Changes in 7.72.0 - August 19 2020

• content_encoding: add zstd decoding support
• CURL_PUSH_ERROROUT: allow the push callback to fail the parent stream
• CURLINFO_EFFECTIVE_METHOD: added

Bugfixes:

• CVE-2020-8231: libcurl: wrong connect-only connection
• appveyor: collect libcurl.dll variants with prefix or suffix
• asyn-ares: correct some bad comments
• bearssl: fix build with disabled proxy support
• buildconf: avoid array concatenation in die()
• buildconf: retire ares buildconf invocation
• checksrc: ban gmtime/localtime
• checksrc: invoke script with -D to find .checksrc proper
• CI/azure: install libssh2 for use with msys2-based builds
• CI/azure: unconditionally enable warnings-as-errors with autotools
• CI/macos: enable warnings as errors for CMake builds
• CI/macos: set minimum macOS version
• CI/macos: unconditionally enable warnings-as-errors with autotools
• CI: Add muse CI analyzer
• cirrus-ci: upgrade 11-STABLE to 11.4
• CMake: don't complain about missing nroff
• CMake: fix test for warning suppressions
• cmake: fix windows xp build
• configure.ac: Sort features name in summary
• configure: allow disabling warnings
• configure: cleanup wolfssl + pkg-config conflicts when cross compiling.
• configure: show zstd "no" in summary when built without it
• connect: remove redundant message about connect failure
• curl-config: ignore REQUIRE_LIB_DEPS in --libs output
• curl.1: add a few missing valid exit codes
• curl: add %{method} to the -w variables
• curl: improve the existing file check with -J
• curl_multi_setopt: fix compiler warning "result is always false"
• curl_version_info.3: CURL_VERSION_KERBEROS4 is deprecated
• CURLINFO_CERTINFO.3: fix typo
• CURLOPT_NOBODY.3: clarify what setting to 0 means
• docs: add date of 7.20 to CURLM_CALL_MULTI_PERFORM mentions
• docs: Add video link to docs/CONTRIBUTE.md
• docs: change "website" to "website"
• docs: clarify MAX_SEND/RECV_SPEED functionality
• docs: Update a few leftover mentions of DarwinSSL
• doh: remove redundant cast
• file2memory: use a define instead of -1 unsigned value
• ftp: don't do ssl_shutdown instead of ssl_close
• ftpserver: don't verify SMTP MAIL FROM names
• getinfo: reset retry-after value in initinfo
• gnutls: repair the build with `CURL_DISABLE_PROXY`
• gtls: survive not being able to get name/issuer
• h2: repair trailer handling
• http2: close the http2 connection when no more requests may be sent
• http2: fix nghttp2_strerror -> nghttp2_http2_strerror in debug messages
• libssh2: s/ssherr/sftperr/
• libtest/Makefile.am: add -no-undefined for libstubgss for Cygwin
• md(4|5): don't use deprecated macOS functions
• mprintf: Fix dollar string handling
• mprintf: Fix stack overflows
• multi: Condition 'extrawait' is always true
• multi: Remove 10-year old out-commented code
• multi: remove two checks always true
• multi: update comment to say easyp list is linear
• multi_remove_handle: close unused connect-only connections
• ngtcp2: adapt to error code rename
• ngtcp2: adjust to recent sockaddr updates
• ngtcp2: update to modified qlog callback prototype
• nss: fix build with disabled proxy support
• ntlm: free target_info before (re-)malloc
• openssl: fix build with LibreSSL < 2.9.1
• page-header: provide protocol details in the curl.1 manpage
• quiche: handle calling disconnect twice
• runtests.pl: treat LibreSSL and BoringSSL as OpenSSL
• runtests: move the gnutls-serv tests to a dynamic port
• runtests: move the smbserver to use a dynamic port number
• runtests: move the TELNET server to a dynamic port
• runtests: run the DICT server on a random port number
• runtests: run the http2 tests on a random port number
• runtests: support dynamicly base64 encoded sections in tests
• setopt: unset NOBODY switches to GET if still HEAD
• smtp_parse_address: handle blank input string properly
• socks: use size_t for size variable
• strdup: remove the odd strlen check
• test1119: verify stdout in the test
• test1139: make it display the difference on test failures
• test1140: compare stdout
• test1908: treat file as text
• tests/FILEFORMAT.md: mention %HTTP2PORT
• tests/sshserver.pl: fix compatibility with OpenSSH for Windows
• TLS naming: fix more Winssl and Darwinssl leftovers
• tls-max.d: this option is only for TLS-using connections
• tlsv1.3.d. only for TLS-using connections
• tool_doswin: Simplify Windows version detection
• tool_getparam: make --krb option work again
• TrackMemory tests: ignore realloc and free in getenv.c
• transfer: fix data_pending for builds with both h2 and h3 enabled
• transfer: fix memory-leak with CURLOPT_CURLU in a duped handle
• transfer: move retrycount from connect struct to easy handle
• travis/script.sh: fix use of `-n' with unquoted envvar
• travis: add ppc64le and s390x builds
• travis: update quiche builds for new boringssl layout
• url: fix CURLU and location following
• url: silence MSVC warning
• util: silence conversion warnings
• win32: Add Curl_verify_windows_version() to curlx
• WIN32: stop forcing narrow-character API
• windows: add unicode to feature list
• windows: disable Unix Sockets for old mingw

Further