2026-10-13  Simon Josefsson  <simon@josefsson.org>

	version 2.6.15
	* NEWS: Record release date.

	doc: Add CVE-2026-109117 advisory to website

	libpskc: Restrict to X509Data KeyValue to fix verify bypass
	CVE-2026-109117

	ci: Add xmlsec1 dependency, Debian13/Devuan6 jobs and confirm tst_bypass_sign

	tests: Add libpskc verify bypass regression check

2026-10-12  Simon Josefsson  <simon@josefsson.org>

	ci: Bump GNULIB_REVISION

2026-10-11  Simon Josefsson  <simon@josefsson.org>

	Don't -Werror out on -Wuseless-cast warning
	Better ideas on how to portably printf a size_t welcome.

	tst_totp_validate.c:179:19: error: useless cast to type 'long unsigned int' [-Werror=useless-cast]
	  179 |                   (unsigned long) i, otp_pos, tv[i].otp_pos);
	      |                   ^

2026-10-11  Simon Josefsson  <simon@josefsson.org>

	Fix pskctool --help output baseline

	ci: Bump GNULIB_REVISION

	ci: Add Ubuntu24.04/Trisquel12 and Ubuntu26.04 jobs

	ci: Fix debian11 jobs

2026-06-29  Simon Josefsson  <simon@josefsson.org>

	oathtool: Reject further nonsense parameter combinations

	doc: Improve NEWS entry for --hotp --totp fix

	oathtool: Add --hex which correspond to the long-time default behaviour
	Closes: #117

	ci: Fix macOS jobs, bumping image names

	ci: Fix B-clang job
	The -std=c23 flag seems to imply no POSIX for glibc, used to work
	when the silkeh/clang:latest image was based on bookworm but it
	was recently upgraded to trixie.

	oathtool: Improve command-line parse handling to reject invalid requests
	Closes: #116

2026-01-27  Simon Josefsson  <simon@josefsson.org>

	maint: Improve release process

	maint: post-release administrivia
	* NEWS: Add header line for next release.
	* .prev-version: Record previous version.
	* cfg.mk (old_NEWS_hash): Auto-update.

	version 2.6.14
	* NEWS: Record release date.


See the source repo for older entries
