From: Bob Halley <halley@dnspython.org>
Date: Tue, 25 Jul 2023 14:05:56 +0000 (-0700)
Subject: prepare 2.4.1 whatsnew
X-Git-Tag: v2.5.0rc1~60
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e039ee635eb00da32a89ff4068a95f8ee41def3f;p=thirdparty%2Fdnspython.git

prepare 2.4.1 whatsnew
---

diff --git a/doc/whatsnew.rst b/doc/whatsnew.rst
index c0f1196b..9857c819 100644
--- a/doc/whatsnew.rst
+++ b/doc/whatsnew.rst
@@ -8,6 +8,27 @@ What's New in dnspython
 
 * TBD
 
+2.4.1
+-----
+
+* Importing dns.dnssecalgs without the cryptography module installed no longer causes
+  an ImportError.
+
+* A number of timeout bugs with the asyncio backend have been fixed.
+
+* DNS-over-QUIC for the asyncio backend now works for IPv6.
+
+* Dnspython now enforces that the candidate DNSKEYs for DNSSEC signatures
+  have protocol 3 and have the ZONE flag set.  This is a standards compliance issue more
+  than a security issue as the legitimate authority would have to have published
+  the non-compliant keys as well as updated their DS record in order for the records
+  to validate (the DS digest includes both flags and protocol).  Dnspython will not
+  make invalid keys by default, but does allow them to be created and used
+  for testing purposes.
+
+* Dependency specifications for optional features in the package metadata have been
+  improved.
+
 2.4.0
 -----