curl and libcurl 8.23.1

 Public curl releases:         277
 Command line options:         278
 curl_easy_setopt() options:   312
 Public functions in libcurl:  100
 Authors:                      1571
 Contributors:                 3882

This release includes the following changes:

 o NTLM: drop support [162]

This release includes the following bugfixes:

 o altsvc: cap 'ma' values at two years maximum [17]
 o altsvc: percent-decode the protocol-id before mapping [164]
 o amiga: use native socket error accessors on classic AmigaOS [122]
 o API: readonly calls and callbacks [51]
 o apple sectrust: require OCSP for cert-status [10]
 o autotools: drop adjacent duplicate `LDFLAGS` from `libcurl.pc` [14]
 o autotools: drop adjacent duplicate `LIBS` from `libcurl.pc` [73]
 o autotools: respect `SED` variable where missing [172]
 o cert-status: tests and fixes [5]
 o CMake/unix-cache.cmake: document BSD version requirements for two features [85]
 o cmake: detect, display and verify LibreSSL version [158]
 o cmake: drop duplicate deduplication of linker flags [13]
 o cmake: enable MSVC `-sdl` picky compiler option [138]
 o cmake: fix detecting `netinet/ip.h` on OpenBSD, FreeBSD <14.3 (HTTP/3) [86]
 o cmake: fix preconditions for option `CURL_STATIC_CRT=ON` [15]
 o cmake: omit pthread dependency when building with AWS-LC 5.6.0+ and mingw-w64 [43]
 o cmake: revert to use pthreads for mingw-w64 gcc AWS-LC builds [42]
 o cmake: silence MSVC linker warning in debug builds with `CURL_DROP_UNUSED=ON` [11]
 o cmake: verify OpenSSL 3+ version early [157]
 o conncache: poll an idle connection for pending input on every reuse [27]
 o connect: bound post-connect blocking connects by their own start [125]
 o connect: tweak the timeout handling [115]
 o connection close: additional checks [44]
 o connection health check: always on idle connections [175]
 o content encoding: reject incomplete zlib streams (gzip, deflate) [75]
 o content_encoding: reject incomplete brotli streams [165]
 o cookie: reload complete self-generated cookie jar rows [24]
 o cshutdown: fix event handling [120]
 o curl: apply --hsts to ipfs:// and ipns:// gateway requests [70]
 o curl_getdate.md: clarify that the weekday name means nothing [29]
 o curl_memrchr: keep reverse searches within the buffer [35]
 o curl_setup.h: fix dangling pointer in Unicode `CURL_DUMP_MODULE_PATHS()` (Windows) [49]
 o cw-pause: only pass EOS with the last flushed piece [57]
 o DEPENDENCIES.md: document LibreSSL 3.4.1+ as required (due to TLSv1.3 API) [83]
 o digest: only percent-encode control codes in quoted values [112]
 o Dockerfile: update debian:bookworm-slim Docker digest to 99c0b25 [45]
 o docs/cmdline-opts/retry.md: mention duplicate data with redirected output [159]
 o docs: clarify WebSocket send retries after CURLE_AGAIN
 o docs: document curl_easy_send retry arg restrictions [103]
 o docs: encourage verifying tarball before unpacking [89]
 o docs: fix 'remove directory' typo in TODO.md [163]
 o docs: minor unit test updates [68]
 o doh: inherit the CURLOPT_DNS_* options from the mother transfer [82]
 o examples: simplify timeout handling in multi-uv.c [31]
 o file: reject a -Y range larger than the file [67]
 o formdata: reject NULL filename and buffer name options [129]
 o ftp: return the error from an invalid range on download [21]
 o ftplistparser: cap the max amount of wildcard entries [111]
 o getinfo: clarify invalid URL handling for CURLINFO_EFFECTIVE_URL [90]
 o gtls/sectrust: fix ocsp checks [56]
 o http2: do not let a rate limit enlarge the stream window [66]
 o http2: fail the parent transfer on CURL_PUSH_ERROROUT [64]
 o http: protocol filters [102]
 o http: use memchr() in Curl_verify_header [41]
 o http_aws_sigv4: use qsort instead of bubble sort [135]
 o imap: fail on multiple literals in custom FETCH response [121]
 o INSTALL-CMAKE.md: update 'Testing' section [93]
 o INSTALL.md: various updates and improvements [87]
 o ldap: return 'AppleLDAP' version string for Apple's legacy OpenLDAP fork [171]
 o lib: drop unused `linux/tcp.h`, `netinet/tcp.h` includes [148]
 o lib: drop unused functions, make single-use ones static [105]
 o lib: drop using `linux/tcp.h` kernel header for the FastOpen feature [136]
 o lib: make private functions static [60]
 o libssh2: make the knownhost name check also verify length [19]
 o libssh: refuse SCP downloads large than CURL_OFF_T_MAX [71]
 o libssh: try the agent and default keys when the key file guess fails [143]
 o macos: handle close during connect [132]
 o mk-ca-bundle.pl: add `-x` option to exclude specific CA roots [52]
 o mk-ca-bundle.pl: include SHA-256 fingerprint for each CA root [55]
 o mk-ca-bundle.pl: restore option for NSS repo [32]
 o msvc: replace debug CRT GUI popups with stderr output [34]
 o multi: return the error from curl_multi_socket_all [131]
 o multi: undo the counters when curl_multi_add_handle fails [30]
 o ngh2: a shim in front of nghttp2 calls [39]
 o openssl: avoid CA caching for providers [91]
 o openssl: avoid OpenSSL API namespace for local fallback symbol [46]
 o openssl: block eMudhra certs from Windows ca-native import [173]
 o openssl: stop I/O after fatal shutdown errors [155]
 o parsedate: minor simplifications [25]
 o peer: extract host name punycoded [127]
 o peer: use the given proxy port, fall back to the documented default [152]
 o pingpong: allow impa to add a prefix directly [7]
 o processhelp.pm: improve task info in trace output (Windows) [77]
 o proxy: fix 0.0.0.0/0 and ::/0 CIDR matching [12]
 o pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont. 2) [37]
 o pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont.) [84]
 o pytest: don't use a regex for a simple string search
 o pytest: timeline check time_queue [40]
 o rtsp: refuse doing uploads with CRLF conversions [20]
 o runtests: add `-S` option to show success logs [3]
 o runtests: add with/without-server test feature tags [62]
 o runtests: disable test server log output on feature detection [95]
 o runtests: enable retries for threaded tests [99]
 o runtests: pass `--disable` to more curl feature detection invocations [94]
 o runtests: retrieve curl version without using disk files [96]
 o rustls: reject retries shorter than buffered plaintext [36]
 o scripts: don't insist on all executable bits on scripts [161]
 o SECURITY-ADVISORY: document some news [149]
 o SECURITY: remove a dupe link, drop "confidentiality" mention [145]
 o sendf: clear reader stack when line-conversion setup fails [150]
 o setopt: fix setting `CURLWS_NOAUTOPONG` with compilers lacking C99 bool type [16]
 o setopt: keep a paused transfer paused when the speed limit is changed [63]
 o share: connection pool shutdowns [28]
 o singleuse.pl: make it CMake compatible, fix to fail when input is missing [106]
 o slist: duplicate lists in linear time [6]
 o smtp: avoid signed overflow in dot-stuffing [142]
 o socketpair: fix compiler warning `-Wunreachable-code` [9]
 o telnet: return errors when poll or reading the input fails [130]
 o test 1623: add test data [176]
 o test-linter.pl: detect duplicate sections and superfluous comments [98]
 o test1488: drop unused C preprocessor logic [79]
 o test20: fix to move `may-retry-on-valgrind` to the keywords section [167]
 o test2501, test2502: add missing `nghttpx-h3` feature [117]
 o test3230: delete local edit committed by accident
 o test3500: delete redundant feature requirement [116]
 o test776: delete long-running, flaky, NTLM stress test [61]
 o test: add unit tests for Curl_range [108]
 o test: fix test_60_h3_proxy.py to include scheme in log line [72]
 o test_06_eyeballs: silence Code Quality warning [2]
 o tests/data: add missing `nghttpx` feature tags, and one minor tidy-up [156]
 o tests/data: delete repetitive comments [114]
 o tests/data: drop stray `data` section, merge duplicate `features` sections [109]
 o tests/server: fix crashing with VS2013 and earlier [4]
 o tests/servers.pm: minor improvements [110]
 o tests: drop unused includes [74]
 o tests: exclude 2088, 2089, 2095 (mTLS), 17_01_sslinfo_plain for LibreSSL 4.4.0 due to upstream limit [154]
 o tests: move non-libtest `libtest/*.pl` scripts one level up [118]
 o tests: use %TESTNUMBER more instead of the actual test number [88]
 o testutil: better function implementation [23]
 o tidy-up: perl formatting nits [119]
 o tidy-up: simplify CRTDBG logic in `generate.bat` [33]
 o tool: append buffered response headers in constant time [78]
 o tool: preserve absent schemes when appending upload filenames [22]
 o tool: reject more than 2 GB of data to URL encode [133]
 o tool_cb_hdr: do not truncate existing file on filename-less C-D header [101]
 o tool_cb_hdr: treat an empty -J filename as no filename [65]
 o tool_getparam: preserve field names for empty URL-encoded files [76]
 o tool_getpass: keep the last character when there is no newline [126]
 o tool_operhlp: trim remote filename separators in linear time [81]
 o tool_paramhlp: reject trailing garbage in seconds arguments [146]
 o tool_parsecfg: accept indented options and CRLF line endings again [128]
 o tool_parsecfg: count skipped lines in config file line numbers [26]
 o tool_progress: avoid forward declaration [141]
 o tool_progress: count retried transfers once [144]
 o tool_writeout_json: escape bytes that are not UTF-8 [47]
 o transfer: drop a pending read rewind when a new transfer starts [54]
 o urlapi: check host for bad content after IDN decode [18]
 o urlapi: copy whole path segments in dedotdotify() [113]
 o urlapi: do not add the zone id twice to a set IPv6 host [59]
 o urlapi: do not pass a NULL path to printf for file URLs [48]
 o urlapi: make zoneids starting with 25 to work [168]
 o urlapi: return a blank user blank even with CURLU_URLENCODE [166]
 o urldata: move OpenSSL provider state to OpenSSL context struct [1]
 o VERSIONS: add the new rock-solid curl releases
 o vtls: encode session peer key fields unambiguously [8]
 o vtls: remove cf_ssl_is_alive() [123]
 o vtls_scache: add auto-client awareness to session key [104]
 o vtls_scache: add scheme name to session key [92]
 o vtls_scache: if using native-ca, use that in key [50]
 o VULN-DISCLOSURE-POLICY.md: officially don't care for old issues [69]
 o VULN-DISCLOSURE-POLICY.md: take severity < HIGH to GitHub [38]
 o wolfssl: get the public key to pin from wolfSSL [100]
 o wolfssl: require a peer certificate when verifying [53]
 o writeout: write JSON strings in chunks instead of buffering them [107]
 o ws: get random masks in batches [134]
 o ws: mask outgoing payload in chunks [97]
 o ws: set seen_close only after the whole CLOSE frame [124]
 o x509: verify that ASN.1 parsing does not get out of sync [80]
 o x509asn1: free the field buffer when a public key value fails to convert [58]

This release includes the following known bugs:

 See https://curl.se/docs/knownbugs.html

For all changes ever done in curl:

 See https://curl.se/changes.html

Planned upcoming removals include:

 o Common Name support in TLS certificates for OpenSSL
 o HTTP/2 Server Push
 o local crypto implementations
 o NTLM

 See https://curl.se/dev/deprecate.html

This release would not have looked like this without help, code, reports and
advice from friends like these:

  11soda11, Achim Friedland, akasakariko, akashdeshmukh-git, AP, Armaan Sandhu,
  Bob Swanson, Bootherr on hackerone, chengr28 on github,
  christos-cantina-security on github, Dan Fandrich, Daniel McCarney,
  Daniel Stenberg, Daniel Wade, David H-yan, dependabot[bot], Derek Martin,
  Dilshod Urazov, Harry Sintonen, heppycat, Jeremy Levartovsky, Johnny Kao,
  Jon DeVree, Kartatz on github, Khaled, Lukas Gelbmann, Martin Mirchev,
  Martin Vlach, Máté Szabó, matty69v, Max Dymond, Michiel van Slobbe,
  Mihai-Gabriel Marin, Mohammadreza Khellat, Nora Qiu, Patrick Monnerat,
  plv1313 on github, pszemus, Ray Satiro, renovate[bot], revolik on hackerone,
  Rhino, Roger Light, Sai Harsha, Samuel Henrique, Stefan Eissing,
  Stefan Reinauer, Stephen Augustus, stze on hackerone, Sujit Jaunjal,
  Treston Cuzzort, Umut, vansukmbg on hackerone, Vasiliy-Kkk, Victor Hugo,
  Viktor Szakats, Vishnu Srivatsava, Zefan Xu, Zheng Yu
  (59 contributors)

References to bug reports and discussions on issues:

 [1] = https://curl.se/bug/?i=23436
 [2] = https://curl.se/bug/?i=23367
 [3] = https://curl.se/bug/?i=23381
 [4] = https://curl.se/bug/?i=23306
 [5] = https://curl.se/bug/?i=23420
 [6] = https://curl.se/bug/?i=23361
 [7] = https://curl.se/bug/?i=23373
 [8] = https://curl.se/bug/?i=23357
 [9] = https://curl.se/bug/?i=23437
 [10] = https://curl.se/bug/?i=23430
 [11] = https://curl.se/bug/?i=23435
 [12] = https://curl.se/bug/?i=23434
 [13] = https://curl.se/bug/?i=23427
 [14] = https://curl.se/bug/?i=23348
 [15] = https://curl.se/bug/?i=23336
 [16] = https://curl.se/bug/?i=23306
 [17] = https://curl.se/bug/?i=23429
 [18] = https://hackerone.com/reports/4129950
 [19] = https://curl.se/bug/?i=23423
 [20] = https://curl.se/bug/?i=23425
 [21] = https://curl.se/bug/?i=23524
 [22] = https://curl.se/bug/?i=23402
 [23] = https://curl.se/bug/?i=23422
 [24] = https://curl.se/bug/?i=23407
 [25] = https://curl.se/bug/?i=23417
 [26] = https://curl.se/bug/?i=23600
 [27] = https://hackerone.com/reports/4098761
 [28] = https://curl.se/bug/?i=23404
 [29] = https://curl.se/bug/?i=23413
 [30] = https://curl.se/bug/?i=23526
 [31] = https://curl.se/bug/?i=23408
 [32] = https://curl.se/bug/?i=23537
 [33] = https://curl.se/bug/?i=23410
 [34] = https://curl.se/bug/?i=23400
 [35] = https://curl.se/bug/?i=23538
 [36] = https://curl.se/bug/?i=23494
 [37] = https://curl.se/bug/?i=23468
 [38] = https://curl.se/bug/?i=23483
 [39] = https://curl.se/bug/?i=23504
 [40] = https://curl.se/bug/?i=23531
 [41] = https://curl.se/bug/?i=23589
 [42] = https://curl.se/bug/?i=23593
 [43] = https://curl.se/bug/?i=23591
 [44] = https://curl.se/bug/?i=23629
 [45] = https://curl.se/bug/?i=23643
 [46] = https://curl.se/bug/?i=23520
 [47] = https://curl.se/bug/?i=23584
 [48] = https://curl.se/bug/?i=23585
 [49] = https://curl.se/bug/?i=23512
 [50] = https://curl.se/bug/?i=23495
 [51] = https://curl.se/bug/?i=23096
 [52] = https://curl.se/bug/?i=23508
 [53] = https://curl.se/bug/?i=23503
 [54] = https://curl.se/bug/?i=23505
 [55] = https://curl.se/bug/?i=23502
 [56] = https://curl.se/bug/?i=23486
 [57] = https://curl.se/bug/?i=23461
 [58] = https://curl.se/bug/?i=23459
 [59] = https://curl.se/bug/?i=23586
 [60] = https://curl.se/bug/?i=23644
 [61] = https://curl.se/bug/?i=23493
 [62] = https://curl.se/bug/?i=23492
 [63] = https://curl.se/bug/?i=23462
 [64] = https://curl.se/bug/?i=23481
 [65] = https://curl.se/bug/?i=23469
 [66] = https://curl.se/bug/?i=23472
 [67] = https://curl.se/bug/?i=23581
 [68] = https://curl.se/bug/?i=23645
 [69] = https://curl.se/bug/?i=23470
 [70] = https://curl.se/bug/?i=23454
 [71] = https://curl.se/bug/?i=23474
 [72] = https://curl.se/bug/?i=23477
 [73] = https://curl.se/bug/?i=23447
 [74] = https://curl.se/bug/?i=23316
 [75] = https://curl.se/bug/?i=23669
 [76] = https://curl.se/bug/?i=23577
 [77] = https://curl.se/bug/?i=23467
 [78] = https://curl.se/bug/?i=23352
 [79] = https://curl.se/bug/?i=23471
 [80] = https://curl.se/bug/?i=23426
 [81] = https://curl.se/bug/?i=23405
 [82] = https://curl.se/bug/?i=23456
 [83] = https://curl.se/bug/?i=23466
 [84] = https://curl.se/bug/?i=23468
 [85] = https://curl.se/bug/?i=23464
 [86] = https://curl.se/bug/?i=23448
 [87] = https://curl.se/bug/?i=23455
 [88] = https://curl.se/bug/?i=23395
 [89] = https://curl.se/bug/?i=23441
 [90] = https://curl.se/bug/?i=23444
 [91] = https://curl.se/bug/?i=23453
 [92] = https://curl.se/bug/?i=23452
 [93] = https://curl.se/bug/?i=23438
 [94] = https://curl.se/bug/?i=23450
 [95] = https://curl.se/bug/?i=23424
 [96] = https://curl.se/bug/?i=23442
 [97] = https://curl.se/bug/?i=23567
 [98] = https://curl.se/bug/?i=23573
 [99] = https://curl.se/bug/?i=23552
 [100] = https://curl.se/bug/?i=23516
 [101] = https://curl.se/bug/?i=23501
 [102] = https://curl.se/bug/?i=23385
 [103] = https://curl.se/bug/?i=23578
 [104] = https://curl.se/bug/?i=23570
 [105] = https://curl.se/bug/?i=23642
 [106] = https://curl.se/bug/?i=23641
 [107] = https://curl.se/bug/?i=23535
 [108] = https://curl.se/bug/?i=23236
 [109] = https://curl.se/bug/?i=23571
 [110] = https://curl.se/bug/?i=23543
 [111] = https://curl.se/bug/?i=23633
 [112] = https://curl.se/bug/?i=23683
 [113] = https://curl.se/bug/?i=23628
 [114] = https://curl.se/bug/?i=23562
 [115] = https://curl.se/bug/?i=23558
 [116] = https://curl.se/bug/?i=23560
 [117] = https://curl.se/bug/?i=23559
 [118] = https://curl.se/bug/?i=23556
 [119] = https://curl.se/bug/?i=23550
 [120] = https://curl.se/bug/?i=23551
 [121] = https://curl.se/bug/?i=23010
 [122] = https://curl.se/bug/?i=23695
 [123] = https://curl.se/bug/?i=23687
 [124] = https://curl.se/bug/?i=23627
 [125] = https://curl.se/bug/?i=23528
 [126] = https://curl.se/bug/?i=23525
 [127] = https://curl.se/bug/?i=23613
 [128] = https://curl.se/bug/?i=23499
 [129] = https://curl.se/bug/?i=23534
 [130] = https://curl.se/bug/?i=23548
 [131] = https://curl.se/bug/?i=23549
 [132] = https://curl.se/bug/?i=23510
 [133] = https://curl.se/bug/?i=23547
 [134] = https://curl.se/bug/?i=23595
 [135] = https://curl.se/bug/?i=23624
 [136] = https://curl.se/bug/?i=23618
 [138] = https://curl.se/bug/?i=23707
 [141] = https://curl.se/bug/?i=23610
 [142] = https://curl.se/bug/?i=23604
 [143] = https://curl.se/bug/?i=23518
 [144] = https://curl.se/bug/?i=23498
 [145] = https://curl.se/bug/?i=23608
 [146] = https://curl.se/bug/?i=23500
 [148] = https://curl.se/bug/?i=23601
 [149] = https://curl.se/bug/?i=23605
 [150] = https://curl.se/bug/?i=23596
 [152] = https://curl.se/bug/?i=23681
 [154] = https://curl.se/bug/?i=23675
 [155] = https://gist.github.com/cmeister2/ef763a8464826adb3c61823b9f5e5710
 [156] = https://curl.se/bug/?i=23679
 [157] = https://curl.se/bug/?i=23678
 [158] = https://curl.se/bug/?i=23677
 [159] = https://curl.se/bug/?i=23670
 [161] = https://curl.se/bug/?i=23656
 [162] = https://curl.se/bug/?i=22933
 [163] = https://curl.se/bug/?i=23667
 [164] = https://curl.se/bug/?i=23654
 [165] = https://curl.se/bug/?i=23615
 [166] = https://curl.se/bug/?i=23659
 [167] = https://curl.se/bug/?i=23666
 [168] = https://curl.se/bug/?i=23658
 [171] = https://curl.se/bug/?i=23651
 [172] = https://curl.se/bug/?i=23592
 [173] = https://curl.se/bug/?i=23542
 [175] = https://curl.se/bug/?i=23621
 [176] = https://curl.se/bug/?i=23648
