This release includes the following enhancements and bugfixes:

• autotools: fix to update LDFLAGS for each detected dependency (d19b619 #1384 #1381 #1377)
• autotools: delete --disable-tests option, fix CI tests (e051ae3 #1271 #715 revert: 7483edf)
• autotools: show the default for hidden-symbols option (a3f5594 #1269)
• autotools: enable -Wunused-macros with gcc (ecdf519 #1262 #1227 #1224)
• autotools: fix dotless gcc and Apple clang version detections (89ccc83 #1232 #1187)
• autotools: show more clang/gcc version details (fb58016 #1230)
• autotools: avoid warnings in libtool stub code (96682bd #1227 #1224)
• autotools: sync warning enabler code with curl (5996fef #1223)
• autotools: rename variable (ce5f208 #1222)
• autotools: picky warning options tidy-up (cdca8cf #1221)
• autotools: fix cp to preserve attributes and timestamp in Makefile.am (f64e631)
• autotools: fix selecting WinCNG in cross-builds (and more) (00a3b88 #1187 #1186)
• autotools: use comma separator in Requires.private of libssh2.pc (7f83de1 #1124)
• autotools: remove AB_INIT from configure.ac (f4f52cc)
• autotools: improve libz position (c89174a #1077 #941 #1075 #1013 regr: 4f0f4bf)
• autotools: skip tests requiring static lib if --disable-static (572c57c #1072 #663 #1056 regr: 83853f8)
• build: stop detecting sys/param.h header (2677d3b #1418 #1415)
• build: silence warnings inside FD_SET()/FD_ISSET() macros (323a14b #1379)
• build: drop -Wformat-nonliteral warning suppressions (c452c5c #1342)
• build: enable -pedantic-errors (3ec53f3 #1286)
• build: add mingw-w64 support to LIBSSH2_PRINTF() attribute (f8c4579 #1287)
• build: add LIBSSH2_NO_DEPRECATED option (b141450 #1267 #1266 #1260 #1259)
• build: enable missing OpenSSF-recommended warnings, with fixes (afa6b86 #1257)
• build: enable more compiler warnings and fix them (7ecc309 #1224)
• build: picky warning updates (328a96b #1219)
• build: revert: respect autotools DLL_EXPORT in libssh2.h (481be04 #1141 #917 revert: fb1195c)
• build: stop requiring libssl from openssl (c84745e #1128)
• build: tidy-up libssh2.pc.in variable names (5720dd9 #1125)
• build: add/fix Requires.private packages in libssh2.pc (ef53806 #1123)
• buildconf: drop (814a850 #1441 follow: fc5d778)
• checksrc: update, check all sources, fix fallouts (1117b67 #1457)
• checksrc: sync with curl (8cd473c #1272)
• checksrc: fix spelling in comment (a95d401)
• checksrc: modernise Perl file open (3d309f9)
• checksrc: switch to dot file (d67a91a #1052)
• ci: use Ninja with cmake (20ad047 #1458)
• ci: disable dependency tracking in autotools builds (e44f041 #1396)
• ci: fix mbedtls runners on macOS (8441153 #1381)
• ci: enable Unity mode for most CMake builds (1bfae57 #1367 #1034)
• ci: add shellcheck job and script (d88b9bc)
• ci: verify build and install from tarball (a86e27e #1362)
• ci: add reproducibility test for maketgz (2d765e4 #1360)
• ci: use Linux runner for BSDs, add arm64 FreeBSD 14 job (6f86b19 #1343)
• ci: do not parallelize distcheck job (5e65dd8 #1339)
• ci: add FreeBSD 14 job, fix issues (46333ad #1277)
• ci: add OmniOS job, fix issues (5e0ec99)
• ci: show compiler in cross/cygwin job names (c912408)
• ci: add OpenBSD (v7.4) job + fix build error in example (0c9a8e3 #1250)
• ci: add NetBSD (v9.3) job (65c7a7a)
• ci: update and speed up FreeBSD job (eee4e80)
• ci: use absolute path in CMAKE_INSTALL_PREFIX (7494881 #1247)
• ci: boost mbedTLS build speed (236e79a #1245)
• ci: add BoringSSL job (cmake, gcc, amd64) (c9dd356 #1233)
• ci: fixup FreeBSD version, bump mbedTLS (fea6664 #1217)
• ci: add FreeBSD 13.2 job (a7d2a57 #1215)
• ci: mbedTLS 3.5.0 (5e19044 #1202)
• ci: update actions, use shallow clones with appveyor (d468a33 #1199)
• ci: replace mv + chmod with install in Dockerfile (5754fed #1175)
• ci: set file mode early in appveyor_docker.yml (633db55)
• ci: add spellcheck (codespell) (a79218d)
• ci: add MSYS builds (autotools and cmake) (d43b8d9 #1162)
• ci: add Cygwin builds (autotools and cmake) (f1e96e7 #1161)
• ci: add mingw-w64 UWP build (1215aa5 #1155 #1147)
• ci: add missing timeout to 'autotools distcheck' step (6265ffd)
• ci: add non-static autotools i386 build, ignore GHA updates on AppVeyor (c6e137f #1074 #1072)
• ci: prefer = operator in shell snippets (e5c0304 #1073)
• ci: drop redundant/unused vars, sync var names (ab8e95b #1059)
• ci: add i386 Linux build (with mbedTLS) (abdf40c #1057 #1053)
• ci/appveyor: reduce test runs (workaround for infrastructure permafails) (b5e68bd #1461)
• ci/appveyor: increase wait for SSH server on GHA (bf3af90)
• ci/appveyor: bump to OpenSSL 3.2.1 (53d9c1a #1363 #1348)
• ci/appveyor: re-enable parallel mode (e190e5b #1294 #884 #867)
• ci/appveyor: delete UWP job broken since Visual Studio upgrade (d0a7f1d #1275)
• ci/appveyor: YAML/PowerShell formatting, shorten variable name (06fd721 #1200)
• ci/appveyor: move to pure PowerShell (8a081fd #1197)
• ci/GHA: revert concurrency and improve permissions (e4c042f)
• ci/GHA: FreeBSD 14.1, actions bump (ae04b1b #1424)
• ci/GHA: fix wolfSSL-from-source AES-GCM tests (1c0b07a #1409 #1408)
• ci/GHA: add Linux job with latest wolfSSL built from source (d4cea53 #1408 #1299 #1020)
• ci/GHA: tidy up build-from-source steps (2c63303)
• ci/GHA: show configure logs on failure and other tidy-ups (dab4839 #1403)
• ci/GHA: bump parallel jobs to nproc+1 (6f3d3bc #1402)
• ci/GHA: show test logs on failure (b8ffa7a #1401)
• ci/GHA: fix Dockerfile failing after Ubuntu package update (839bb84 #1400)
• ci/GHA: use ubuntu-latest with OmniOS job (50143d5)
• ci/GHA: shell syntax tidy-up (3b23e03 #1390)
• ci/GHA: bump NetBSD/OpenBSD, add NetBSD arm64 job (e980af7 #1388)
• ci/GHA: tidy up wolfSSL autotools config on macOS (5953c1f #1383)
• ci/GHA: shorter mbedTLS autotools workaround (736e3d7 #1382 #1381)
• ci/GHA: fix gcrypt with autotools/macOS/Homebrew/ARM64 (ae2770d #1377)
• ci/GHA: fix verbose option for autotools jobs (499b27a #1376)
• ci/GHA: dump config.log on failure for macOS autotools jobs (4fa6921 #1375)
• ci/GHA: fix autoreconf failure on macOS/Homebrew (0b64b30 #1374)
• ci/GHA: fixup Homebrew location (for ARM runners) (6128aee #1373)
• ci/GHA: review/fixup auto-cancel settings (b08cfbc #1292)
• ci/GHA: restore curly braces in if (3674827 #1145)
• ci/GHA: simplify if strings (cab3db5 #1140)
• cmake: sync and improve Find modules, add pkg-config native detection (4506413 #1445 #1420)
• cmake: generate LIBSSH2_PC_LIBS_PRIVATE dynamically (c87f129 #1466)
• cmake: add comment about ibssh2.pc.in variables (14b1b9d)
• cmake: support absolute CMAKE_INSTALL_INCLUDEDIR/CMAKE_INSTALL_LIBDIR (d70cee3 #1465)
• cmake: rename two variables and initialize them (0fce9dc #1464)
• cmake: prefer find_dependency() in libssh2-config.cmake (d9c2e55 #1460)
• cmake: tidy up syntax, minor improvements (9d9ee78 #1446)
• cmake: rename mbedTLS and wolfSSL Find modules (570de0f)
• cmake: fixup version detection in mbedTLS Find module (8e3c40b #1444)
• cmake: mbedTLS detection tidy-ups (6d1d13c #1438)
• cmake: add quotes, delete ending dirseps (2bb46d4 #1437 #1166)
• cmake: sync formatting in cmake/Find* modules (a031069)
• cmake: tidy up function name casing in CopyRuntimeDependencies.cmake (03547cb)
• cmake: use the imported target of FindOpenSSL module (82b09f9 #1322)
• cmake: rename picky warnings script (64d6789 #1225)
• cmake: fix multiple include of libssh2 package (932d6a3 #1216)
• cmake: show crypto backend in feature summary (2038728 #1211)
• cmake: simplify showing CMake version (fc00bdd #1203)
• cmake: cleanup mbedTLS version detection more (4c241d5 #1196 #1192)
• cmake: delete duplicate include() (30eef0a)
• cmake: improve/fix mbedTLS detection (4159467 #1192 #1191)
• cmake: tidy-up foreach() syntax (4a64ca1 #1180)
• cmake: verify libssh2_VERSION in integration tests (a20572e)
• cmake: show cmake versions in ci (87f5769)
• cmake: quote more strings (e9c7d3a #1173)
• cmake: add ExternalProject integration test (aeaefaf #1171)
• cmake: add integration tests (8715c3d #1170)
• cmake: (re-)add aliases for add_subdirectory() builds (4ff64ae #1169)
• cmake: style tidy-up (3fa5282 #1166)
• cmake: add LIB_NAME variable (5453fc8 #1159)
• cmake: tidy-up concatenation in CMAKE_MODULE_PATH (ae7d510 #1157)
• cmake: replace libssh2 literals with PROJECT_NAME variable (72fd259 #1152)
• cmake: fix STREQUAL check in error branch (42d3bf1 #1151)
• cmake: cache more config values on Windows (11a0369 #1142)
• cmake: streamline invocation (f58f77b #1138)
• cmake: merge set_target_properties() calls (a909100 #1132)
• cmake: (re-)add zlib to Libs.private in libssh2.pc (6464301 #1131)
• cmake: use wolfssl/options.h for detection, like autotools (c5ec6c4 #1130)
• cmake: add openssl libs to Libs.private in libssh2.pc (5cfa59d #1127)
• cmake: bump minimum CMake version to v3.7.0 (9cd18f4 #1126)
• cmake: CMAKE_SOURCE_DIR -> PROJECT_SOURCE_DIR (0f396aa #1121)
• cmake: tidy-ups (2fc3679 #1122)
• cmake: re-add Libssh2:libssh2 for compatibility + lowercase namespace (2da13c1 #1104 #731 #1103)
• copyright: remove years from copyright headers (187d89b #1082)
• disable DSA by default (b7ab0fa #1435 #1433)
• docs: update INSTALL_AUTOTOOLS (2f0efde #1316)
• docs: replace SHA1 with SHA256 in CMake example (766bde9)
• example: restore sys/time.h for AIX (24503cb #1340 #1335 #1334 #1001 regr: e53aae0)
• example: use libssh2_socket_t in X11 example (3f60ccb)
• example: replace remaining libssh2_scp_recv with libssh2_scp_recv2 in output messages (8d69e63 #1258 follow: 6c84a42)
• example: fix regression in ssh2_exec.c (279a2e5 #1106 #861 #846 #1105 regr: b13936b)
• example, tests: call WSACleanup() for each WSAStartup() (94b6bad #1283)
• example, tests: fix/silence -Wformat-truncation=2 gcc warnings (744e059)
• hostkey: do not advertise ssh-rsa when SHA1 is disabled (82d1b8f #1093 #1092)
• kex: prevent possible double free of hostkey (b346541 #1452)
• kex: always check for null pointers before calling _libssh2_bn_set_word (9f23a3b #1423)
• kex: fix a memory leak in key exchange (1910184 #1412 #1404)
• kex: always add extension indicators to kex_algorithms (00e2a07 #1327 #1326)
• libssh2.h: add deprecated function warnings (9839ebe #1289 #1260)
• libssh2.h: add portable LIBSSH2_SOCKET_CLOSE() macro (28dbf01 #1278)
• libssh2.h: use _WIN32 for Windows detection instead of rolling our own (631e773 #1238)
• libssh2.pc: reference mbedcrypto pkgconfig (c149a12 #1405)
• libssh2.pc: re-add & extend support for static-only libssh2 builds (624abe2 #1119 #1114)
• libssh2.pc: don't put @LIBS@ in pc file (1209c16)
• mac: add empty hash functions for mac_method_hmac_aesgcm to not crash when e.g. setting LIBSSH2_METHOD_CRYPT_CS (b273839 #1321)
• mac: handle low-level errors (f64885b #1297)
• Makefile.mk: delete Windows-focused raw GNU Make build (4348557 #1204)
• maketgz: reproducible tarballs/zip, display tarball hashes (d52fe1b #1357 #1359)
• maketgz: set -eu, reproducibility, improve zip, add CI test (cba7f97 #1353)
• man: improve libssh2_userauth_publickey_from* manpages (581b72a #1347 #1308 #652)
• man: fix double spaces and dash escaping (a3ffc42 #1210)
• man: add description to libssh2_session_get_blocking.3 (67e3909 #1185)
• mbedtls: always init ECDSA mbedtls_pk_context (a50d7de #1430)
• mbedtls: correctly initialize values (ECDSA) (1701d5c #1428 #1421)
• mbedtls: expose mbedtls_pk_load_file() for our use (1628f6c #1421 #1393 #1349 follow: e973493)
• mbedtls: add workaround + FIXME to build with 3.6.0 (2e4c5ec #1349)
• mbedtls: improve disabling -Wredundant-decls (ecec68a #1226 #1224)
• mbedtls: include version.h for MBEDTLS_VERSION_NUMBER (9d7bc25 #1095 #1094)
• mbedtls: use more size_t to sync up with crypto.h (1153ebd #1054 #879 #846 #1053)
• md5: allow disabling old-style encrypted private keys at build-time (eb9f9de #1181)
• mingw: fix printf mask for 64-bit integers (36c1e1d #1091 #876 #846 #1090)
• misc: flatten _libssh2_explicit_zero if tree (74e7428 #1149)
• NMakefile: delete (c515eed #1134 #1129)
• openssl: free allocated resources when using openssl3 (b942bad #1459)
• openssl: fix memory leaks in _libssh2_ecdsa_curve_name_with_octal_new and _libssh2_ecdsa_verify (8d3bc19 #1449)
• openssl: fix calculating DSA public key with OpenSSL 3 (8b3c6e9 #1380)
• openssl: initialize BIGNUMs to NULL in gen_publickey_from_dsa for OpenSSL 3 (f1133c7 #1320)
• openssl: fix cppcheck found NULL dereferences (f294590 #1304)
• openssl: delete internal read_openssh_private_key_from_memory() (34aff5f #1306)
• openssl: use OpenSSL 3 HMAC API, add no-deprecated CI job (363dcbf #1243 #1235 #1207)
• openssl: make a function static, add #ifdef comments (efee913 #1246 #248 follow: 0309229)
• openssl: fix DSA code to use OpenSSL 3 API (8258194 #1244 #1207)
• openssl: fix EC_KEY reference with OpenSSL 3 no-deprecated build (487152f #1236 #1235 #1207)
• openssl: use non-deprecated APIs with OpenSSL 3.x (b0ab005 #1207)
• openssl: silence -Wunused-value warnings (bf28550 #1205)
• openssl: use automatic initialization with LibreSSL 2.7.0+ (d79047c #1146 #302)
• openssl: add missing check for LIBRESSL_VERSION_NUMBER before use (4a42f42 #1117 #1115)
• os400: drop vsprintf() use (40e817f #1462 #1457)
• os400: Add two recent files to the distribution (e4c65e5 #1364)
• os400: fix shellcheck warnings in scripts (fixups) (81341e1 #1366 #1364 #1358)
• os400: fix shellcheck warnings in scripts (c662570 #1358)
• os400: maintain up to date (8457c37 #1309)
• packet: properly bounds check packet_authagent_open() (88a960a #1179)
• pem: fix private keys encrypted with AES-GCM methods (e87bdef #1133)
• reuse: upgrade to REUSE.toml (70b8bf3 #1419)
• reuse: fix duplicate copyright warning (b9a4ed8)
• reuse: comply with 3.1 spec and 2.0.0 checker (fe6239a #1102 #1101 #1098)
• reuse: provide SPDX identifiers (f6aa31f #1084)
• scp: fix missing cast for targets without large file support (c317e06 #1060 #1057 #1002 regr: 5db836b)
• session: support server banners up to 8192 bytes (was: 256) (1a9e881 #1443 #1442)
• session: add libssh2_session_callback_set2() (c0f6954 #1285)
• session: handle EINTR from send/recv/poll/select to try again as the error is not fatal (798ed4a #1058 #955)
• sftp: increase SFTP_HANDLE_MAXLEN back to 4092 (75de6a3 #1422)
• sftp: implement posix-rename@openssh.com (fb65274 #1386)
• src: implement chacha20-poly1305@openssh.com (492bc54 #1426 #584)
• src: use UINT32_MAX (dc20640 #1413)
• src: fix type warning in libssh2_sftp_unlink macro (ac2e8c7 #1406)
• src: check the return value from _libssh2_bn_*() functions (95c824d #1354)
• src: support RSA-SHA2 cert-based authentication (rsa-sha2-512_cert and rsa-sha2-256_cert) (3a6ab70 #1314)
• src: check hash update/final success (4718ede #1303 #1301)
• src: check hash init success (2ed9eb9 #1301)
• src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" (d34d925 #1291 #1290)
• src: disable -Wsign-conversion warnings, add option to re-enable (6e45166 #1284 #1257)
• src: fix gcc 13 -Wconversion warning on Darwin (8cca7b7 #1209 follow: 08354e0)
• src: drop a redundant #include (1f0174d #1153)
• src: improve MSVC C4701 warning fix (8b92499 #1086 #876 #1083)
• src: bump hash_len to size_t in LIBSSH2_HOSTKEY_METHOD (8b917d7 #1076)
• src: bump DSA and ECDSA sign hash_len to size_t (7b8e022 #1055)
• tests: avoid using MAXPATHLEN, for portability (12427f4 #1415 #198 #1414)
• tests: fix excluding AES-GCM tests (fbd9d19 #1410)
• tests: drop default cygpath option -u (38e50aa)
• tests: fix shellcheck issues in test_sshd.test (a2ac8c5)
• tests: sync port number type with the rest of codebase (eb996af)
• tests: fall back to $LOGNAME for username (5326a5c #1241 #1240)
• tests: show cmake version used in integration tests (2cd2f40 #1201)
• tests: formatting and tidy-ups (e61987a)
• tests: replace FIXME with comments (1a99a86)
• tests: add aes256-gcm encrypted key test (802336c #1135 #1133)
• tests: trap signals in scripts (b2916b2 #1098)
• tests: cast to avoid -Wchar-subscripts with Cygwin (43df6a4 #1081 #1080)
• test_read: make it run without Docker (57e9d18 #1139)
• test_sshd.test: show sshd and test connect logs on harness failure (299c204 #1097)
• test_sshd.test: set a safe PID directory (e8cabdc #1089)
• test_sshd.test: minor cleanups (d29eea1)
• tidy-up: link updates (c905bfd #1434)
• tidy-up: typo in comment (792e1b6)
• tidy-up: fix typo found by codespell (706ec36)
• tidy-up: bump casts from int to long for large C99 types in printfs (2e5a871 #1264 #1257)
• tidy-up: unsigned -> unsigned int (b136c37)
• tidy-up: stop using leading underscores in macro names (c6589b8 #1248)
• tidy-up: around stdint.h (bfa00f1 #1212)
• tidy-up: fix typo in readme.vms (a9a79e7)
• tidy-up: use built-in _WIN32 macro to detect Windows (6fbc950 #1195)
• tidy-up: drop www. from www.libssh2.org (6e3e883 #1172)
• tidy-up: delete duplicate word from comment (7630743)
• tidy-up: avoid exclamations, prefer single quotes, in outputs (003fb45 #1079)
• TODO: disable or drop weak algos (0b4bdc8 #1261)
• transport: fix unstable connections over non-blocking sockets (de00487 #1454 #720 #1431 #1397)
• transport: check ETM on remote end when receiving (bde1082 #1332 #1331)
• transport: fix incorrect byte offset in debug message (2388a3a #1096)
• userauth: avoid oob with huge interactive kbd response (f3a85ca #1337)
• userauth: add a new structure to separate memory read and file read (63b4c20 #773)
• userauth: check whether *key_method is a NULL pointer instead of key_method (bec57c4)
• wincng: fix DH_GEX_MAXGROUP set higher than supported (4858467 #1372 #493)
• wincng: add to ci/GHA, add ./configure option --enable-ecdsa-wincng (3f98bfb #1368 #1315)
• wincng: add ECDSA support for host and user authentication (3e72343 #1315)
• wincng: prefer ULONG/DWORD over unsigned long (186c1d6 #1165)
• wincng: tidy-ups (7bb669b #1164)
• wolfssl: drop header path hack (8ae1b2d #1439)
• wolfssl: fix EVP_Cipher() use with v5.6.0 and older (a5b0fac #1407 #1394 #797 #1299 #1020)
• wolfssl: bump version in upstream issue comment (5cab802)
• wolfssl: require v5.4.0 for AES-GCM (260a721 #1411 #1299 #1020)
• wolfssl: enable debug logging in wolfSSL when compiled in (76e7a68 #1310)

Credits

This release would not have looked like this without help, code, reports and
advice from friends like these:

Viktor Szakats, Michael Buckley, Patrick Monnerat, Ren Mingshuai,
Will Cosgrove, Daniel Stenberg, Josef Cejka, Nicolas Mora, Ryan Kelley,
Aaron Stone, Adam, Anders Borum, András Fekete, Andrei Augustin, binary1248,
Brian Inglis, brucsc on GitHub, concussious on github, Dan Fandrich,
dksslq on github, Haowei Hsu, Harmen Stoppels, Harry Mallon, Jack L,
Jakob Egger, Jiwoo Park, João M. S. Silva, Joel Depooter, Johannes Passing,
Jose Quaresma, Juliusz Sosinowicz, Kai Pastor, Kenneth Davidson,
klux21 on github, Lyndon Brown, Marc Hoersken, mike-jumper, naddy,
Nursan Valeyev, Paul Howarth, PewPewPew, Radek Brich, rahmanih on github,
rolag on github, Seo Suchan, shubhamhii on github, Steve McIntyre,
Tejaswi Kandula, Tobias Stoeckmann, Trzik, Xi Ruoyao