sgcIndy release notes

Every public release of sgcIndy, newest first. Each version lists what was added, what was fixed and anything that changes behaviour, exactly as it is written in the history file that ships with the product.

sgcIndy product page · Download

sgcIndy 2026.10.0 Latest

  • 2026.10.0: 2026 October
  • FixedFixed a TLS connection that fails during the handshake being reported as "Socket Error #0" instead of an OpenSSL error. When the server accepts the TCP connection but does not speak TLS, or its certificate is rejected, the exception again contains the text "Error connecting with SSL" followed by the reason reported by OpenSSL, as it did up to version 2025.6.

sgcIndy 2026.9.0

  • 2026.9.0: 2026 September
  • FixedFixed Bug Setup Community: the precompiled Delphi 13 binaries were produced from the Delphi 12 projects, so they were named IndyCore290, IndySystem290 and IndyProtocols290 instead of the 370 names the Delphi 13 installer expects, and the Windows ARM64EC platform was not built at all because the Delphi 12 projects do not define it. Delphi 13 now builds its own 370 projects for every supported platform.
  • FixedFixed the protocol name agreed through ALPN being written with four bytes into the single byte OpenSSL keeps for its length, so every handshake that negotiated a protocol overwrote the memory next to it. A name longer than 255 characters cannot be represented in that single byte and is now refused instead of being written with a wrong length.
  • FixedFixed a TLS server using the IOCP or EPOLL engine using all the CPU of one thread when the other side asked to renegotiate the connection. The server retried the write again and again instead of sending what OpenSSL had already prepared, so that connection could never continue and the thread stayed busy until the server was stopped.
  • FixedFixed a TLS application on Linux being closed by the operating system when the other side reset the connection while data was being written. OpenSSL writes to the socket in a way that cannot ask the system to suppress the broken pipe signal, and nothing else suppressed it, so the whole application ended instead of the write simply failing. An application that already handles that signal itself keeps its own handling.
  • FixedFixed the same broken pipe problem under FPC and Lazarus, where writing to a connection whose other side had already closed ended the application. On macOS the protection was only applied to connections opened by a client, so connections accepted by a server were still exposed.

sgcIndy 2026.8.0

  • 2026.8.0: 2026 August
  • NewNew TIdSocketHandle.SetReceiveTimeout method, the counterpart of SetSendTimeout, so a connection that goes silent fails cleanly instead of freezing the thread that was reading.
  • FixedFixed a misleading error when a TLS connection failed, for example "error:00000006:lib(0):func(0):EVP lib". The real reason reported by OpenSSL was thrown away before the exception was raised, so the text shown had nothing to do with the real problem. The exception now shows the error reported by OpenSSL.
  • FixedFixed a problem when the certificate file contained the certificate and the private key together. An error was left pending inside OpenSSL and could affect a later call. Real errors while reading the certificate chain were ignored too. Both cases are now handled properly.
  • FixedThe OpenSSL options to disable old TLS versions, disable compression, disable renegotiation and prefer the server cipher order were ignored when the library loaded was OpenSSL 1.1 or later. They are now applied.
  • FixedImproved the error when a PKCS#12 certificate (.p12 or .pfx) cannot be read because it uses an old algorithm such as RC2 40-bit. OpenSSL 3 moved those algorithms to the legacy provider, and the message now explains how to enable it.
  • FixedFixed the error reported when a PKCS#12 private key fails to load, it named the certificate function instead of the private key function.
  • FixedFixed a TLS connection writing past the end of its read buffer when the other side sent several encrypted records together in the same packet, which could overwrite the memory next to the buffer and crash the application. The buffer was told it had more free space than it really had. The data read during the handshake was cut short in a similar way, and the protocol name agreed through ALPN was read past its end because it does not arrive as text ending in a zero byte.
  • FixedFixed the limit on the number of response headers in the HTTP client never being applied, so a server could send an endless stream of headers until the client ran out of memory. Setting MaxHeaderLines to 0, which means no limit, had the opposite effect and threw away every response header, including Content-Length and Location.
  • FixedFixed an NTLM authentication challenge shorter than expected being read past its end, so the value used to answer it could be taken from unrelated memory and the client could crash. The challenge is now checked before it is used, including its signature and its message type.
  • FixedNTLM authentication now reports clearly that it cannot run, instead of sending an empty answer that no server can accept. The routines that calculate the NTLM response are not available unless SGC_NATIVE_CRYPTO is enabled in the project, and until now the client sent an empty response and the server answered 401 again, which looked like a wrong user name or password. On Windows nothing changes, NTLM is handled by the operating system through SSPI.
  • FixedFixed a SOCKS5 UDP reply larger than the buffer of the caller being copied past the end of that buffer, and a reply that was truncated or that declared an address type the client does not know being read past its end.
  • FixedFixed several problems talking to a SOCKS5 proxy when the address is a host name instead of an IP address. The reply from the proxy was read one byte short, so the first byte of the answer reached the application as if it were data, and the port was taken from the wrong position. In the reply to a UDP request, an IPv6 address had two of its bytes read as the port. Connecting through the proxy to a host name longer than 248 characters also wrote past the end of the buffer used to build the request.
  • FixedImproved the error reported when the OpenSSL legacy provider cannot be loaded, it now names the provider module that could not be loaded and the directory where it was searched.

sgcIndy 2026.7.0

  • 2026.7.0: 2026 July
  • FixedFixed minor bugs.

sgcIndy 2026.6.0

  • 2026.6.0: 2026 June
  • NewNew opt-in TLS server hardening properties on TIdSSLOptions: StrictVerify (peer certificate verification now enforces the OpenSSL result, so a verify callback can only further restrict it, never accept an untrusted certificate), DisableCompression (mitigates CRIME), DisableRenegotiation (mitigates client-initiated renegotiation DoS) and ServerCipherPreference (the server cipher order wins). All default to the previous behaviour.
  • NewNew TIdIOHandler.MaxInputBufferSize property: caps the cumulative input buffer to mitigate memory exhaustion from oversized lines or attacker-controlled length-prefixed reads (0 = unlimited, the default).
  • NewNew TIdIOHandler.SetReadDeadline method: an opt-in total read deadline that complements the inactivity ReadTimeout to defeat Slowloris attacks that drip bytes slowly to keep resetting an inactivity timeout.
  • NewNew TIdSocketHandle.SetSendTimeout method: sets the socket send timeout (SO_SNDTIMEO) correctly on both Windows and POSIX. On POSIX the timeout is passed as a timeval instead of a millisecond integer, so a write to a slow-reading client is now bounded on Linux too, not only on Windows.
  • NewNew opt-in HTTP request hardening properties on TIdCustomHTTPServer: MaxRequestBodySize (caps the Content-Length and chunked body, replies 413), MaxHeaderTotalSize (caps total header bytes, replies 431), RequestReadTimeout (bounds the time to receive the request line and headers, Slowloris) and StrictRequestParsing (rejects ambiguous Content-Length plus Transfer-Encoding request smuggling and negative chunk sizes, replies 400). All default to the previous behaviour.
  • NewNew functions for ML-KEM-768 post-quantum encapsulation/decapsulation (OpenSSL 3.5+).
  • FixedFixed Bug TIdSSLIOHandlerSocketOpenSSL: the peer-verification callback could fail open and accept an untrusted certificate even when verification was requested. Enable the new TIdSSLOptions.StrictVerify option to enforce the OpenSSL verification result.
  • FixedFixed Bug TIdCustomHTTPServer: the chunked transfer-encoding trailer-header loop was unbounded, allowing a memory and CPU exhaustion DoS. It is now bounded by MaximumHeaderLineCount.
  • FixedFixed Bug Setup: C++Builder package compilation failed with MSBuild error MSB1008 "Only one project can be specified" when the IDE was installed in a path containing spaces (for example "RAD Studio"). The DCC_BpiOutput parameter is now quoted.
  • FixedFixed Bug TIdSSHClient: the Execute method froze the calling thread indefinitely. The background read thread started by Connect competed with Execute for the same socket and consumed the channel open confirmation, so OpenChannel never completed. Execute now takes exclusive control of the connection while it runs and restores the read thread afterwards, and the channel open wait is bounded by ReadTimeout so it can no longer loop forever.
  • FixedFixed Bug TIdSSHClient: the Execute method returned corrupted command output on Delphi 2009 and later. The output bytes were copied into a UnicodeString as raw memory, so each pair of bytes was misread as one wide character. The bytes are now converted one character at a time.

sgcIndy 2026.5.0

  • 2026.5.0: 2026 May
  • FixedFixed Bug TIdSSHClient: compile error E2064 "Left side cannot be assigned to" in Connect method when conditional defines SGC_OPENSSL_API_1_1 or SGC_OPENSSL_API_3_0 are active. The OpenSSL API version selection block is now guarded with {$IFNDEF} directives.

sgcIndy 2026.4.0

  • 2026.4.0: 2026 April
  • NewAdded Support for Rad Studio 13.1: the new platform WinARM64EC is supported.
  • NewNew Component TIdSSHClient, SSH 2.0 client with support for Curve25519, ECDH, Diffie-Hellman key exchange, Ed25519/ECDSA/RSA host keys, AES-256/192/128-CTR ciphers, and HMAC-SHA2-256/512 MACs.
  • NewNew Component TIdSFTPClient, SFTP client over SSH with support for file upload, download, delete, rename, directory listing, and file attributes.
  • NewNew Demo SFTPClient, GUI application showing how to connect, list directories, upload and download files using the TIdSFTPClient component.
  • NewNew Demo SSHClient, GUI application showing how to connect and execute commands using the TIdSSHClient component.
  • FixedFixed Bug sgcIndy: pointer truncation in TIdWorkOpUnitWriteBuffer on Win64. (Thanks to Gabriel for the fix).

sgcIndy 2026.3.0

  • 2026.3.0: 2026 March
  • NewImproved Setup, a new option "Build Rad Studio IDE Win64" allows to install the package for the 64-bit IDE, by default is unchecked.
  • FixedFixed Bug Delphi 12: error while compiling the package because the project was misconfigured.

sgcIndy 2026.2.0

  • 2026.2.0: 2026 February
  • FixedFixed some minor setup bugs.

sgcIndy 2026.1.0

  • 2026.1.0: 2026 January
  • FixedFixed Bug sgcIndy Setup: when installing in Delphi XE4 some packages were not found.
  • FixedFixed Bug Indy Server: access violation when running on Linux64.

sgcIndy 2025.10.0

  • NewImproved Setup: now the uninstaller is digitally signed.
  • FixedFixed Bug sgcIndy: when installing Rad Studio, if the installation path contained any spaces, an error occurred.

sgcIndy 2025.9.0

  • NewUpdated sgcIndy to the latest version.
  • NewImproved sgcIndy Setup: added the parameter "/debug" to get a warning message if there is any error while compiling the Embarcadero package.
  • FixedFixed Bug sgcIndy: Cannot assign a TIdSSLX509Checks to a TIdSSLOptions_Internal.
  • FixedFixed Bug sgcIndy: the cipherlist is now set before loading the certificates to allow to set for example the security level. (Thanks to Preben for the fix)

sgcIndy 2025.8.0

  • NewAdded Support for Rad Studio 13 Florence.
  • NewImproved sgcIndy Setup: the Embarcadero IP Abstraction units are now compiled with the sgcIndy version installed.
  • NewImproved sgcIndy Setup: Added support for CBuilder 64-bits IDE.
  • NewImproved sgcIndy: Setup: Added the Platform "Windows 64-bit Modern" for CBuilder.
  • FixedFixed Bug sgcIndy: when installing community edition and then the registered version, the original indy package was not restored when sgcIndy was uninstalled.
  • FixedFixed Bug sgcIndy: the setup wasn't disabling the package msedge when setting compatibility mode to true.
  • FixedFixed Bug sgcIndy: after uninstalling sgcIndy an rtl.bpl error was raised after closing the IDE.
  • FixedFixed Bug sgcIndy: when multiple editions were installed a Runtime error maybe raised when opening the IDE.
  • FixedFixed Bug sgcIndy: when compiling IdSSLOpenSSLHeaders_static for iOS, error E2009: Incompatible types: "Calling conventions differ".

sgcIndy 2025.7.0

  • NewUpdated the OpenSSL libraries to the version 3.5.1
  • NewImproved sgcIndy: new property TIdSSLIOHandlerSocketOpenSSL.SSLOptions.X509Checks to enable validate HostName and IPAddress in X509 Certificates.
  • FixedFixed some minor bugs.

sgcIndy 2025.6.0

  • NewImproved sgcIndy: new function sgcIdSSLOpenSSL.GetOpenSSLErrors to obtain the list of the latest errors.
  • FixedFixed Bug sgcIndy: function RSA_set0_key, only is required for openssl 1.1+.
  • FixedFixed Bug sgcIndy: decoding UTC DataTime.
  • FixedFixed Bug sgcIndy: if EVP_PKEY_base_id function is not available use the EVP_PKEY_is_a function instead.

sgcIndy 2025.5.0

  • FixedMinor Bugs and fixes.

sgcIndy 2025.4.0

  • FixedMinor Bugs and fixes.

sgcIndy 2025.3.0

  • NewNew Demo showing how to use FTPS and the new openSSL libraries.
  • NewImproved sgcIndy, added two functions: IdOpenSSLSetLoadFuncsCallback and IdOpenSSLSetUnLoadFuncsCallback to load additional openssl functions using the dll already loaded.
  • NewImproved sgcIndy, new demo LoadCustomFunctions which shows how to use the new callback for loading additional openssl functions.
  • FixedFixed Bug IdSSLOpenSSLHeaders, the method X509_STORE_CTX_free was not properly defined.
  • FixedFixed Bug IdSSLOpenSSLHeaders, the method ECDH_compute_key was not properly defined.

sgcIndy 2025.2.0

  • NewImproved Setup, now if detects the IDE is running aborts the installation until it's closed.

sgcIndy 2025.1.0

  • FixedFixed Bug OpenSSL when setting Version TLS 1.3 and MinVersion TLS 1.2, only TLS 1.2 was available.

Get the current release

Every licence includes a year of updates, and the trial is the full product.

sgcIndy All release notes