Changes in 7.49.0 - May 18 2016

Changes:

• schannel: Add ALPN support
• SSH: support CURLINFO_FILETIME
• SSH: new CURLOPT_QUOTE command "statvfs"
• wolfssl: Add ALPN support
• http2: added --http2-prior-knowledge
• http2: added CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE
• libcurl: added CURLOPT_CONNECT_TO
• curl: added --connect-to
• libcurl: added CURLOPT_TCP_FASTOPEN
• curl: added --tcp-fastopen
• curl: remove support for --ftpport, -http-request and --socks

Bugfixes:

• CVE-2016-3739: TLS certificate check bypass with mbedTLS/PolarSSL
• checksrc.bat: Updated the help to be consistent with generate.bat
• checksrc.bat: Added support for scanning the tests and examples
• openssl: fix ERR_remove_thread_state() for boringssl/libressl
• openssl: boringssl provides the same numbering as openssl
• multi: fix "Operation timed out after" timer
• url: don't use bad offset in tld_check_name to show error
• sshserver.pl: use quotes for given options
• Makefile.am: skip the scripts dir
• curl: warn for --capath use if not supported by libcurl
• http2: fix connection reuse
• GSS: make Curl_gss_log_error more verbose
• build-wolfssl: Allow a broader range of ciphers (Visual Studio)
• wolfssl: Use ECC supported curves extension
• openssl: Fix compilation warnings
• Curl_add_buffer_send: avoid possible NULL dereference
• SOCKS5_gssapi_negotiate: don't assume little-endian ints
• strerror: don't bit shift a signed integer
• url: Corrected get protocol family for FTP and LDAP
• curl/mprintf.h: remove support for _MPRINTF_REPLACE
• upload: missing rewind call could make libcurl hang
• IMAP: check pointer before dereferencing it
• build: Changed the Visual Studio projects warning level from 3 to 4
• checksrc: now stricter, wider checks, code cleaned up
• checksrc: added docs/CHECKSRC.md
• curl_sasl: Fixed potential null pointer utilisation
• krb5: Fixed missing client response when mutual authentication enabled
• krb5: Only process challenge when present
• krb5: Only generate a SPN when its not known
• formdata: use appropriate fopen() macros
• curl.1: -w filename_effective was introduced in 7.26.0
• http2: make use of the nghttp2 error callback
• http2: fix connection reuse when PING comes after last DATA
• curl.1: change example for -F
• HTTP2: Add a space character after the status code
• curl.1: use example.com more
• mbedtls.c: changed private prefix to mbed_
• mbedtls: implement and provide *_data_pending() to avoid hang
• mbedtls: fix MBEDTLS_DEBUG builds
• ftp/imap/pop3/smtp: Allow the service name to be overridden
• CURLOPT_SOCKS5_GSSAPI_SERVICE: Merged with CURLOPT_PROXY_SERVICE_NAME
• build: include scripts/ in the dist
• http2: Add handling stream level error
• http2: Improve header parsing
• makefile.vc6: use d suffix on debug object
• configure: remove check for libresolve
• scripts/make: use $(EXEEXT) for executables
• checksrc: got rid of the whitelist files
• sendf: added ability to call recv() before send() as workaround
• NTLM: check for NULL pointer before dereferencing
• openssl: builds with OpenSSL 1.1.0-pre5
• configure: ac_cv_ -> curl_cv_ for all cached vars
• winbuild: add mbedtls support
• curl: make --ftp-create-dirs retry on failure
• PolarSSL: implement public key pinning
• multi: accidentally used resolved hostname instead of proxy
• CURLINFO_TLS_SESSION.3: clarify TLS library support before 7.48.0
• CONNECT_ONLY: don't close connection on GSS 401/407 responses
• opts: Fix some syntax errors in example code fragments
• mbedtls: Fix session resume
• test1139: verifies libcurl option manpage presence
• CURLINFO_TLS_SSL_PTR.3: Clarify SSL pointer availability
• curl: make --disable work as long form of -q
• curl: use --telnet-option as documented
• curl.1: document --ftp-ssl-reqd, --krb4 and --ntlm-wb
• curl: -h output lacked --proxy-header and --ntlm-wb
• curl -J: make it work even without http:// scheme on URL
• lib: include curl_printf.h as one of the last headers
• tests: handle path properly on Msys/Cygwin
• curl.1: --mail-rcpt can be used multiple times
• CURLOPT_ACCEPT_ENCODING.3: clarified
• docs: fixed lots of broken manpage references
• tls: make setting pinnedkey option fail if not supported
• test1140: run nroff-scan to verify manpages
• http: make sure a blank header overrides accept_decoding
• connections: do not reuse non-HTTP proxies on different ports
• connect: fix invalid "Network is unreachable" errors
• TLS: move the ALPN/NPN enable bits to the connection
• TLS: SSL_peek is not a const operation
• http2: Add space between colon and header value
• darwinssl: fix certificate verification disable on OS X 10.8
• mprintf: Fix processing of width and prec args
• ftp wildcard: segfault due to init only in multi_perform

Further