Pycurl

Latest version: v7.45.6

Safety actively analyzes 723158 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 3 of 13

7.43.0.3

Not secure
-----------------------------------------------------------------

* Fixed use with libcurl 7.65+ when FTP support is disabled.

* Added support for mbedTLS (patch by Josef Schlehofer).

* Fixed string processing on Python 3 (patch by Dmitriy Taychenachev).

* Added CURLOPT_TCP_FASTOPEN and CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE
(patch by Khavish Anshudass Bhundoo).

* Repaired inability to install PycURL when libcurl is using an SSL
backend other than the ones PycURL explicitly recognizes and
handles (OpenSSL, LibreSSL, BoringSSL, GnuTLS, NSS).
The requirement for setup.py to detect an SSL backend if libcurl
is configured to use SSL, added in 7.43.0.2, has been changed
to a warning to allow this.

7.43.0.2

Not secure
-----------------------------------------------------------------

* Official Windows builds now include HTTP 2 support via
libnghttp2 and international domain name support via WINIDN.

* Added perform_rb and perform_rs methods to Curl objects to
return response body as byte string and string, respectively.

* Added OPT_COOKIELIST constant for consistency with other
option constants.

* PycURL is now able to report errors triggered by libcurl
via CURLOPT_FAILONERROR mechanism when the error messages are
not decodable in Python's default encoding (GitHub issue 259).

* Added getinfo_raw method to Curl objects to return byte strings
as is from libcurl without attempting to decode them
(GitHub issue 493).

* When adding a Curl easy object to CurlMulti via add_handle,
the easy objects now have their reference counts increased so that
the application is no longer required to keep references to them
to keep them from being garbage collected (GitHub issue 171).

* PycURL easy, multi and share objects can now be weak referenced.

* Python 3.2 and 3.3 support officially dropped as those versions
are end of lifed.

* set_ca_certs now accepts byte strings as it should have been
all along.

* PycURL now skips automatic SSL backend detection if curl-config
indicates that libcurl is not built with SSL support, and will warn
if an SSL backend is explicitly specified in this case.

* PycURL now requires that SSL backend is determined by setup.py
to provide earlier failure compared to the existing warning
during compilation and failing during module import on mismatched
SSL backends.

* Use OpenSSL 1.1 and 1.0 specific APIs for controlling thread locks
depending on OpenSSL version (patch by Vitaly Murashev).

* Fixed a crash when closesocket callback failed (patch by
Gisle Vanem and toddrme2178).

* Added CURLOPT_PROXY_SSLCERT, CURLOPT_PROXY_SSLCERTTYPE,
CURLOPT_PROXY_SSLKEY, CURLOPT_PROXY_SSLKEYTYPE,
CURLOPT_PROXY_SSL_VERIFYPEER (libcurl 7.52.0+,
patch by Casey Miller).

* Added CURLOPT_PRE_PROXY (libcurl 7.52.0+, patch by ziggy).

* Support for Python 2.6 officially dropped.

* Added SOCKET_BAD constant and it is now recognized as a valid
return value from OPENSOCKET callback.

* BoringSSL is now recognized as equivalent to OpenSSL backend
(patch by Gisle Vanem).

7.43.0.1

Not secure
-----------------------------------------------------------------

* WRITEHEADER/WRITEFUNCTION and WRITEDATA/WRITEFUNCTION can now
be set on the same handle. The last call will take precedence over
previous calls. Previously some combinations were not allowed.

* Fixed a crash when using WRITEDATA with a file-like object followed
by WRITEDATA with a real file object (patch by Léo El Amri).

* Fixed a theoretical memory leak in module initialization (patch by
ideal).

* Added support for CURL_SSLVERSION_MAX_* constants (libcurl 7.52.0+,
patch by Jozef Melicher).

* Added support for CURLSSH_AUTH_AGENT (libcurl 7.28.0+,
patch by kxrd).

* Added support for CURLOPT_CONNECT_TO (patch by Iain R. Learmonth).

* Added support for CURLINFO_HTTP_VERSION (patch by Iain R. Learmonth).

* Fixed build against OpenSSL l.1 on Windows.

* Added set_ca_certs method to the Easy object to set CA certificates
from a string (OpenSSL only, patch by Lipin Dmitriy).

* Python 3.6 is now officially supported (patch by Samuel
Dion-Girardeau).

* Added support for CURLOPT_PROXY_CAPATH (libcurl 7.52.0+,
patch by Jan Kryl).

* C-Ares updated to 1.12.0 in Windows builds, fixing DNS resolution
issues on Windows (patch by Wei C).

* Added --openssl-lib-name="" option to support building against
OpenSSL 1.1.0 on Windows.

* Fixed a possible double free situation in all Curl objects
due to a misuse of the trashcan API (patch by Benjamin Peterson).

* High level Curl objects can now be reused.

* LARGE options fixed under Windows and Python 3 (INFILESIZE,
MAX_RECV_SPEED_LARGE, MAX_SEND_SPEED_LARGE, MAXFILESIZE,
POSTFILESIZE, RESUME_FROM).

* Fixed compilation on Solaris (patch by Yiteng Zhang).

* ENCODING option can now be unset (patch by Yves Bastide).

7.43.0

Not secure
---------------------------------------------------------------

* Added CURLINFO_RTSP_* constants (libcurl 7.20.0+).

* Added CURLOPT_XOAUTH2_BEARER (libcurl 7.33.0+).

* Added CURLOPT_SASL_IR (libcurl 7.31.0+).

* Added CURLOPT_LOGIN_OPTIONS (libcurl 7.34.0+).

* Added CURLOPT_FTP_USE_PRET (libcurl 7.20.0+).

* Added setopt_string method to Curl objects to set arbitrary
string options.

* Switched to Bintray for hosting release distributions.

* Added CURLOPT_DEFAULT_PROTOCOL (libcurl 7.45.0+).

* Added CURLOPT_TLSAUTH_* options (libcurl 7.21.4+).

* Added CURLPROTO_SMB and CURLPROTO_SMBS constants (libcurl 7.40.0+).

* Added CURL_SOCKOPT_* constants (libcurl 7.21.5+).

* Added CURL_HTTP_VERSION_2_0, CURL_HTTP_VERSION_2 and
CURL_HTTP_VERSION_2TLS constants for CURLOPT_HTTP_VERSION
(various libcurl versions required for these).

* winbuild.py can now build binary wheels on Windows.

* Added failed memory allocation handling during SSL lock initialization.

* CURLOPT_IOCTLDATA option support has been removed.
This option is used internally by PycURL and is not settable by
applications.

* HTTPHEADER and PROXYHEADER options can now be unset.

* Added CURLPIPE_* constants (libcurl 7.43.0+).

* Added CURLOPT_PIPEWAIT (libcurl 7.43.0+).

* Added CURLOPT_PATH_AS_IS (libcurl 7.42.0+).

* Added CURLOPT_PROXYHEADER and CURLOPT_HEADEROPT as well as
CURLHEADER_UNIFIED and CURLHEADER_SEPARATE (libcurl 7.37.0+).

* Added CURLOPT_EXPECT_100_TIMEOUT_MS (libcurl 7.36.0+).

* Added CURLOPT_XFERINFOFUNCTION (libcurl 7.32.0+).

* Added CURLM_ADDED_ALREADY error constant (libcurl 7.32.1+).

* Added remaining CURLE_* constants through libcurl 7.46.0.

* Unbroken `curl' module import on Windows - apparently Windows now
has a `signal' Python module but no `SIGPIPE' (patch by Gabi Davar).

* Added CURLMOPT_PIPELINING_SITE_BL and CURLMOPT_PIPELINING_SERVER_BL
options (libcurl 7.30.0+).

* Added CURLOPT_TCP_KEEPALIVE, CURLOPT_TCP_KEEPIDLE and
CURLOPT_TCP_KEEPINTVL options (libcurl 7.25.0+).

* Added CURLOPT_ACCEPTTIMEOUT_MS (libcurl 7.24.0+).

* Added CURLOPT_ACCEPT_ENCODING and CURLOPT_TRANSFER_ENCODING
options (libcurl 7.21.6+).

* OPENSOCKETFUNCTION callback for AF_UNIX sockets was mistakenly
invoked with the address as a `string' rather than `bytes' on
Python 3. The callback now receives a `bytes' instance as was
documented.

7.21.5

Not secure
---------------------------------------------------------------

* --with-openssl and its --win-ssl alias setup.py options are now
accepted under Windows in order to use OpenSSL's crypto locks
when building against OpenSSL.

* --with-openssl added as an alias for --with-ssl option to setup.py.

* Official Windows builds are now linked against C-Ares and libssh2.

* Official Windows builds are now linked against OpenSSL instead of
WinSSL.

* Official Windows builds are now statically linked against
their dependencies (libcurl and zlib).

* Added CURLOPT_USE_SSL and CURLUSESSL_* constants.

* Added CURLOPT_APPEND, CURLOPT_COOKIESESSION, CURLOPT_DIRLISTONLY,
CURLOPT_KEYPASSWD, CURLOPT_TELNETOPTIONS.

* Several CURLE_* and CURLM_* constants added.

* Add VERSION_* constants, corresponding to CURL_VERSION_*.

* Breaking change: OPENSOCKETFUNCTION callback API now mirrors that
of libcurl:
1. The callback now takes two arguments, `purpose' and `address`.
Previously the callback took `family', `socktype', `protocol`
and `addr' arguments.
2. The second argument to the callback, `address', is a
`namedtuple' with `family', `socktype', `protocol' and
`addr' fields.
3. `addr' field on `address' for AF_INET6 family addresses is a
4-tuple of (address, port, flow info, scope id) which matches
Python's `socket.getaddrinfo' API.

It seems that libcurl may mishandle error return from an
opensocket callback, as would happen when code written for
pre-PycURL 7.21.5 API is run with PycURL 7.21.5 or newer,
resulting in the application hanging.

* OPENSOCKETFUNCTION callback can now be unset.

* Added CURLOPT_CLOSESOCKETFUNCTION (libcurl 7.21.7+).
CURLOPT_CLOSESOCKETDATA is used internally by PycURL.

* Added CURLOPT_SOCKOPTFUNCTION. CURLOPT_SOCKOPTDATA is used
internally by PycURL.

* Added CURLOPT_SSH_KEYFUNCTION (libcurl 7.19.6+).
CURLOPT_SSH_KEYDATA is used internally by PycURL.

* Added CURLOPT_SSL_OPTIONS (libcurl 7.25.0+).

* Added CURLOPT_KRBLEVEL.

* Added CURLOPT_SSL_FALSESTART (libcurl 7.42.0+).

* Added CURLOPT_SSL_ENABLE_NPN (libcurl 7.36.0+).

* Added CURLOPT_SSL_ENABLE_ALPN (libcurl 7.36.0+).

* Added CURLOPT_UNIX_SOCKET_PATH (libcurl 7.40.0+).

* Added CURLOPT_WILDCARDMATCH (libcurl 7.21.0+).

* C module initialization changed to raise exceptions on failure
rather than trigger a fatal error and abort the Python interpreter.

* Added CURLOPT_PINNEDPUBLICKEY (libcurl 7.39.0-7.44.0+
depending on SSL backend and encoding algorithm).

* Fixed incorrect detection of libcurl 7.19.5 and 7.19.6
(thanks to bataniya).

7.19.5.3

Not secure
-----------------------------------------------------------------

* python and nosetests binaries can now be overridden when running
the test suite (patch by Kamil Dudka).

* Files needed to run the test suite are distributed in sdist
(patch by Kamil Dudka).

Page 3 of 13

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.