Pending RELEASE-NOTES for the upcoming release

This is work in progress and seeing changes before the release goes public on 2026-12-09.

Changes:

Bugfixes:

• altsvc: cap 'ma' values at two years maximum
• API: readonly calls and callbacks
• apple sectrust: require OCSP for cert-status
• autotools: drop adjacent duplicate `LDFLAGS` from `libcurl.pc`
• autotools: drop adjacent duplicate `LIBS` from `libcurl.pc`
• cert-status: tests and fixes
• CMake/unix-cache.cmake: document BSD version requirements for two features
• cmake: drop duplicate deduplication of linker flags
• cmake: fix detecting `netinet/ip.h` on OpenBSD, FreeBSD <14.3 (HTTP/3)
• cmake: fix preconditions for option `CURL_STATIC_CRT=ON`
• cmake: silence MSVC linker warning in debug builds with `CURL_DROP_UNUSED=ON`
• conncache: poll an idle connection for pending input on every reuse
• cookie: reload complete self-generated cookie jar rows
• curl: apply --hsts to ipfs:// and ipns:// gateway requests
• curl_getdate.md: clarify that the weekday name means nothing
• curl_memrchr: keep reverse searches within the buffer
• curl_setup.h: fix dangling pointer in Unicode `CURL_DUMP_MODULE_PATHS()` (Windows)
• cw-pause: only pass EOS with the last flushed piece
• DEPENDENCIES.md: document LibreSSL 3.4.1+ as required (due to TLSv1.3 API)
• docs: encourage verifying tarball before unpacking
• doh: inherit the CURLOPT_DNS_* options from the mother transfer
• examples: simplify timeout handling in multi-uv.c
• ftp: return the error from an invalid range on download
• getinfo: clarify invalid URL handling for CURLINFO_EFFECTIVE_URL
• gtls/sectrust: fix ocsp checks
• http2: do not let a rate limit enlarge the stream window
• http2: fail the parent transfer on CURL_PUSH_ERROROUT
• INSTALL-CMAKE.md: update 'Testing' section
• INSTALL.md: various updates and improvements
• libssh2: make the knownhost name check also verify length
• libssh: refuse SCP downloads large than CURL_OFF_T_MAX
• mk-ca-bundle.pl: add `-x` option to exclude specific CA roots
• mk-ca-bundle.pl: include SHA-256 fingerprint for each CA root
• mk-ca-bundle.pl: restore option for NSS repo
• msvc: replace debug CRT GUI popups with stderr output
• multi: undo the counters when curl_multi_add_handle fails
• ngh2: a shim in front of nghttp2 calls
• openssl: avoid CA caching for providers
• openssl: avoid OpenSSL API namespace for local fallback symbol
• parsedate: minor simplifications
• pingpong: allow impa to add a prefix directly
• processhelp.pm: improve task info in trace output (Windows)
• proxy: fix 0.0.0.0/0 and ::/0 CIDR matching
• pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont. 2)
• pytest: adjust threshold in test_20_11_crazy_pings to better pass on arm64 (cont.)
• pytest: timeline check time_queue
• rtsp: refuse doing uploads with CRLF conversions
• runtests: add `-S` option to show success logs
• runtests: add with/without-server test feature tags
• runtests: disable test server log output on feature detection
• runtests: pass `--disable` to more curl feature detection invocations
• runtests: retrieve curl version without using disk files
• setopt: fix setting `CURLWS_NOAUTOPONG` with compilers lacking C99 bool type
• setopt: keep a paused transfer paused when the speed limit is changed
• share: connection pool shutdowns
• slist: duplicate lists in linear time
• socketpair: fix compiler warning `-Wunreachable-code`
• test1488: drop unused C preprocessor logic
• test3230: delete local edit committed by accident
• test776: delete long-running, flaky, NTLM stress test
• test: fix test_60_h3_proxy.py to include scheme in log line
• test_06_eyeballs: silence Code Quality warning
• tests/server: fix crashing with VS2013 and earlier
• tests: drop unused includes
• tests: use %TESTNUMBER more instead of the actual test number
• testutil: better function implementation
• tidy-up: simplify CRTDBG logic in `generate.bat`
• tool: append buffered response headers in constant time
• tool: preserve absent schemes when appending upload filenames
• tool_cb_hdr: treat an empty -J filename as no filename
• tool_operhlp: trim remote filename separators in linear time
• transfer: drop a pending read rewind when a new transfer starts
• urlapi: check host for bad content after IDN decode
• urldata: move OpenSSL provider state to OpenSSL context struct
• VERSIONS: add the new rock-solid curl releases
• vtls: encode session peer key fields unambiguously
• vtls_scache: add scheme name to session key
• vtls_scache: if using native-ca, use that in key
• VULN-DISCLOSURE-POLICY.md: officially don't care for old issues
• wolfssl: require a peer certificate when verifying
• x509: verify that ASN.1 parsing does not get out of sync
• x509asn1: free the field buffer when a public key value fails to convert

Contributors:

akashdeshmukh-git, Bootherr on hackerone, Dan Fandrich, Daniel McCarney, Daniel Stenberg, Daniel Wade, David H-yan, David H_YAN, Jeremy Levartovsky, Jon DeVree, Kartatz on github, Martin Mirchev, Martin Vlach, Máté Szabó, matty69v, Mihai-Gabriel Marin, Nora Qiu, Patrick Monnerat, pszemus, Ray Satiro, renovate[bot], revolik on hackerone, Rhino, Roger Light, Samuel Henrique, Stefan Eissing, stze on hackerone, Sujit Jaunjal, Umut, vansukmbg on hackerone, Vasiliy-Kkk, Viktor Szakats, Zefan Xu, Zheng Yu