel Stenberg (21 Nov 2023)

- doh: provide better return code for responses w/o addresses

  Previously it was wrongly returning CURLE_OUT_OF_MEMORY when the
  response did not contain any addresses. Now it more accurately returns
  CURLE_COULDNT_RESOLVE_HOST.

  Reported-by: lRoccoon on github

  Fixes #12365
  Closes #12366

Stefan Eissing (21 Nov 2023)

- HTTP/2, HTTP/3: handle detach of onoing transfers

  - refs #12356 where a UAF is reported when closing a connection
    with a stream whose easy handle was cleaned up already
  - handle DETACH events same as DONE events in h2/h3 filters

  Fixes #12356
  Reported-by: Paweł Wegner
  Closes #12364

Viktor Szakats (20 Nov 2023)

- autotools: stop setting `-std=gnu89` with `--enable-warnings`

  Do not alter the C standard when building with `--enable-warnings` when
  building with gcc.

  On one hand this alters warning results compared to a default build.
  On the other, it may produce different binaries, which is unexpected.

  Also fix new warnings that appeared after removing `-std=gnu89`:

  - include: fix public curl headers to use the correct printf mask for
    `CURL_FORMAT_CURL_OFF_T` and `CURL_FORMAT_CURL_OFF_TU` with mingw-w64
    and Visual Studio 2013 and newer. This fixes the printf mask warnings
    in examples and tests. E.g. [1]

  - conncache: fix printf format string [2].

  - http2: fix potential null pointer dereference [3].
    (seen on Slackware with gcc 11.)

  - libssh: fix printf format string in SFTP code [4].
    Also make MSVC builds compatible with old CRT versions.

  - libssh2: fix printf format string in SFTP code for MSVC.
    Applying the same fix as for libssh above.

  - unit1395: fix `argument is null` and related issues [5]:
    - stop calling `strcmp()` with NULL to avoid undefined behaviour.
    - fix checking results if some of them were NULL.
    - do not pass NULL to printf `%s`.

  - ci: keep a build job with `-std=gnu89` to continue testing for
    C89-compliance. We can apply this to other gcc jobs as needed.
    Ref: b23ce2cee7329bbf425f18b49973b7a5f23dfcb4 (2022-09-23) #9542

  [1] https://dev.azure.com/daniel0244/curl/_build/results?buildId=18581&view=l
  ogs&jobId=ccf9cc6d-2ef1-5cf2-2c09-30f0c14f923b
  [2] https://github.com/curl/curl/actions/runs/6896854263/job/18763831142?pr=1
  2346#step:6:67
  [3] https://github.com/curl/curl/actions/runs/6896854253/job/18763839238?pr=1
  2346#step:30:214
  [4] https://github.com/curl/curl/actions/runs/6896854253/job/18763838007?pr=1
  2346#step:29:895
  [5] https://github.com/curl/curl/actions/runs/6896854253/job/18763836775?pr=1
  2346#step:33:1689

  Closes #12346

- autotools: fix/improve gcc and Apple clang version detection

  - Before this patch we expected `n.n` `-dumpversion` output, but Ubuntu
    may return `n-win32` (also with `-dumpfullversion`). Causing these
    errors and failing to enable picky warnings:
    ```
    ../configure: line 23845: test: : integer expression expected
    ```
    Ref: https://github.com/libssh2/libssh2/actions/runs/6263453828/job/1700789
  3718#step:5:143

    Fix that by stripping any dash-suffix and handling a dotless (major-only)
    version number by assuming `.0` in that case.

    `9.3-posix`, `9.3-win32`, `6`, `9.3.0`, `11`, `11.2`, `11.2.0`
    Ref: https://github.com/mamedev/mame/pull/9767

  - fix Apple clang version detection for releases between
    'Apple LLVM version 7.3.0' and 'Apple LLVM version 10.0.1' where the
    version was under-detected as 3.7 llvm/clang equivalent.

  - fix Apple clang version detection for 'Apple clang version 11.0.0'
    and newer where the Apple clang version was detected, instead of its
    llvm/clang equivalent.

  - display detected clang/gcc/icc compiler version.

  Via libssh2:
  - https://github.com/libssh2/libssh2/commit/00a3b88c51cdb407fbbb347a2e38c5c7d
  89875ad
    https://github.com/libssh2/libssh2/pull/1187
  - https://github.com/libssh2/libssh2/commit/89ccc83c7da73e7ca3a112e3500081319
  42b592e
    https://github.com/libssh2/libssh2/pull/1232

  Closes #12362

- autotools: delete LCC compiler support bits

  Follow-up to fd7ef00f4305a2919e6950def1cf83d0110a4acd #12222

  Closes #12357

- cmake: add test for `DISABLE` options, add `CURL_DISABLE_HEADERS_API`

  - tests: verify CMake `DISABLE` options.

    Make an exception for 2 CMake-only ones, and one more that's
    using a different naming scheme, also in autotools and source.

  - cmake: add support for `CURL_DISABLE_HEADERS_API`.

  Suggested-by: Daniel Stenberg
  Ref: https://github.com/curl/curl/pull/12345#pullrequestreview-1736238641

  Closes #12353

Jacob Hoffman-Andrews (20 Nov 2023)

- hyper: temporarily remove HTTP/2 support

  The current design of the Hyper integration requires rebuilding the
  Hyper clientconn for each request. However, building the clientconn
  requires resending the HTTP/2 connection preface, which is incorrect
  from a protocol perspective. That in turn causes servers to send GOAWAY
  frames, effectively degrading performance to "no connection reuse" in
  the best case. It may also be triggering some bugs where requests get
  dropped entirely and reconnects take too long.

  This doesn't rule out HTTP/2 support with Hyper, but it may take a
  redesign of the Hyper integration in order to make things work.

  Closes #12191

Jay Satiro (20 Nov 2023)

- schannel: fix unused variable warning

  Bug: https://github.com/curl/curl/pull/12349#issuecomment-1818000846
  Reported-by: Viktor Szakats

  Closes https://github.com/curl/curl/pull/12361

Daniel Stenberg (19 Nov 2023)

- url: find scheme with a "perfect hash"

  Instead of a loop to scan over the potentially 30+ scheme names, this
  uses a "perfect hash" table. This works fine because the set of schemes
  is known and cannot change in a build. The hash algorithm and table size
  is made to only make a single scheme index per table entry.

  The perfect hash is generated by a separate tool (scripts/schemetable.c)

  Closes #12347

- scripts: add schemetable.c

  This tool generates a scheme-matching table.

  It iterates over a number of different initial and shift values in order
  to find the hash algorithm that needs the smallest possible table.

  The generated hash function, table and table size then needs to be used
  by the url.c:Curl_getn_scheme_handler() function.

Stefan Eissing (19 Nov 2023)

- vtls/vquic, keep peer name information together

  - add `struct ssl_peer` to keep hostname, dispname and sni
    for a filter
  - allocate `sni` for use in VTLS backend
  - eliminate `Curl_ssl_snihost()` and its use of the download buffer
  - use ssl_peer in SSL and QUIC filters

  Closes #12349

Viktor Szakats (18 Nov 2023)

- build: always revert `#pragma GCC diagnostic` after use

  Before this patch some source files were overriding gcc warning options,
  but without restoring them at the end of the file. In CMake UNITY builds
  these options spilled over to the remainder of the source code,
  effecitvely disabling them for a larger portion of the codebase than
  intended.

  `#pragma clang diagnostic` didn't have such issue in the codebase.

  Reviewed-by: Marcel Raad
  Closes #12352

- tidy-up: casing typos, delete unused Windows version aliases

  - cmake: fix casing of `UnixSockets` to match the rest of the codebase.

  - curl-compilers.m4: fix casing in a comment.

  - setup-win32: delete unused Windows version constant aliases.

  Reviewed-by: Marcel Raad
  Closes #12351

- keylog: disable if unused

  Fully disable keylog code if there is no TLS or QUIC subsystem using it.

  Closes #12350

- cmake: add `CURL_DISABLE_BINDLOCAL` option

  To match similar autotools option.

  Default is `ON`.
