Pending RELEASE-NOTES for the upcoming release

This is work in progress and seeing changes before the release goes public on 2026-06-24.

Changes:

• curl: named globs in output file name for upload glob references
• lib: drop support for CURLAUTH_DIGEST_IE
• libssh: add support for SHA256 host public keys
• tool_urlglob: add named globs

Bugfixes:

• asyn-thrdd: fix result processing without wakeup socketpair
• cf-h2-proxy: drop interim responses
• cmake: auto-select static nghttp2/nghttp3/ngtcp2 Config
• cmake: export/forward `NGTCP2_CRYPTO_BACKEND`
• cmake: fix zstd CMake config name
• cookie: compare path case sensitively
• cookie: simplify strstore(), remove outdated comment
• cookie: trim trailing dots when checking PSL
• creds: add sasl service name
• curl_ntlm_core: fix nettle 4+ builds in certain MultiSSL combos
• curl_ntlm_core: propagate DES `CryptEncrypt()` error
• CURLOPT_ECH.md: simplify the description language
• CURLOPT_HAPROXYPROTOCOL.md: only sent for newly setup connections
• CURLOPT_MAXFILESIZE: clarify this also works for on-going transfers
• CURLOPT_SHARE: warn about early remove
• CURLOPT_SSH_HOSTKEYFUNCTION.md: for new connections only
• delta: harden external command invocations
• docs: end "...can be used several times..." sentences with period
• docs: fix --follow doc typo
• docs: fix a couple of typos
• docs: fix grammar and wording in FAQ
• ECH: cleanups
• event: fix wakeup consumption
• ftp: avoid accessing EPSV response one byte past the NULL
• ftp: remove 2 Curl_resolv_blocking() calls
• ftp: remove bits.ftp_use_control_ssl
• gnutls: allow building with nettle 4.0
• gnutls: fix more nettle 4+ compatibility issues
• gsasl: fix potential double free
• gtls: fix some typos
• hostip: remove unused MAX_HOSTCACHE_LEN and MAX_DNS_CACHE_SIZE
• idn: replace header guards with forward declaration
• ldap: fix minor leak on write callback error
• ldap: fix to not leak `attribute` on OOM (WinLDAP)
• lib678: fix to not be perma-skipped
• lib: make `__STDC_VERSION__` literals `L` (where missing)
• lib: two minor typos
• libcurl-easy.md: minor clarifications
• mbedtls: null-terminate the private key blob
• mqtt: validate PINGRESP and DISCONNECT have remaining_length == 0
• pythonlint.sh: make it fail on error, fix ruff warnings in pytest
• rtsp: bump buf after rtsp_filter_rtp()
• runner.pm: set `CURL_TESTNUM` for `precheck` commands
• rustls: error on CURLOPT_CRLFILE with native CA store
• schannel: enforce Extended Key Usage for custom CA roots
• schannel_verify: avoid out of blob access
• setopt: changing the proxy port is also a proxy change
• setopt: fix to honor `CURLOPT_PROXY_CAINFO_BLOB` over Native CA
• setopt: gate a few proxy TLS options by checking backend support
• setopt: more careful cleanup of the HSTS cache
• show-headers.md: mention bold headers and --no-styled-output
• snpego_sspi: preserve distinction btw policy-only and uncond delegation
• spnego_sspi: honor CURLOPT_GSSAPI_DELEGATION for Windows SSPI
• src: fix comment typos
• SSLCERTS: document 8.19.0 default Native CA builds (Windows)
• tests: fix unit1636 with --disable-progress-meter
• tftp: stricter option name checks
• tool_formparse.c: fix two minor comment typos
• tool_formparse: polish error message + make two functions static
• tool_formparse: tool2curlparts is no longer recursive
• tool_urlglob: avoid overflow at end of range
• tool_urlglob: better 'Duplicate glob name' position
• tool_urlglob: make globbing error reported for correct position
• unix-sockets: ignore proxy settings
• url: compare full origin when setting credentials
• url: fix connection reuse for starttls protocols
• url: keep the question mark for empty queries
• url: remove ssh_config_matches
• url: url_match_destination fix
• urlapi: change more lowercase percent-encoded to uppercase
• urlapi: consume trailing dots after IPv4 numerical addresses
• urlapi: deny hostnames with more than one trailing dot
• urlapi: handle redirect without set scheme with default-scheme
• user-agent.md: mention double quotes too
• windows: update MS SDK versions in comments
• x509asn1: fix DH public key parameter extraction
• x509asn1: fix operator order in do_pubkey

Contributors:

0xN3R3K3, Alan De Smet, amitbidlan, Andrei Rybak, Andrew Nesbitt, Bastian Jesuiter, Bill Mill, chrizilla on github, Dan Fandrich, Daniel Stenberg, dependabot[bot], Earnestly on github, Elise Vance, Emanuel Krollmann, Fabian Keil, jeffhuang, Jeremy Nicoll, Joshua Rogers, Kai Pastor, mulan_dh on hackerone, parasol-aser, Raymond Steen, renovate[bot], Sergio Correia, Sollace on github, Song X. Gao, Stefan Eissing, Tim Martin, Viktor Szakats, Xi Ruoyao, x-xiang on github