Release notes and version bump for 6.5.6.

diff --git a/docs/releases.rst b/docs/releases.rst
index da95c9917de4a4facf7079c334cba02ab929f440..198fa3d114238064c77c5f3bb87e5ecc46a2657b 100644 (file)
--- a/docs/releases.rst
+++ b/docs/releases.rst
@@ -4,6 +4,7 @@ Release notes
 .. toctree::
    :maxdepth: 2
 
+   releases/v6.5.6
    releases/v6.5.5
    releases/v6.5.4
    releases/v6.5.3

diff --git a/docs/releases/v6.5.6.rst b/docs/releases/v6.5.6.rst
new file mode 100644 (file)
index 0000000..ac100d3
--- /dev/null
+++ b/docs/releases/v6.5.6.rst
@@ -0,0 +1,30 @@
+What's new in Tornado 6.5.6
+===========================
+
+May 27, 2026
+------------
+
+Security fixes
+~~~~~~~~~~~~~~
+
+- ``SimpleAsyncHTTPClient`` now strips the ``Authorization`` and ``Cookie`` headers from the request
+  when following a redirect to a different origin. This matches the default behavior of
+  ``CurlAsyncHTTPClient``. Applications that need different behavior here can set
+  ``follow_redirects=False`` and handle redirects manually. Thanks to [Yannick
+  Wang](https://github.com/noobone123) for being first to report this issue, as well as additional
+  reporters [Kai Aizen](https://github.com/SnailSploit), [HunSec](https://github.com/0xHunSec), and
+  [Thai Son Dinh](https://github.com/sondt99).
+- ``SimpleAsyncHTTPClient`` now enforces ``max_body_size`` on the decompressed size of the response,
+  rather than the compressed size. This prevents a denial-of-service attack via a very large
+  compressed response. Thanks to [Yuichiro Kedashiro](https://github.com/yuui25) for reporting this
+  issue.
+- Fixed a bug in the C extension that could have read up to three bytes past the end of an input
+  array. Thanks to [Thai Son Dinh](https://github.com/sondt99) for reporting this issue.
+- ``OpenIDMixin`` has improved parsing for the ``check_authentication`` response. Thanks to
+  [Yannick Wang](https://github.com/noobone123) for reporting this issue.
+
+Bug fixes
+~~~~~~~~~
+
+- ``CurlAsyncHTTPClient`` has been updated to use non-deprecated APIs, avoiding deprecation
+  warnings with recent versions of ``pycurl``.