                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.74.0 (9 Dec 2020)

Daniel Stenberg (9 Dec 2020)
- RELEASE-NOTES: synced
  
  for 7.74.0

Jay Satiro (7 Dec 2020)
- [Jacob Hoffman-Andrews brought this change]

  urldata: restore comment on ssl_connect_data.use
  
  This comment was originally on the `use` field, but was separated from
  its field in 62a2534.
  
  Closes https://github.com/curl/curl/pull/6287

Daniel Stenberg (7 Dec 2020)
- VERSIONS: refreshed
  
  We always use the patch number these days: all releases are
  "major.minor.patch"

- [Jakub Zakrzewski brought this change]

  cmake: don't use reserved target name 'test'
  
  CMake up to 3.10 always reserves this name
  
  Fixes #6257
  Closes #6258

- openssl: make the OCSP verification verify the certificate id
  
  CVE-2020-8286
  
  Reported by anonymous
  
  Bug: https://curl.se/docs/CVE-2020-8286.html

- ftp: make wc_statemach loop instead of recurse
  
  CVE-2020-8285
  
  Fixes #6255
  Bug: https://curl.se/docs/CVE-2020-8285.html
  Reported-by: xnynx on github

- ftp: CURLOPT_FTP_SKIP_PASV_IP by default
  
  The command line tool also independently sets --ftp-skip-pasv-ip by
  default.
  
  Ten test cases updated to adapt the modified --libcurl output.
  
  Bug: https://curl.se/docs/CVE-2020-8284.html
  CVE-2020-8284
  
  Reported-by: Varnavas Papaioannou

- urlapi: don't accept blank port number field without scheme
  
  ... as it makes the URL parser accept "very-long-hostname://" as a valid
  host name and we don't want that. The parser now only accepts a blank
  (no digits) after the colon if the URL starts with a scheme.
  
  Reported-by: d4d on hackerone
  
  Closes #6283

- Revert "multi: implement wait using winsock events"
  
  This reverts commit d2a7d7c185f98df8f3e585e5620cbc0482e45fac.
  
  This commit also reverts the subsequent follow-ups to that commit, which
  were all done within windows #ifdefs that are removed in this
  change. Marc helped me verify this.
  
  Fixes #6146
  Closes #6281

- [Klaus Crusius brought this change]

  ftp: retry getpeername for FTP with TCP_FASTOPEN
  
  In the case of TFO, the remote host name is not resolved at the
  connetion time.
  
  For FTP that has lead to missing hostname for the secondary connection.
  Therefore the name resolution is done at the time, when FTP requires it.
  
  Fixes #6252
  Closes #6265
  Closes #6282

- [Thomas Danielsson brought this change]

  scripts/completion.pl: parse all opts
  
  For tab-completion it may be preferable to include all the
  available options.
  
  Closes #6280

- RELEASE-NOTES: synced

- openssl: use OPENSSL_init_ssl() with >= 1.1.0
  
  Reported-by: Kovalkov Dmitrii and Per Nilsson
  Fixes #6254
  Fixes #6256
  Closes #6260

- SECURITY-PROCESS: disclose on hackerone
  
  Once a vulnerability has been published, the hackerone issue should be
  disclosed. For tranparency.
  
  Closes #6275

Marc Hoersken (3 Dec 2020)
- tests/util.py: fix compatibility with Python 2
  
  Backporting the Python 3 implementation of setStream
  to ClosingFileHandler as a fallback within Python 2.
  
  Reported-by: Jay Satiro
  
  Fixes #6259
  Closes #6270

Daniel Gustafsson (3 Dec 2020)
- docs: fix typos and markup in ETag manpage sections
  
  Reported-by: emanruse on github
  Fixes #6273

Daniel Stenberg (2 Dec 2020)
- quiche: close the connection
  
  Reported-by: Junho Choi
  Fixes #6213
  Closes #6217

Jay Satiro (2 Dec 2020)
- ngtcp2: Fix build error due to symbol name change
  
  - NGTCP2_CRYPTO_LEVEL_APP -> NGTCP2_CRYPTO_LEVEL_APPLICATION
  
  ngtcp2/ngtcp2@76232e9 changed the name.
  
  ngtcp2 master is required to build curl with http3 support.
  
  Closes https://github.com/curl/curl/pull/6271

Daniel Stenberg (1 Dec 2020)
- [Klaus Crusius brought this change]

  cmake: check for linux/tcp.h
  
  The HAVE_LINUX_TCP_H define was not set by cmake.
  
  Closes #6252

- NEW-PROTOCOL: document what needs to be done to add one
  
  Closes #6263

- splay: rename Curl_splayremovebyaddr to Curl_splayremove
  
  ... and remove the old unused proto for the old Curl_splayremove
  version.
  
  Closes #6269

- openssl: free mem_buf in error path
  
  To fix a memory-leak.
  
  Closes #6267

- openssl: remove #if 0 leftover
  
  Follow-up to 4c9768565ec3a9 (from Sep 2008)
  
  Closes #6268

- ntlm: avoid malloc(0) on zero length user and domain
  
  ... and simplify the too-long checks somewhat.
  
  Detected by OSS-Fuzz
  
  Closes #6264

- RELEASE-NOTES: synced

Marc Hoersken (28 Nov 2020)
- tests/server/tftpd.c: close upload file in case of abort
  
  Commit c353207 removed the closing right after do_tftp
  which covered the case of abort. This handles that case.
  
  Reviewed-by: Jay Satiro
  Reviewed-by: Daniel Stenberg
  
  Follow up to #6209
  Closes #6234

Daniel Stenberg (26 Nov 2020)
- [Daiki Ueno brought this change]

  ngtcp2: use the minimal version of QUIC supported by ngtcp2
  
  Closes #6250

- [Daiki Ueno brought this change]

  ngtcp2: advertise h3 ALPN unconditionally
  
  Closes #6250

- [Daiki Ueno brought this change]

  vquic/ngtcp2.h: define local_addr as sockaddr_storage
  
  This field needs to be wide enough to hold sockaddr_in6 when
  connecting via IPv6.  Otherwise, ngtcp2_conn_read_pkt will drop the
  packets because of the address mismatch:
    I00000022 [...] con ignore packet from unknown path
  
  We can safely assume that struct sockaddr_storage is available, as it
  is used in the public interface of ngtcp2.
  
  Closes #6250

- socks: check for DNS entries with the right port number
  
  The resolve call is done with the right port number, but the subsequent
  check used the wrong one, which then could find a previous resolve which
  would return and leave the fresh resolve "incomplete" and leaking
  memory.
  
  Fixes #6247
  Closes #6253

- curl_setup: USE_RESOLVE_ON_IPS is for Apple native resolver use
  
  ... so don't define it when instructed to use c-ares!

- test506: make it not run in c-ares builds
  
  As the asynch nature of it may trigger events in another order. A c-ares
  upgrade made it break.
  
  Reported-by: Marc Hörsken
  Fixes #6247

- runtests: make 'c-ares' a "feature" to depend on
  
  ... also added to the docs.

- tool_writeout: use off_t getinfo-types instead of doubles
  
  Commit 3b80d3ca46b12e52342 (June 2017) introduced getinfo replacement
  variables that use curl_off_t instead of doubles. Switch the --write-out
  function over to use them.
  
  Closes #6248

- [Emil Engler brought this change]

  file: avoid duplicated code sequence
  
  file_disconnect() is identical with file_do() except the function header
  but as the arguments are unused anyway so why not just return file_do()
  directly!
  
  Reviewed-by: Daniel Stenberg
  Closes #6249

- [Rikard Falkeborn brought this change]

  infof/failf calls: fix format specifiers
  
  Update a few format specifiers to match what is being printed.
  
  Closes #6241

- docs/INTERNALS: remove reference to Curl_sendf()
  
  The function has been removed from common usage. Also removed comment in
  gopher.c that still referenced it.
  
  Reported-by: Rikard Falkeborn
  Fixes #6242
  Closes #6243

- [Rikard Falkeborn brought this change]

  examples: update .gitignore
  
  Add files that are generated by 'make examples' and remove some that
  have been renamed.
  
  The commits that renamed the programs are e9625c5bc6c046a (imap.c and
  simplesmtp.c were renamed to imap-fetch.c and smtp-send.c) and
  ad39e7ec01e7 (pop3slist.c and pop3s.c were renamed to pop3-list.c and
  pop3-ssl.c).
  
  Closes #6240

- asyn: use 'struct thread_data *' instead of 'void *'
  
  To reduce use of types that can't be checked at compile time. Also
  removes several typecasts.
  
  ... and rename the struct field from 'os_specific' to 'tdata'.
  
  Closes #6239
  Reviewed-by: Jay Satiro

Viktor Szakats (23 Nov 2020)
- Makefile.m32: add support for UNICODE builds
  
  It requires the linker to support the `-municode` option.
  This is available in more recent mingw-w64 releases.
  
  Ref: https://gcc.gnu.org/onlinedocs/gcc/x86-Windows-Options.html
  Ref: https://stackoverflow.com/questions/3571250/wwinmain-unicode-and-mingw/11706847#11706847
  
  Reviewed-by: Jay Satiro
  Reviewed-by: Marcel Raad
  
  Closes #6228

Daniel Stenberg (23 Nov 2020)
- urldata: remove 'void *protop' and create the union 'p'
  
  ... to avoid the use of 'void *' for the protocol specific structs done
  per transfer.
  
  Closes #6238

- winbuild: remove docs from Makefiles and refer to README.md
  
  Reduce risk for conflicting docs and makes it to a single place to fix
  and polish.
  
  add these missing options to the readme:
  
  ENABLE_OPENSSL_AUTO_LOAD_CONFIG and ENABLE_UNICODE
  
  clarify ENABLE_SCHANNEL default varies
  
  Fixes #6216
  Closes #6227
  Co-Authored-by: Jay Satiro

- [Daiki Ueno brought this change]

  http3: use the master branch of GnuTLS for testing
  
  Closes #6235

- KNOWN_BUGS: curl with wolfSSL lacks support for renegotiation
  
  Closes #5839

- KNOWN_BUGS: wakeup socket disconnect causes havoc
  
  Closes #6132
  Closes #6133

- RELEASE-NOTES: synced

- [Oliver Urbann brought this change]

  curl: add compatibility for Amiga and GCC 6.5
  
  Changes are mainly reordering and adding of includes required
  to compile with a more recent version of GCC.
  
  Closes #6220

Marc Hoersken (20 Nov 2020)
- tests/server/tftpd.c: close upload file right after transfer
  
  Make sure uploaded file is no longer locked after the
  transfer while waiting for the final ACK to be handled.
  
  Assisted-by: Daniel Stenberg
  
  Bug: #6058
  Closes #6209

- CI/cirrus: simplify logic for disabled tests
  
  The OpenSSH server instance for the testsuite cannot
  be started on FreeBSD, therefore the SFTP and SCP
  tests are disabled right away from the beginning.
  
  The previous OS version specific logic for SKIP_TESTS
  is no longer needed/used and can therefore be removed.
  
  Reviewed-by: Daniel Stenberg
  
  Follow up to #6211
  Closes #6229

Daniel Gustafsson (20 Nov 2020)
- mailmap: Daniel Hwang
  
  Add Daniel Hwang to the mailmap to cover the alternative spelling
  Daniel Lee Hwang which was used in one commit.
  
  Closes #6230
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- openssl: guard against OOM on context creation
  
  EVP_MD_CTX_create will allocate memory for the context and returns
  NULL in case the allocation fails. Make sure to catch any allocation
  failures and exit early if so.
  
  In passing, also move to EVP_DigestInit rather than EVP_DigestInit_ex
  as the latter is intended for ENGINE selection which we don't do.
  
  Closes #6224
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Emil Engler <me@emilengler.com>

Daniel Stenberg (19 Nov 2020)
- [Vincent Torri brought this change]

  cmake: use libcurl.rc in all Windows builds
  
  Reviewed-by: Marcel Raad
  Closes #6215

- [Cristian Morales Vega brought this change]

  cmake: make CURL_ZLIB a tri-state variable
  
  By differentiating between ON and AUTO it can make a missing zlib
  library a hard error when CURL_ZLIB=ON is used.
  
  Reviewed-by: Jakub Zakrzewski
  Closes #6221
  Fixes #6173

- quiche: remove 'static' from local buffer
  
  For thread-safety
  
  Closes #6223

- KNOWN_BUGS: cmake: libspsl is not supported
  
  Closes #6214

- KNOWN_BUGS: cmake autodetects cert paths when cross-compiling
  
  Closes #6178

- KNOWN_BUGS: cmake build doesn't fail if zlib not found
  
  Closes #6173

- KNOWN_BUGS: cmake libcurl.pc uses absolute library paths
  
  Closes #6169

- KNOWN_BUGS: cmake: generated .pc file contains strange entries
  
  Closes #6167

- KNOWN_BUGS: cmake uses -lpthread instead of Threads::Threads
  
  Closes #6166

- KNOWN_BUGS: cmake build in Linux links libcurl to libdl
  
  Closes #6165

- KNOWN_BUGS: make a new section for cmake topics
  
  Closes #6219

- [Emil Engler brought this change]

  cirrus: build with FreeBSD 12.2 in CirrusCI
  
  Closes #6211

Marc Hoersken (14 Nov 2020)
- tests/*server.py: close log file after each log line
  
  Make sure the log file is not locked once a test has
  finished and align with the behavior of our logmsg.
  
  Rename curl_test_data.py to be a general util.py.
  Format and sort Python imports with isort/VSCode.
  
  Bug: #6058
  Closes #6206

Daniel Stenberg (13 Nov 2020)
- CURLOPT_HSTS.3: document the file format
  
  Closes #6205

- RELEASE-NOTES: synced

- release-notes.pl: detect #[number] better for Ref: etc

- curl: only warn not fail, if not finding the home dir
  
  ... as there's no good reason to error out completely.
  
  Reported-by: Andreas Fischer
  Fixes #6200
  Closes #6201

- httpput-postfields.c: new example doing PUT with POSTFIELDS
  
  Proposed-by: Jeroen Ooms
  Ref: #6186
  Closes #6188

- [Tobias Hieta brought this change]

  cmake: correctly handle linker flags for static libs
  
  curl CMake was setting the the EXE flags for static libraries which made
  the /manifest:no flag ended up when linking the static library, which is
  not a valid flag for lib.exe or llvm-lib.exe and caused llvm-lib to exit
  with an error.
  
  The better way to handle this is to make sure that we pass the correct
  linker flags to CMAKE_STATIC_LINKER_FLAGS instead.
  
  Reviewed-by: Jakub Zakrzewski
  Closes #6195

- [Tobias Hieta brought this change]

  cmake: don't pass -fvisibility=hidden to clang-cl on Windows
  
  When using clang-cl on windows -fvisibility=hidden is not an known
  argument. Instead it behaves exactly like MSVC in this case. So let's
  make sure we take that path.
  
  In CMake clang-cl sets both CMAKE_C_COMPILER_ID=clang and MSVC get's
  defined since clang-cl is basically a MSVC emulator. So guarding like we
  do in this patch seems logical.
  
  Reviewed-by: Jakub Zakrzewski
  Closes #6194

- http_proxy: use enum with state names for 'keepon'
  
  To make the code clearer, change the 'keepon' from an int to an enum
  with better state names.
  
  Reported-by: Niranjan Hasabnis
  Bug: https://curl.se/mail/lib-2020-11/0026.html
  Closes #6193

- curl_easy_escape: limit output string length to 3 * max input
  
  ... instead of the limiting it to just the max input size. As every
  input byte can be expanded to 3 output bytes, this could limit the input
  string to 2.66 MB instead of the intended 8 MB.
  
  Reported-by: Marc Schlatter
  Closes #6192

- docs: document the 8MB input string limit
  
  for curl_easy_escape and curl_easy_setopt()
  
  The limit is there to catch mistakes and abuse. It is meant to be large
  enough to allow virtually all "fine" use cases.
  
  Reported-by: Marc Schlatter
  Fixes #6190
  Closes #6191

- mqttd: fclose test file when done
  
  Reported-by: Marc Hörsken
  Reviewed-by: Jay Satiro
  Bug: #6058
  Closes #6189

- RELEASE-NOTES: synced

- THANKS-filter: ignore autobuild links

- Revert "libcurl.pc: make it relocatable"
  
  This reverts commit 3862c37b6373a55ca704171d45ba5ee91dec2c9f.
  
  That fix should either be done differently or with an option.
  
  Reported-by: asavah on github
  Fixes #6157
  Closes #6183

- examples/httpput: remove use of CURLOPT_PUT
  
  It is deprecated and unnecessary since it already sets CURLOPT_UPLOAD.
  
  Reported-by: Jeroen Ooms
  Fixes #6186
  Closes #6187

- Curl_pgrsStartNow: init speed limit time stamps at start
  
  By setting the speed limit time stamps unconditionally at transfer
  start, we can start off a transfer without speed limits and yet allow
  them to get set during transfer and have an effect.
  
  Reported-by: Kael1117 on github
  Fixes #6162
  Closes #6184

- ngtcp2: adapt to recent nghttp3 updates
  
  'reset_stream' was added to the nghttp3_conn_callbacks struct
  
  Closes #6185

- configure: pass -pthread to Libs.private for pkg-config
  
  Reported-by: Cristian Morales Vega
  Fixes #6168
  Closes #6181

- altsvc: minimize variable scope and avoid "DEAD_STORE"
  
  Closes #6182

- FAQ: remove "Why is there a HTTP/1.1 in my HTTP/2 request?"
  
  This hasn't been the case for a while now, remove.

- FAQ: refresh "Why do I get "certificate verify failed"
  
  Add more details, remove references to ancient curl version.

- test493: verify --hsts upgrade and that %{url_effective} reflects that
  
  Closes #6175

- url: make sure an HSTS upgrade updates URL and scheme correctly
  
  Closes #6175

- tool_operate: set HSTS with CURLOPT_HSTS to pass on filename
  
  Closes #6175

- hsts: remove debug code leftovers
  
  Closes #6175

- FAQ: refreshed
  
   - remove a few ancient questions
   - add configure with static libs question
   - updated wording in several places
   - lowercased curl
  
  Closes #6177

Daniel Gustafsson (5 Nov 2020)
- examples: fix comment syntax
  
  Commit ac0a88fd2 accidentally added a stray character outside of the
  comment which broke compilation. Fix by removing.
  
  Reported-by:  autobuild https://curl.se/dev/log.cgi?id=20201105084306-12742

- hsts: Remove pointless call to free in errorpath
  
  The line variable will always be NULL in the error path, so remove
  the free call since it's pointless.
  
  Closes #6170
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- docs: Fix various typos in documentation
  
  Closes #6171
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (5 Nov 2020)
- copyright: fix year ranges
  
  Follow-up from 4d2f8006777

- HISTORY: the new domain

- curl.se: new home
  
  Closes #6172

- KNOWN_BUGS: FTPS with Schannel times out file list operation
  
  Reported-by: bobmitchell1956 on github
  Closes #5284

- KNOWN_BUGS: SMB tests fail with Python 2
  
  Reported-by: Jay Satiro
  Closes #5983

- KNOWN_BUGS: LDAPS with NSS is slow
  
  Reported-by: nosajsnikta on github
  Closes #5874

Sergei Nikulov (4 Nov 2020)
- travis: use ninja-build for CMake builds
  
  Added package ninja-build to environment
  Use ninja to speed up CMake builds
  
  Closes #6077

Daniel Stenberg (4 Nov 2020)
- [Harry Sintonen brought this change]

  rtsp: error out on empty Session ID, unified the code

- [Harry Sintonen brought this change]

  rtsp: fixed the RTST Session ID mismatch in test 570
  
  Closes #6161

- [Harry Sintonen brought this change]

  rtsp: fixed Session ID comparison to refuse prefix
  
  Closes #6161

- RELEASE-NOTES: synced
  
  (forgot to update the list of contributors)

- RELEASE-NOTES: synced

- curlver: bumped to 7.74.0

- hsts: add read/write callbacks
  
  - read/write callback options
  - man pages for the 4 new setopts
  - test 1915 verifies the callbacks
  
  Closes #5896

- hsts: add support for Strict-Transport-Security
  
  - enable in the build (configure)
  - header parsing
  - host name lookup
  - unit tests for the above
  - CI build
  - CURL_VERSION_HSTS bit
  - curl_version_info support
  - curl -V output
  - curl-config --features
  - CURLOPT_HSTS_CTRL
  - man page for CURLOPT_HSTS_CTRL
  - curl --hsts (sets CURLOPT_HSTS_CTRL and works with --libcurl)
  - man page for --hsts
  - save cache to disk
  - load cache from disk
  - CURLOPT_HSTS
  - man page for CURLOPT_HSTS
  - added docs/HSTS.md
  - fixed --version docs
  - adjusted curl_easy_duphandle
  
  Closes #5896

- [Sergei Nikulov brought this change]

  CI/tests: enable test target on TravisCI for CMake builds
  
  Added test-nonflaky target to CMake builds
  
  Disabled test 1139 because the cmake build doesn't create docs/curl.1
  
  Closes #6074

- tool_debug_cb: do not assume zero-terminated data
  
  Follow-up to d70a5b5a0f5e3

- sendf: move the verbose-check into Curl_debug
  
  Saves us from having the same check done everywhere.
  
  Closes #6159

- travis: use valgrind when running tests for debug builds
  
  Except the non-x86 and sanitizer builds
  
  Closes #6154

- header.d: fix syntax mistake
  
  follow-up from 1144886f38fd0

- [Harry Sintonen brought this change]

  gnutls: fix memory leaks (certfields memory wasn't released)
  
  Closes #6153

- tests: add missing global_init/cleanup calls
  
  Without the cleanup call in these test files, the mbedTLS backend leaks
  memory.
  
  Closes #6156

- tool_operate: --retry for HTTP 408 responses too
  
  This was inadvertently dropped from the code when the parallel support
  was added.
  
  Regression since b88940850 (7.66.0)
  
  Reviewed-by: Jay Satiro
  Closes #6155

- http: pass correct header size to debug callback for chunked post
  
  ... when the chunked framing was added, the size of the "body part" of
  the data was calculated wrongly so the debug callback would get told a
  header chunk a few bytes too big that would also contain the first few
  bytes of the request body.
  
  Reported-by: Dirk Wetter
  Ref: #6144
  Closes #6147

- header.d: mention the "Transfer-Encoding: chunked" handling
  
  Ref: #6144
  Closes #6148

- acinclude: detect manually set minimum macos/ipod version
  
  ... even if set in the CC or IPHONEOS/MACOSX_DEPLOYMENT_TARGET
  variables.
  
  Reported-by: hamstergene on github
  Fixes #6138
  Closes #6140

Jay Satiro (29 Oct 2020)
- tests: fix some http/2 tests for older versions of nghttpx
  
  - Add regex that strips http/2 server header name to those http/2 tests
    that don't already have it.
  
  - Improve that regex in all http/2 tests.
  
  Tests 358 and 359 were failing for me before this change on a system
  that uses an older version of nghttpx which includes its version number
  in the server header.
  
  Closes https://github.com/curl/curl/pull/6139

Daniel Stenberg (30 Oct 2020)
- RELEASE-NOTES: synced

- [Cristian Morales Vega brought this change]

  configure: use pkgconfig to find openSSL when cross-compiling
  
  This reverts 736a40fec (November 2004), which doesn't explain why it was
  done.
  
  Closes #6145

- tool_operate: bail out proper on errors for parallel setup
  
  ... otherwise for example trying to upload a missing file just causes a
  loop.
  
  Reported-by: BrumBrum on hackerone
  Closes #6141

- [Sergei Nikulov brought this change]

  CMake: make BUILD_TESTING dependent option
  
  CMake will now handle BUILD_TESTING depending on PERL_FOUND and
  CURL_DISABLE_TESTING
  
  Ref: #6036
  Closes #6072

- libssh2: fix transport over HTTPS proxy
  
  The fix in #6021 was not enough. This fix makes sure SCP/SFTP content
  can also be transfered over a HTTPS proxy.
  
  Fixes #6113
  Closes #6128

- curl.1: add an "OUTPUT" section at the top of the manpage
  
  Explain the basic concepts behind curl output.
  
  Inspired by #6124
  
  Closes #6134

- mailmap: set Viktor Szakats's email

- runtests: show keywords when no tests ran
  
  To help out future debugging, runtests now outputs the list of keywords
  when it fails because no tests ran.
  
  Ref: #6120
  Closes #6126

Jay Satiro (26 Oct 2020)
- CURLOPT_DNS_USE_GLOBAL_CACHE.3: fix typo
  
  Reported-by: Rui LIU
  
  Closes https://github.com/curl/curl/issues/6131

- range.d: fix typo
  
  Follow-up to 15ae039 from earlier today.

Daniel Stenberg (26 Oct 2020)
- CI/github: work-around for brew breakage on macOS
  
  ... and make it use OpenSSL 1.1 properly
  
  Fixes #6130
  Closes #6129

- [José Joaquín Atria brought this change]

  range.d: clarify that curl will not parse multipart responses
  
  Closes #6127
  Fixes #6124

- RELEASE-NOTES: synced

- [Baruch Siach brought this change]

  libssh2: fix build with disabled proxy support
  
  Build breaks because the http_proxy field is missing:
  
  vssh/libssh2.c:3119:10: error: 'struct connectdata' has no member named 'http_proxy'
  
  Regression from #6021, shipped in curl 7.73.0
  
  Closes #6125

- alt-svc: enable by default
  
  Remove CURLALTSVC_IMMEDIATELY, which was never implemented/supported.
  
  alt-svc support in curl is no longer considered experimental
  
  Closes #5868

- CI/appveyor: remove (unused) runtests.pl -b option

- [Emil Engler brought this change]

  tool_help: make "output" description less confusing
  
