Add CHANGES and release note for [GL !2946]

diff --git a/CHANGES b/CHANGES
index 07c9cf3b082a9e20734e550e44e8ee29488cf4b6..8225feacac9f33b7bdac68d7f6458d710575247e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5697.  [protocol]      SHA-1 CDS records are no longer used by dnssec-cds to
+                       make DS records. Thanks to Tony Finch. [GL !2946]
+
 5696.  [protocol]      Add support for HTTPS and SVCB record types. [GL #1132]
 
 5695.  [func]          Dig can now display the BADCOOKIE message as part of
@@ -1452,7 +1455,7 @@
 5349.  [bug]           Fix a race in task_pause/unpause. [GL #1571]
 
 5348.  [bug]           dnssec-settime -Psync was not being honoured.
-                       [GL !2893]
+                       Thanks to Tony Finch. [GL !2893]
 
        --- 9.15.8 released ---
 

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index a83a17c5ea0f6ba5eaec22ea2820f19ef7a1cc5a..61dec801658a92118bfd0901427a7828682c2377 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -39,6 +39,9 @@ Feature Changes
   key. This allows for a gradual replacement of RRSIGs as they reach expiry.
   :gl:`#1551`
 
+- SHA-1 CDS records are no longer used by ``dnssec-cds`` to make DS
+  records. Thanks to Tony Finch. :gl:`!2946`
+
 Bug Fixes
 ~~~~~~~~~