when keyboard-interactive auth fails, try password (#2229800)
cap SFTP packet size sent (RHEL-5311)
unify the upload/method handling (CVE-2023-28322)
fix cookie injection with none file (CVE-2023-38546)
fix HTTP2 connection failure with HTTP2 framing layer (RHEL-5657)
lowercase the domain names before PSL checks (CVE-2023-46218)

fix host name wildcard checking (CVE-2023-28321)
rebuild certs with 2048-bit RSA keys

sftp: do not specify O_APPEND when not in append mode (#2187717)

fix GSS delegation too eager connection re-use (CVE-2023-27536)
fix FTP too eager connection reuse (CVE-2023-27535)

fix HTTP multi-header compression denial of service (CVE-2023-23916)

h2: lower initial window size to 32 MiB (#2166254)

smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552)

upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1 (#2139337)

control code in cookie denial of service (CVE-2022-35252)

setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703)
fix HTTP compression denial of service (CVE-2022-32206)
fix FTP-KRB bad message verification (CVE-2022-32208)

fix too eager reuse of TLS and SSH connections (CVE-2022-27782)
fix invalid type in printf() argument detected by Coverity

fix credential leak on redirect (CVE-2022-27774)
fix auth/cookie leak on redirect (CVE-2022-27776)
fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)

fix STARTTLS protocol injection via MITM (CVE-2021-22947)
fix protocol downgrade required TLS bypass (CVE-2021-22946)

fix TELNET stack contents disclosure again (CVE-2021-22925)
fix TELNET stack contents disclosure (CVE-2021-22898)
fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
disable metalink support to fix the following vulnerabilities
2021-22923 - metalink download sends credentials
2021-22922 - wrong content via metalink not discarded

fix a cppcheck's false positive in 0029-curl-7.61.1-CVE-2021-22876.patch

make `curl --head file://` work as expected (#1947493)
prevent automatic referer from leaking credentials (CVE-2021-22876)