Changes in 7.39.0 - November 5 2014

Changes:

• SSLv3 is disabled by default
• CURLOPT_COOKIELIST: Added "RELOAD" command
• build: Added WinIDN build configuration options to Visual Studio projects
• ssh: improve key file search
• SSL: public key pinning. Use CURLOPT_PINNEDPUBLICKEY and --pinnedpubkey
• vtls: remove QsoSSL support, use gskit!
• mk-ca-bundle: added SHA-384 signature algorithm
• docs: added many examples for libcurl opts and other doc improvements
• build: Added VC ssh2 target to main Makefile
• MinGW: Added support to build with nghttp2
• NetWare: Added support to build with nghttp2
• build: added Watcom support to build with WinSSL
• build: Added optional specific version generation of VC project files

Bugfixes:

• curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds
• openssl: build fix for versions < 0.9.8e
• newlines: fix mixed newlines to LF-only
• ntlm: Fixed HTTP proxy authentication when using Windows SSPI
• sasl_sspi: Fixed Unicode build
• file: reject paths using embedded %00
• threaded-resolver: revert Curl_expire_latest() switch
• configure: allow --with-ca-path with PolarSSL too
• HTTP/2: Fix busy loop when EOF is encountered
• CURLOPT_CAPATH: return failure if set without backend support
• nss: do not fail if a CRL is already cached
• smtp: Fixed intermittent "SSL3_WRITE_PENDING: bad write retry" error
• fixed 20+ nits/memory leaks identified by Coverity scans
• curl_schannel.c: Fixed possible memory or handle leak
• multi-uv.c: call curl_multi_info_read() better
• cmake: Check for OpenSSL before OpenLDAP
• cmake: Fix library list provided to curl tests
• cmake: Avoid cycle directory dependencies
• cmake: Build with GSS-API libraries (MIT or Heimdal)
• vtls: provide backend defines for internal source code
• nss: fix a connection failure when FTPS handle is reused
• tests/http_pipe.py: Python 3 support
• cmake: build tool_hugehelp (ENABLE_MANUAL)
• cmake: enable IPv6 by default if available
• tests: move TESTCASES to Makefile.inc, add show for cmake
• ntlm: Avoid unnecessary buffer allocation for SSPI based type-2 token
• ntlm: Fixed empty/bad base-64 decoded buffer return codes
• ntlm: Fixed empty type-2 decoded message info text
• cmake: add CMake/Macros.cmake to the release tarball
• cmake: add SUPPORT_FEATURES and SUPPORT_PROTOCOLS
• cmake: use LIBCURL_VERSION from curlver.h
• cmake: generate pkg-config and curl-config
• fixed several superfluous variable assignments identified by cppcheck
• cleanup of 'CURLcode result' return code
• pipelining: only output "is not blacklisted" in debug builds
• SSL: Remove SSLv3 from SSL default due to POODLE attack
• gskit.c: remove SSLv3 from SSL default
• darwinssl: detect possible future removal of SSLv3 from the framework
• ntlm: Only define ntlm data structure when USE_NTLM is defined
• ntlm: Return CURLcode from Curl_ntlm_core_mk_lm_hash()
• ntlm: Return all errors from Curl_ntlm_core_mk_nt_hash()
• sspi: Only call CompleteAuthToken() when complete is needed
• http_negotiate: Fixed missing check for USE_SPNEGO
• HTTP: return larger than 3 digit response codes too
• openssl: Check for NPN / ALPN via OpenSSL version number
• openssl: enable NPN separately from ALPN
• sasl_sspi: Allow DIGEST-MD5 to use current windows credentials
• sspi: Return CURLE_LOGIN_DENIED on AcquireCredentialsHandle() failure
• resume: consider a resume from
• sasl: Fixed Kerberos V5 inclusion when CURL_DISABLE_CRYPTO_AUTH is used
• build-openssl.bat: Fix x64 release build
• cmake: drop _BSD_SOURCE macro usage
• cmake: fix gethostby{addr,name}_r in CurlTests
• cmake: clean OtherTests, fixing -Werror
• cmake: fix struct sockaddr_storage check
• Curl_single_getsock: fix hold/pause sock handling
• SSL: PolarSSL default min SSL version TLS 1.0
• cmake: fix ZLIB_INCLUDE_DIRS use
• buildconf: stop checking for libtool

Further