http: free protocol-specific struct in setup_connection callback (#1836773)

fix heap buffer overflow in function tftp_receive_packet() (CVE-2019-5482)

allow curl to POST from a char device (#1769307)

fix auth failure with duplicated WWW-Authenticate header (#1754736)

fix TFTP receive buffer overflow (CVE-2019-5436)

make `curl --tlsv1` backward compatible (#1672639)

backport the --tls-max option of curl and TLS 1.3 ciphers (#1672639)

prevent curl --rate-limit from hanging on file URLs (#1281969)
fix NTLM password overflow via integer overflow (CVE-2018-14618)
fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
backport options to force TLS 1.3 in curl and libcurl (#1672639)
prevent curl --rate-limit from crashing on https URLs (#1683292)

require a new enough version of nss-pem to avoid regression in yum (#1610998)

remove dead code, detected by Coverity Analysis
remove unused variable, detected by GCC and Clang

make curl --speed-limit work with TFTP (#1584750)

fix RTSP bad headers buffer over-read (CVE-2018-1000301)
fix FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
fix LDAP NULL pointer dereference (CVE-2018-1000121)
fix RTSP RTP buffer over-read (CVE-2018-1000122)
http: prevent custom Authorization headers in redirects (CVE-2018-1000007)
doc: --tlsauthtype works only if built with TLS-SRP support (#1542256)
update certificates in the test-suite because they expire soon (#1572723)

make NSS deallocate PKCS #11 objects early enough (#1510247)

reset authentication state when HTTP transfer is done (#1511523)

fix buffer overflow while processing IMAP FETCH response (CVE-2017-1000257)

drop 0109-curl-7.29.0-crl-valgrind.patch no longer needed (#1427883)