                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.50.1 (3 Aug 2016)

Daniel Stenberg (3 Aug 2016)
- THANKS: 7 new contributors from the 7.50.1 release

- RELEASE-NOTES: 7.50.1

- TLS: only reuse connections with the same client cert
  
  CVE-2016-5420
  Bug: https://curl.haxx.se/docs/adv_20160803B.html

- TLS: switch off SSL session id when client cert is used
  
  CVE-2016-5419
  Bug: https://curl.haxx.se/docs/adv_20160803A.html
  Reported-by: Bru Rom
  Contributions-by: Eric Rescorla and Ray Satiro

- curl_multi_cleanup: clear connection pointer for easy handles
  
  CVE-2016-5421
  Bug: https://curl.haxx.se/docs/adv_20160803C.html
  Reported-by: Marcelo Echeverria and Fernando Muñoz

- KNOWN_BUGS: SOCKS proxy not working via IPv6
  
  Closes #835

- KNOWN_BUGS: CURLOPT_SEEKFUNCTION not called with CURLFORM_STREAM
  
  Closes #768

- KNOWN_BUGS: transfer-encoding: chunked in HTTP/2
  
  Closes #662

- TODO: Provide cmake config-file
  
  Closes #885

Patrick Monnerat (2 Aug 2016)
- os400: define BUILDING_LIBCURL in make script.

Daniel Stenberg (1 Aug 2016)
- RELEASE-NOTES: synced with aa9f536a18b

Jay Satiro (1 Aug 2016)
- [Thomas Glanzmann brought this change]

  mbedtls: Fix debug function name
  
  This patch is necessary so that curl compiles if MBEDTLS_DEBUG is
  defined.
  
  Bug: https://curl.haxx.se/mail/lib-2016-08/0001.html

Daniel Stenberg (1 Aug 2016)
- [Sergei Nikulov brought this change]

  travis: fix OSX build by re-installing libtool
  
  Apparently due to a broken homebrew install
  
  fixes #934
  Closes #939

- [Martin Vejnár brought this change]

  win32: fix a potential memory leak in Curl_load_library
  
  If a call to GetSystemDirectory fails, the `path` pointer that was
  previously allocated would be leaked. This makes sure that `path` is
  always freed.
  
  Closes #938

- include: revert 9adf3c4 and make public types void * again
  
  Many applications assume the actual contents of the public types and use
  that do for example forward declarations (saving them from including our
  public header) which then breaks when we switch from void * to a struct
  *.
  
  I'm not convinced we were wrong, but since this practise seems
  widespread enough I'm willing to (partly) step down.
  
  Now libcurl uses the struct itself when it is built and it allows
  applications to use the struct type if CURL_STRICTER is defined at the
  time of the #include.
  
  Reported-by: Peter Frühberger
  Fixes #926

Jay Satiro (28 Jul 2016)
- [Yonggang Luo brought this change]

  cmake: Fix for schannel support
  
  The check_library_exists_concat do not check crypt32 library properly.
  So include it directly.
  
  Bug: https://github.com/curl/curl/pull/917
  Reported-by: Yonggang Luo
  
  Bug: https://github.com/curl/curl/issues/935
  Reported-by: Alain Danteny

- Revert "travis: Install libtool for OS X builds"
  
  Didn't work.
  
  This reverts commit 50723585ed380744358de054e2a55dccee65dfd7.

- travis: Install libtool for OS X builds
  
  CI is failing due to missing libtoolize, so I'm trying this.

Daniel Stenberg (26 Jul 2016)
- [Viktor Szakats brought this change]

  TODO: minor typo in last commit
  
  merged #931

- TODO: Timeout idle connections from the pool

Patrick Monnerat (25 Jul 2016)
- os400: minimum supported OS version: V6R1M0.
  Do not log compilation informational messages.

Jay Satiro (24 Jul 2016)
- tests: Fix for http/2 feature
  
  Bug: https://curl.haxx.se/mail/lib-2016-07/0070.html
  Reported-by: Paul Howarth

Steve Holme (23 Jul 2016)
- README: Mention wolfSSL in the 'Dependencies' section

- vauth.h: No need to query HAVE_GSSAPI || USE_WINDOWS_SSPI for SPNEGO
  
  As SPNEGO is only defined when these pre-processor variables are defined
  there is no need to query them explicitly.

- spnego: Corrected miss-placed * in Curl_auth_spnego_cleanup() declaration
  
  Typo introduced in commit ad5e9bfd5d.

Daniel Stenberg (22 Jul 2016)
- SECURITY: mention how to get windows-specific CVEs
  
  ... and make the distros link a proper link

Dan Fandrich (21 Jul 2016)
- test558: fix test by stripping file paths from FD lines

Kamil Dudka (21 Jul 2016)
- tests: distribute the http2-server.pl script, too

- docs: distribute the CURLINFO_HTTP_VERSION(3) man page, too

Daniel Stenberg (21 Jul 2016)
- bump: start working on 7.50.1

Version 7.50.0 (21 Jul 2016)

Daniel Stenberg (21 Jul 2016)
- RELEASE-NOTES: version 7.50.0 ready

- THANKS: 13 new contributors from the 7.50.0 release

Jay Satiro (21 Jul 2016)
- winbuild: fix embedded manifest option
  
  Embedded manifest option didn't work due to typo.
  
  Reported-by: Stefan Kanthak

- vauth: Fix memleak by freeing credentials if out of memory
  
  This is a follow up to the parent commit dcdd4be which fixes one leak
  but creates another by failing to free the credentials handle if out of
  memory. Also there's a second location a few lines down where we fail to
  do same. This commit fixes both of those issues.

Daniel Stenberg (20 Jul 2016)
- [Saurav Babu brought this change]

  vauth: Fixed memory leak due to function returning without free
  
  This patch allocates memory to "output_token" only when it is required
  so that memory is not leaked if function returns.

- test558: updated after ipv6-check move
  
  Follow-up commit to c50980807c5 to make this test pass.

Jay Satiro (20 Jul 2016)
- connect: disable TFO on Linux when using SSL
  
  - Linux TFO + TLS is not implemented yet.
  
  Bug: https://github.com/curl/curl/issues/907

Daniel Stenberg (19 Jul 2016)
- ROADMAP: QUIC and TLS 1.3

- RELEASE-NOTES: synced with c50980807c5

Jay Satiro (18 Jul 2016)
- [Brian Prodoehl brought this change]

  curl_global_init: Check if IPv6 works
  
  - Curl_ipv6works() is not thread-safe until after the first call, so
  call it once during global init to avoid a possible race condition.
  
  Bug: https://github.com/curl/curl/issues/915
  PR: https://github.com/curl/curl/pull/918

- [Timothy Polich brought this change]

  CURLMOPT_SOCKETFUNCTION.3: fix typo
  
  Closes https://github.com/curl/curl/pull/914

- [Miroslav Franc brought this change]

  library: Fix memory leaks found during static analysis
  
  Closes https://github.com/curl/curl/pull/913

- [Viktor Szakats brought this change]

  cookie.c: Fix misleading indentation
  
  Closes https://github.com/curl/curl/pull/911

- FAQ: Update FTP directory listing section for MLSD command
  
  Explain how some FTP servers support the machine readable listing
  format MLSD from RFC 3659 and compare it to LIST.
  
  Ref: https://github.com/curl/curl/issues/906

Daniel Stenberg (1 Jul 2016)
- [Sergei Nikulov brought this change]

  Appveyor: Updates for options - CURL_STATICLIB/BUILD_TESTING
  
  Closes #892

- TODO: 17.4 also brings more HTTP/2 support

- TODO: try next proxy if one doesn't work
  
  Closes #896

- conn: don't free easy handle data in handler->disconnect
  
  Reported-by: Gou Lingfeng
  Bug: https://curl.haxx.se/mail/lib-2016-06/0139.html

- test1244: test different proxy ports same URL

- curl_global_init.3: improved formatting of the flags

- curl_global_init.3: expand on the SSL and WIN32 bits purpose
  
  Reported-by: Richard Gray
  Bug: https://curl.haxx.se/mail/lib-2016-06/0136.html

- [Michael Kaufmann brought this change]

  cleanup: minor code cleanup in Curl_http_readwrite_headers()
  
  - the expression of an 'if' was always true
  - a 'while' contained a condition that was always true
  - use 'if(k->exp100 > EXP100_SEND_DATA)' instead of 'if(k->exp100)'
  - fixed a typo
  
  Closes #889

- SFTP: set a generic error when no SFTP one exists...
  
  ... as otherwise we could get a 0 which would count as no error and we'd
  wrongly continue and could end up segfaulting.
  
  Bug: https://curl.haxx.se/mail/lib-2016-06/0052.html
  Reported-by: 暖和的和暖

- ROADMAP: http2 tests are merged, mention http2 perf

- docs/README.md: to render nicer pages on github
  
  ... as previously the README.cmake would be picked and put at the bottom
  of the docs page there and it wasn't very representative!

- README.md: change host name for the svg logo
  
  rawgit.com asks to use the domain cdn.rawgit.com for production
  
  See #900

- [Viktor Szakats brought this change]

  README.md: use the SVG logo

- README.md: logo on top!

- KNOWN_BUGS: 3.4 POP3 expects "CRLF.CRLF" eob for some
  
  Closes #740

- RELEASE-NOTES: synced with d61c80515aa8

- [Michael Osipov brought this change]

  acinclude.m4: improve autodetection of CA bundle on FreeBSD
  
  The FreeBSD Port security/ca_root_nss installs the Mozilla NSS CA bundle
  to /usr/local/share/certs/ca-root-nss.crt. Use this bundle in the
  discovery process.
  
  This change also removes the former FreeBSD path that has been obsolete
  for 8 years since this FreeBSD ports commit:
  https://svnweb.freebsd.org/ports/head/security/?view=revision&revision=215953
  
  Closes #894

- configure: don't specify .lib for libs on windows
  
  Another follow up for crypt32.lib linking with winssl

- configure: fix winssl LIBS change typo
  
  follow-up from 120bf29e

- TODO: "TCP Fast Open" is done, add monitor pool connections

- configure: add crypt32.lib for winssl builds
  
  Necessary since 6cabd78531f

- Makefile.vc: link with crypt32.lib for winssl builds
  
  Necessary since 6cabd78531f
  
  Fixes #853

- [Joel Depooter brought this change]

  VC: Add crypt32.lib to Visual Sudio project template files
  
  Closes #854

- vc: fix the build for schannel certinfo support
  
  Broken since 6cabd785, which adds use of the Curl_extract_certinfo
  function from the x509asn1.c file.

- typedefs: use the full structs in internal code...
  
  ... and save the typedef'ed names for headers and external APIs.

- internals: rename the SessionHandle struct to Curl_easy

- headers: forward declare CURL, CURLM and CURLSH as structs
  
  Instead of typedef'ing to void, typedef to their corresponding actual
  struct names to allow compilers to type-check.
  
  Assisted-by: Reinhard Max

Jay Satiro (22 Jun 2016)
- vtls: Only call add/getsession if session id is enabled
  
  Prior to this change we called Curl_ssl_getsessionid and
  Curl_ssl_addsessionid regardless of whether session ID reusing was
  enabled. According to comments that is in case session ID reuse was
  disabled but then later enabled.
  
  The old way was not intuitive and probably not something users expected.
  When a user disables session ID caching I'd guess they don't expect the
  session ID to be cached anyway in case the caching is later enabled.

Daniel Stenberg (22 Jun 2016)
- curl.1: the used progress meter suffix is k in lower case
  
  Closes #883

- [Sergei Nikulov brought this change]

  cmake: now using BUILD_TESTING=ON/OFF
  
  CMake build now using BUILD_TESTING=ON/OFF (default is OFF) to build
  tests and enabling CTest integration. Options BUILD_CURL_TESTS and
  BUILD_DASHBOARD_REPORTS was removed.
  
  Closes #882
  
  Reviewed-by: Brad King

- [Michael Kaufmann brought this change]

  cleanup: fix method names in code comments
  
  Closes #887

Kamil Dudka (21 Jun 2016)
- curl-compilers.m4: improve detection of GCC's -fvisibility= flag
  
  Some builds of GCC produce output on both stdout and stderr when --help
  --verbose is used.  The 2>&1 redirection caused them to be arbitrarily
  interleaved with each other because of stream buffering.  Consequently,
  grep failed to match the fvisibility= string in the mixed output, even
  though the string was present in GCC's standard output.
  
  This led to silently disabling symbol hiding in some builds of curl.

Daniel Stenberg (19 Jun 2016)
- tests: fix the HTTP/2 tests
  
  The HTTP/2 tests brought with commit bf05606ef1f were using the internal
  name 'http2' for the HTTP/2 server, while in fact that name was already
  used for the second instance of the HTTP server. This made tests using
  the second instance (like test 2050) fail after a HTTP/2 test had run.
  
  The server is now known as HTTP/2 internally and within the <server>
  section in test cases. 1700, 1701 and 1702 were updated accordingly.

- openssl: use more 'const' to fix build warnings with 1.1.0 branch

- curl.1: missed 'T' in the progress unit suffixes

- curl.1: mention the unix for the progress meter

Patrick Monnerat (16 Jun 2016)
- os400: add new definitions to ILE/RPG binding.

Daniel Stenberg (16 Jun 2016)
- openssl: fix cert check with non-DNS name fields present
  
  Regression introduced in 5f5b62635 (released in 7.48.0)
  
  Reported-by: Fabian Ruff
  Fixes #875

Dan Fandrich (16 Jun 2016)
- axtls: Use Curl_wait_ms instead of the less-portable usleep

- axtls: Fixed compile after compile 31c521b0

- tests: Added HTTP proxy keywords to tests 1141 & 1142

Jay Satiro (15 Jun 2016)
- [Sergei Nikulov brought this change]

  cmake: Fix build with winldap
  
  Bug: https://github.com/curl/curl/pull/874
  Reported-by: Sergei Nikulov

- CURLOPT_POSTFIELDS.3: Clarify what happens when set empty
  
  When CURLOPT_POSTFIELDS is set to an empty string libcurl will send a
  zero-byte POST. Prior to this change it was documented as sending data
  from the read callback.
  
  This also changes the wording of what happens when empty or NULL so that
  it's hopefully easier to understand for people whose primary language
  isn't English.
  
  Bug: https://github.com/curl/curl/issues/862
  Reported-by: Askar Safin

- [Michael Wallner brought this change]

  curl_multi_socket_action.3: Fix rewording
  
  - Remove some erroneous text.
  
  Closes https://github.com/curl/curl/pull/865

- [Luo Jinghua brought this change]

  resolve: enable protocol family logic for synthesized IPv6
  
  - Enable protocol family logic for IPv6 resolves even when support
  for synthesized addresses is enabled.
  
  This is a follow up to the parent commit that added support for
  synthesized IPv6 addresses from IPv4 on iOS/OS X. The protocol family
  logic needed for IPv6 was inadvertently excluded if support for
  synthesized addresses was enabled.
  
  Bug: https://github.com/curl/curl/issues/863
  Ref: https://github.com/curl/curl/pull/866
  Ref: https://github.com/curl/curl/pull/867

Daniel Stenberg (7 Jun 2016)
- [Luo Jinghua brought this change]

  resolve: add support for IPv6 DNS64/NAT64 Networks on OS X + iOS
  
  Use getaddrinfo() to resolve the IPv4 address literal on iOS/Mac OS X.
  If the current network interface doesn’t support IPv4, but supports
  IPv6, NAT64, and DNS64.
  
  Closes #866
  Fixes #863

- tests: two more HTTP/2 tests
  
  1701 and 1702

- runtests: don't display logs when http2 server fails to start

- runtests: make stripfile work on stdout as well
  
  ... and have test 1700 use that to strip out the nghttpx server: headers

- http2-tests: test1700 is the first real HTTP/2 test
  
  It requires that 'nghttpx' is in the PATH, and it will run the tests
  using nghttpx as a front-end proxy in front of the standard HTTP/1 test
  server. This uses HTTP/2 over plain TCP.
  
  If you like me have nghttpx installed in a custom path, you can run test 1700
  like this:
  
  $ PATH=$PATH:$HOME/build-nghttp2/bin/ ./runtests.pl 1700

- RELEASE-NOTES: synced with 34855feeb4c299

Steve Holme (6 Jun 2016)
- schannel: Disable ALPN on Windows < 8.1
  
  Calling QueryContextAttributes with SECPKG_ATTR_APPLICATION_PROTOCOL
  fails on Windows < 8.1 so we need to disable ALPN on these OS versions.
  
  Inspiration provide by: Daniel Seither
  
  Closes #848
  Fixes #840

Jay Satiro (5 Jun 2016)
- checksrc: Add LoadLibrary to the banned functions list
  
  LoadLibrary was supplanted by Curl_load_library for security
  reasons in 6df916d.

- http: Fix HTTP/2 connection reuse
  
  - Change the parser to not require a minor version for HTTP/2.
  
  HTTP/2 connection reuse broke when we changed from HTTP/2.0 to HTTP/2
  in 8243a95 because the parser still expected a minor version.
  
  Bug: https://github.com/curl/curl/issues/855
  Reported-by: Andrew Robbins, Frank Gevaerts

Steve Holme (4 Jun 2016)
- connect.c: Fixed compilation warning from commit 332e8d6164
  
  connect.c:952:5: warning: suggest explicit braces to avoid ambiguous 'else'

- win32: Used centralised verify windows version function
  
  Closes #845

- win32: Added verify windows version functionality

- win32: Introduced centralised verify windows version function

Kamil Dudka (3 Jun 2016)
- tool_urlglob: fix off-by-one error in glob_parse()
  
  ... causing SIGSEGV while parsing URL with too many globs.
  Minimal example:
  
  $ curl $(for i in $(seq 101); do printf '{a}'; done)
  
  Reported-by: Romain Coltel
  Bug: https://bugzilla.redhat.com/1340757

Daniel Stenberg (1 Jun 2016)
- [Benjamin Kircher brought this change]

  libcurl-multi.3: fix small typo
  
  Closes #850

- [Viktor Szakats brought this change]

  makefile.m32: add crypt32 for winssl builds
  
  Dependency added by 6cabd78
  
  Closes #849

- [Ivan Avdeev brought this change]

  vtls: fix ssl session cache race condition
  
  Sessionid cache management is inseparable from managing individual
  session lifetimes. E.g. for reference-counted sessions (like those in
  SChannel and OpenSSL engines) every session addition and removal
  should be accompanied with refcount increment and decrement
  respectively. Failing to do so synchronously leads to a race condition
  that causes symptoms like use-after-free and memory corruption.
  This commit:
   - makes existing session cache locking explicit, thus allowing
     individual engines to manage lock's scope.
   - fixes OpenSSL and SChannel engines by putting refcount management
     inside this lock's scope in relevant places.
   - adds these explicit locking calls to other engines that use
     sessionid cache to accommodate for this change. Note, however,
     that it is unknown whether any of these engines could also have
     this race.
  
  Bug: https://github.com/curl/curl/issues/815
  Fixes #815
  Closes #847

- [Andrew Kurushin brought this change]

  schannel: add CURLOPT_CERTINFO support
  
  Closes #822

- RELEASE-NOTES: synced with 142ee9fa15002315

- openssl: rename the private SSL_strerror
  
  ... to make it not look like an OpenSSL function

- [Michael Kaufmann brought this change]

  openssl: Use correct buffer sizes for error messages
  
  Closes #844

- curl: fix -q [regression]
  
  This broke in 7.49.0 with commit e200034425a7625
  
  Fixes #842

- URL parser: allow URLs to use one, two or three slashes
  
  Mostly in order to support broken web sites that redirect to broken URLs
  that are accepted by browsers.
  
  Browsers are typically even more leniant than this as the WHATWG URL
  spec they should allow an _infinite_ amount. I tested 8000 slashes with
  Firefox and it just worked.
  
  Added test case 1141, 1142 and 1143 to verify the new parser.
  
  Closes #791

- [Renaud Lehoux brought this change]

  cmake: Added missing mbedTLS support
  
  Closes #837

- [Renaud Lehoux brought this change]

  mbedtls: removed unused variables
  
  Closes #838

- [Frank Gevaerts brought this change]

  http: add CURLINFO_HTTP_VERSION and %{http_version}
  
  Adds access to the effectively used http version to both libcurl and
  curl.
  
  Closes #799

- bump: start the journey toward 7.50.0

- [Marcel Raad brought this change]

  openssl: fix build with OPENSSL_NO_COMP
  
  With OPENSSL_NO_COMP defined, there is no function
  SSL_COMP_free_compression_methods
  
  Closes #836

- [Gisle Vanem brought this change]

  memdebug: fix MSVC crash with -DMEMDEBUG_LOG_SYNC
  
  Fixes #828

- [Jonathan brought this change]

  README.md: polish
  
  Closes #834

- RELEASE-NOTES: fix vuln link

Version 7.49.1 (30 May 2016)

Daniel Stenberg (30 May 2016)
- RELEASE-NOTES: 7.49.1

- [Steve Holme brought this change]

  loadlibrary: Only load system DLLs from the system directory
  
  Inspiration provided by: Daniel Stenberg and Ray Satiro
  
  Bug: https://curl.haxx.se/docs/adv_20160530.html
  
  Ref: Windows DLL hijacking with curl, CVE-2016-4802

- ssh: fix version number check typo

Jay Satiro (29 May 2016)
- curl_share_setopt.3: Add min ver needed for ssl session lock
  
  Bug: https://github.com/curl/curl/issues/826
  Reported-by: Michael Wallner

Daniel Stenberg (29 May 2016)
- ssh: fix build for libssh2 before 1.2.6
  
  The statvfs functionality was added to libssh2 in that version, so we
  switch off that functionality when built with older libraries.
  
  Fixes #831

- mbedtls: fix includes so snprintf() works
  
  Regression from the previous *printf() rearrangements, this file missed to
  include the correct header to make sure snprintf() works universally.
  
  Reported-by: Moti Avrahami
  Bug: https://curl.haxx.se/mail/lib-2016-05/0196.html

Steve Holme (23 May 2016)
- checksrc.pl: Added variants of strcat() & strncat() to banned function list
  
  Added support for checking the tchar, unicode and mbcs variants of
  strcat() and strncat() in the banned function list.

Daniel Stenberg (23 May 2016)
- smtp: minor ident (white space) fixes

- THANKS: updated after script fixes
  
  Now giving credit properly to github user names, fixed some UTF-8 issues
  and added names discovered when contrithanks was improved.

- THANKS-filter: more name cleanups

- contrithanks.sh: exclude existing names case insensitively

- contrithanks.sh: use same grep pattern and -a flag as contributors.sh

- contributors.sh: better grep pattern, use grep -a

- THANKS-filter: fix more names

- contrithanks.sh: do the same github fix as contributors.sh
  
  from 1577bfa35ba

Jay Satiro (23 May 2016)
- contributors: Show GitHub username if real name unknown
  
  Prior to this change if a GitHub contributor's real name was unknown
  they would be omitted from the list.
  
  Bug: https://github.com/curl/curl/issues/824

Daniel Stenberg (21 May 2016)
- RELEASE-NOTES: synced with 3caaeffbe8ded4

Jay Satiro (20 May 2016)
- openssl: cleanup must free compression methods
  
  - Free compression methods if OpenSSL 1.0.2 to avoid a memory leak.
  
  Bug: https://github.com/curl/curl/issues/817
  Reported-by: jveazey@users.noreply.github.com

Daniel Stenberg (20 May 2016)
- [Gisle Vanem brought this change]

  curl_multibyte: fix compiler error
  
  While compiling lib/curl_multibyte.c with '-DUSE_WIN32_IDN' etc. I was
  getting:
  
  f:\mingw32\src\inet\curl\lib\memdebug.h(38): error C2054: expected '('
  to follow 'CURL_EXTERN'
  
  f:\mingw32\src\inet\curl\lib\memdebug.h(38): error C2085:
  'curl_domalloc': not in formal parameter list

- THANKS-filter: make Jan-E get proper credit

- [Jan-E brought this change]

  winbuild/Makefile.vc: Fix check on SSL, MBEDTLS, WINSSL exclusivity
  
  Closes #818

- [Alexander Traud brought this change]

  libcurl.m4: Avoid obsolete warning
  
  Closes #821

Jay Satiro (20 May 2016)
- [Michael Kaufmann brought this change]

  CURLOPT_CONNECT_TO.3: user must not free the list prematurely
  
  The connect-to list isn't copied so as long as the handle may be used
  for a transfer the list must be valid.
  
  Bug: https://github.com/curl/curl/pull/819
  Reported-by: Michael Kaufmann

Daniel Stenberg (19 May 2016)
- RELEASE-NOTES: synced with 48114a8634242c

- openssl: ERR_remove_thread_state() is deprecated in latest 1.1.0
  
  See OpenSSL commit 21e001747d4a

- http2: use HTTP/2 in the HTTP/1.1-alike header
  
  ... when generating them, not "2.0" as the protocol is called just
  HTTP/2 and nothing else.

Jay Satiro (19 May 2016)
- dist: include curl_multi_socket_all.3
  
  Closes https://github.com/curl/curl/pull/816

Steve Holme (18 May 2016)
- bump: Start work on 7.49.1

Daniel Stenberg (18 May 2016)
- curlbuild.h.dist: check __LP64__ as well to fix MIPS build
  
  The preprocessor check that sets up the 32bit defines for non-configure
  builds didn't work properly for MIPS systems as __mips__ is defined for
  both 32bit and 64bit. Now __LP64__ is also checked and indicates 64bit.
  
  Reported-by: Tomas Jakobsson
  Fixes #813

- [Marcel Raad brought this change]

  schannel: fix compile break with MSVC XP toolset
  
  For the Windows XP toolset of Visual C++ 2013/2015, the old Windows SDK
  7.1 is used. In this case, _USING_V110_SDK71_ is defined.
  
  Closes #812

- dist: include CHECKSRC.md
  
  Reported-by: Paul Howarth
  Bug: https://curl.haxx.se/mail/lib-2016-05/0116.html

- test/Makefile.am: include manpage-scan.pl and nroff-scan.pl in dist
  
  Reported-by: Ray Satiro
  Bug: https://curl.haxx.se/mail/lib-2016-05/0113.html

Version 7.49.0 (17 May 2016)

Daniel Stenberg (17 May 2016)
- THANKS: 24 new names from 7.49.0 release notes

- RELEASE-NOTES: 7.49.0

- mbedtls/polarssl: set "hostname" unconditionally
  
  ...as otherwise the TLS libs will skip the CN/SAN check and just allow
  connection to any server. curl previously skipped this function when SNI
  wasn't used or when connecting to an IP address specified host.
  
  CVE-2016-3739
  
  Bug: https://curl.haxx.se/docs/adv_20160518A.html
  Reported-by: Moti Avrahami

- [Frank Gevaerts brought this change]

  CURLOPT_RESOLVE.3: fix typo
  
  Closes #811

- docs: CURLOPT_RESOLVE overrides CURLOPT_IPRESOLVE

- KNOWN_BUGS: GnuTLS backend skips really long certificate fields
  
  Closes #762

- CURLOPT_HTTPPOST.3: the data needs to be around while in use

- openssl: get_cert_chain: fix NULL dereference
  
  CID 1361815: Explicit null dereferenced (FORWARD_NULL)

- openssl: get_cert_chain: avoid NULL dereference
  
  CID 1361811: Explicit null dereferenced (FORWARD_NULL)

- dprintf_formatf: fix (false?) Coverity warning
  
  CID 1024412: Memory - illegal accesses (OVERRUN). Claimed to happen when
  we run over 'workend' but the condition says <= workend and for all I
  can see it should be safe. Compensating for the warning by adding a byte
  margin in the buffer.
  
  Also, removed the extra brace level indentation in the code and made it
  so that 'workend' is only assigned once within the function.

- RELEASE-NOTES: synced with 2dcb5adc72d6

- THANKS-filter: fixed Jonathan Cardoso

Jay Satiro (15 May 2016)
- ftp: fix incorrect out-of-memory code in Curl_pretransfer
  
  - Return value type must match function type.
  
  s/CURLM_OUT_OF_MEMORY/CURLE_OUT_OF_MEMORY/
  
  Caught by Travis CI

Daniel Stenberg (15 May 2016)
- ftp wildcard: segfault due to init only in multi_perform
  
  The proper FTP wildcard init is now more properly done in Curl_pretransfer()
  and the corresponding cleanup in Curl_close().
  
  The previous place of init/cleanup code made the internal pointer to be NULL
  when this feature was used with the multi_socket() API, as it was made within
  the curl_multi_perform() function.
  
  Reported-by: Jonathan Cardoso Machado
  Fixes #800

Jay Satiro (13 May 2016)
- libcurl-tlibcurl-thread: Update OpenSSL links
  
  Because the old OpenSSL link now redirects to their master documentation
  (currently 1.1.0), which does not document the required actions for
  OpenSSL <= 1.0.2.

Daniel Stenberg (13 May 2016)
- [Viktor Szakats brought this change]

  darwinssl.c: fix OS X codename typo in comment

- RELEASE-NOTES: synced with 68701e51c1f7
  
  Added 8 bug fixes and 5 more contrbutors

- [Jay Satiro brought this change]

  mprintf: Fix processing of width and prec args
  
  Prior to this change a width arg could be erroneously output, and also
  width and precision args could not be used together without crashing.
  
  "%0*d%s", 2, 9, "foo"
  
  Before: "092"
  After: "09foo"
  
  "%*.*s", 5, 2, "foo"
  
  Before: crash
  After: "   fo"
  
[--snip--]
