Pending RELEASE-NOTES for the upcoming release

This is work in progress and seeing changes before the release goes public on 2026-09-02.

Changes:

Bugfixes:

• autotools: minor fixes and improvements
• build: enable thread-safe `getaddrinfo()` for OpenBSD, and other tidy-ups
• cmake: dedupe expressions into local vars in `cmake_uninstall.in.cmake`
• cmake: fix not to build `tunits` when `BUILD_CURL_EXE=OFF`
• cmake: flatten build tree, tidy up base dir variables
• cmake: replace deprecated `remove` command with `rm` and pass arg safely
• cmake: robustify base path in local file reference
• cmake: stop probing unused `float.h` for `STDC_HEADERS`
• conncache: connection alive checks intervals
• curl-functions.m4: verify working RFC 4291 zero prefixed IPv4 - mapped format
• gopher: reject CR and LF in the selector
• http: trim custom header name before the Authorization drop
• INSTALL.md: add building-from-source overview section
• ldap: support insecure mode for Windows native LDAP
• lib1587: fix gcc `-Wconversion` with LibreSSL on Windows, test in CI
• mqtt: reject control bytes in the topic
• multi: forbid curl_easy_pause from within multi socket callback
• openssl: drop unused pre-OpenSSL3 `ctx_option_t` typedef
• runtests: restore `-k` option and actively process as no-op
• scripts: use end-of-options marker in `cd`, `mkdir`, `mv`, `sha256sum` commands
• sws: allow connection-monitor to log all disconnects
• test 1560: test RFC4291 style IPv6 IPv4-mapped addresses
• tool: do not flush on out-null
• tool: init progress bar on demand
• tool_operate: remove call to abort()
• urlapi: do not keep an internal port string
• VULN-DISCLOSURE-POLICY.md: issues that should be found by tests are LOW

Contributors:

Alhuda Khan, alhudz, Dan Fandrich, Daniel Stenberg, Ray Satiro, renovate[bot], Roger Leigh, Sam James, Samuel Dainard, Stefan Eissing, stze on hackerone, Viktor Szakats