Pending RELEASE-NOTES for the upcoming release

This is work in progress and will change before the release goes public on 2025-09-10.

Changes:

• build: bump minimum required mingw-w64 to v3.0 (from v1.0)
• curl: add --parallel-max-host to limit concurrent connections per host
• curl: add long option '--out-null'
• curl: make --retry-delay and --retry-max-time accept decimal seconds
• ip happy eyeballing: keep attempts running
• multi: add CURLMOPT_NETWORK_CHANGED to signal network changed
• netrc: use the NETRC environment variable (first) if set
• smtp: allow suffix behind a mail address for RFC 3461
• tls: make default TLS version be minimum 1.2
• tool_getparam: add support for `--longopt=value`
• vquic: drop msh3

Bugfixes:

• _PROTOCOLS.md: mention file:// is only for absolute paths
• alpn: query filter
• bufq: add integer overflow checks before chunk allocations
• build: allow libtests/clients to use libcurl dependencies directly
• build: enable _GNU_SOURCE on GNU/Hurd
• build: extend GNU C guards to clang where applicable, fix fallouts
• build: fix build errors/warnings in rare configurations
• build: fix disable-verbose
• build: fix mingw-w64 version guard for mingw32ce
• build: link to Apple frameworks required by static wolfSSL
• build: tidy up compiler definition for tests
• cf-https-connect: delete unused declaration
• cmake: capitalize 'Rustls' in the config summary
• cmake: defer building `unitprotos.h` till a test target needs it
• cmake: fix `ENABLE_UNIX_SOCKETS=OFF` with pre-fill enabled on unix
• cmake: fix to disable Schannel and SSPI for non-Windows targets
• cmake: keep websockets disabled if HTTP is disabled
• cmake: make `runtests` targets build the curl tool
• cmake: omit linking duplicate/unnecessary libs to tests & examples
• CODE_STYLE: sync with recent `checksrc.pl` updates
• config-win32.h: do not use winsock2 `inet_ntop()`/`inet_pton()`
• connectdata: remove primary+secondary ip_quadruple
• connection: terminate after goaway
• contrithanks: fix for BSD `sed` tool
• curl/system.h: fix for GCC 3.3.x and older
• curl: make the URL indexes 64 bit
• curl: tool_read_cb fix of segfault
• curl_addrinfo: drop workaround for old-mingw
• curl_easy_ssls_export: make the example more clear
• curl_fnmatch, servers: drop local macros in favour of `sizeof()`
• curl_mime_data_cb.md: mention what datasize is for
• curl_ossl: extend callback table for nghttp3 1.11.0
• curl_setup.h: move UWP detection after `config-win32.h` (revert)
• curl_setup.h: move UWP detection after `config-win32.h`
• CURLOPT: bump `CURL_REDIR_*` macros to `long`
• CURLOPT: bump `CURLALTSVC_*` macros to `long`
• CURLOPT: bump `CURLFTP*` enums to `long`, drop casts
• CURLOPT: bump `CURLHEADER_*` macros to `long`, drop casts
• CURLOPT: bump `CURLPROXY_*` enums to `long`, drop casts
• CURLOPT: drop redundant `long` casts
• delta: fix warnings, fix for non-GNU `date` tool
• DEPRECATE.md: drop support for Windows XP/2003
• DEPRECATE.md: remove leftover "nothing"
• DISTROS.md: add Haiku
• docs/cmdline-opts: the auth types are not mutually exclusive
• docs: fix name in curl_easy_ssls_export man page
• doh: rename symbols to avoid collision with mingw-w64 headers
• easy handle: check validity on external calls
• gnutls: some small cleanups
• hmac: return error if init fails
• http: const up readonly H2_NON_FIELD
• http: silence `-Warray-bounds` with gcc 13+
• inet_pton, inet_ntop: drop declarations when unused
• lib1560: fix memory leak when run without UTF-8 support
• lib1560: replace an `int` with `bool`
• lib517: use `LL` 64-bit literals & re-enable a test case (`time_t`)
• libssh: Use sftp_aio instead of sftp_async for sftp_recv
• libtests: update format strings to avoid casts, drop some macros
• memanalyze: fix warnings
• memory: make function overrides work reliably in unity builds
• multi event: remove only announced
• multi: don't insert a node into the splay tree twice
• multi: fix assert in multi_getsock()
• multi: process pending, one by one
• multi: replace remaining EXPIRE_RUN_NOW
• multissl: initialize when requesting a random number
• ngtcp2: extend callback tables for nghttp3 1.11.0 and ngtcp2 1.14.0
• openssl: some small cleanups
• openssl: split cert_stuff into smaller sub functions
• parallel-max: bump the max value to 65535
• pytest: add SOCKS tests and scoring
• pytest: increase server KeepAliveTimeout
• pytest: relax error check on test_07_22
• schannel: assume `CERT_CHAIN_REVOCATION_CHECK_CHAIN`
• schannel: drop fallbacks for 4 macros
• schannel: drop fallbacks for unused `BCRYPT_*` macros
• schannel: drop old-mingw special case
• schannel: fix recent update for mingw32ce
• schannel: not supported with UWP, drop redundant code
• schannel: use if(result) like the code style says
• scripts: enable strict warnings in Perl where missing, fix fallouts
• scripts: fix two Perl uninitialized value warnings
• servers: convert two macros to scoped static const strings
• setopt: refactor out the booleans from setopt_long to setopt_bool
• socks: do_SOCKS5: Fix invalid buffer content on short send
• spacecheck.pl: when detecting unicode, mention line number
• test1148: drop redundant `LC_NUMBER=` env setting
• test1560: set locale/codeset with `LC_ALL` (was: `LANG`), test in CI
• test1560: skip some URLs if UTF-8 is not supported
• test1: raise alloc limits
• test428: re-enable for Windows
• tests: constify command-line arguments
• tests: drop unused `CURL_FORCEHOST` envs
• tests: fix perl warnings in http2-server, http3-server
• tests: fix prechecks to call the bundle libtest tool
• tests: fix UTF-8 detection, per-test `LC_*` settings, CI coverage
• tests: merge clients into libtests, drop duplicate code
• tests: set `CURL_ENTROPY` per test, not globally
• tests: unset some envs instead of blanking them
• tidy-up: `Curl_thread_create()` callback return type
• tidy-up: move literal to the right side of comparisons
• tidy-up: prefer `ifdef`/`ifndef` for single checks
• tls: CURLINFO_TLS_SSL_PTR testing
• tool_operate: avoid superfluous strdup'ing output
• unit-tests: build the unitprotos.h from here
• vquic-tls: fix SSL backend type for QUIC connections using gnutls
• windows: assume `ADDRESS_FAMILY`, drop feature checks
• windows: document toolchain support for `CERT_NAME_SEARCH_ALL_NAMES_FLAG`
• windows: document toolchain support for some macros (cont.)
• windows: document toolchain support for some macros
• windows: drop `CRYPT_E_*` macro fallbacks, limit one to mingw32ce
• windows: drop two interim, single-use macros
• windows: drop unused `curlx/version_win32.h` includes
• windows: fix `if_nametoindex()` detection with autotools, improve with cmake
• windows: include `wincrypt.h` before `iphlpapi.h` for mingw-w64 <6
• windows: target version macro tidy-ups
• ws: avoid NULL pointer deref in curl_ws_recv

Contributors:

Ahmad Gani, Alice Lee Poetics, Ammar Faizi, Berthin Torres Callañaupa, Caolán McNamara, Cole Leavitt, d1r3ct0r, Dan Fandrich, Daniel Stenberg, David Zhuang, Dominik Tomecki, Eshan Kelkar, Harry Sintonen, Kai Pastor, LoRd_MuldeR, nevakrien on github, Paul Gilmartin, Philippe Antoine, Pino Toscano, Qriist on github, Ray Satiro, renovate[bot], rm-rmonaghan on github, Schrijvers Luc, Sergio Durigan Junior, Stefan Eissing, Tal Regev, Todd Gamblin, Viktor Szakats, yaoy6 on github, ウさん