0.23.22 (stable)

• Fix memory-safety issues that affect the RPC protocol
  (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered
  and fixed by David Cook
• anchor: Prefer persistent format when storing anchor [PR#329]
• common: Fix infloop in p11_path_build [PR#326, PR#327]
• proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325]
• common: Check for a NULL locale before freeing it [PR#321]
• Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339]

0.23.21 (stable)

• proxy: Do not assign duplicate slot IDs [PR#282]
• common: Get program name based on executable path if possible [PR#307]
• anchor: Exit with non-zero code, if any error occurs [PR#304]
• Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311]

0.23.20 (stable)

• Revert "Fix RPC when length-s are 0" changes [PR#276]

0.23.19 (stable)

• common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255]
• Add simple bash completion for provided commands [PR#258]
• Unbreak list matching in enable-in and disable-in [PR#262]
• Fix RPC when length-s are 0 [PR#259]
• rpc: Add vsock transport support [PR#270]
• trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265]
• Build fixes [PR#271, PR#272, PR#273, ...]

autotools: Add more files from meson build in distribution

0.23.18 (stable)

• rpc: Allow empty CK_DATE value [PR#253]
• build: Meson fixes [PR#245]
• build: Adjust feature parity between meson and autotools [PR#247]

0.23.17 (stable)

• common: Fix uClibc-ng compilation [PR#237]
• trust: do not allow daylight to invalidate date validation [PR#236]
• build: Port to meson build system [PR#231, PR#234]
• rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232]
• doc: Add 'server' command in help [PR#229]
• Build and test fixes [PR#230]

tests: Avoid uninitialized value in test-proxy.c

0.23.16 (stable)

• proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225]
• conf: Ignore user configuration if the program is running as root [PR#226]
• proxy: Refresh slot list on every C_GetSlotList call [PR#224]
• modules: Fix index used in call to p11_dict_remove() [PR#219]
• Fix Win32 p11_dl_error crash [PR#218]
• modules: check gl.modules before iterates on it when freeing [PR#217]
• trust: Ignore unreadable content in anchors [PR#215]
• extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213]

0.23.15 (stable)

• trust: Improve error handling if backed trust file is corrupted [PR#206]
• url: Prefer upper-case letters in hex characters when encoding [PR#193]
• trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202]
• virtual: Prefer fixed closures to libffi closures [PR#196]
• Fix issues spotted by coverity and cppcheck [PR#194, PR#204]
• Build and test fixes [PR#164, PR#191, PR#199, PR#201]

0.23.14 (stable)

• proxy: Avoid invalid memory access when unloading proxy module [PR#180]
• Update pkcs11 header to allow SoftHSMv2 to compile [PR#181]
• build: Restore libpthread dependency [PR#183]
• Build fixes [PR#188]

0.23.13 (stable)

• server: Enable socket activation through systemd [PR#173]
• rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174]
• proxy: Fail early if there is no slot mapping [PR#175]
• Remove hard dependency on libpthread on glibc systems [PR#177]
• Build fixes [PR#170, PR#176]

0.23.12 (stable)

• Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160]
• Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167]
• Build and test fixes on macOS [PR#162, PR#168]

0.23.11 (stable)

• trust: Add extractor for edk2/cacerts.bin [PR#139]
• modules: Add option to control module visibility from proxy [PR#140]
• trust: Prevent trust module being loaded by proxy module [PR#142]
• library: Use dedicated locale object for printing error [PR#148]
• Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134]
• Improve const correctness for P11KitUri [PR#152]
• PKCS#11 URI scheme comparison is now case insensitive [PR#156]
• Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135]

0.23.10 (devel)

• filter: Respect "write-protected" vendor-specific attribute in
  PKCS#11 URI [PR#129]
• server: Improve shell integration and documentation [PR#107, PR#108]
• proxy: Reuse existing slot ID mapping in after fork() [PR#120]
• trust: Forcibly mark "Default Trust" read-only [PR#123]
• New function p11_kit_override_system_files() which can be used for
  testing [PR#110]
• trust: Filter out duplicate extensions [PR#69]
• Update translations [PR#128]
• Bug fixes [PR#125, PR#126]

0.23.9 (devel)

• Fix p11-kit server regressions [PR#103, PR#104]
• trust: Respect anyExtendedKeyUsage in CA certificates [PR#99]
• Build fixes related to reallocarray [PR#96, PR#98, PR#100]

0.23.8 (devel)

• Improve vendor query attributes handling in PKCS#11 URI [PR#92]
• Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91]
• New envvar P11_KIT_NO_USER_CONFIG to stop looking at user
  configurations [PR#87]
• Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86]

0.23.6 (devel)

• Port "p11-kit server" to Windows and portability fixes of the RPC
  protocol [PR#67, PR#72, PR#74]
• Recover the old behavior of "trust anchor --remove" [PR#70, PR#71]
• Build fixes [PR#63 ...]

0.23.5 (devel)

• Fix license notice of common/unix-peer.c [PR#58]
• Remove systemd unit files for now [PR#60]
• Build fixes for FreeBSD [PR#56]