## Added
- Serial number generator (#1270)
- `DecodeValue` for `x509_cert::time::Time` (#1986)
- `FromStr` for `x509_cert::time::Time` (#1961)
- impl `Hash` for `Name` (#1764)
- impl `Ord` for `CrlReason` (#1869)
- `DirectoryString::BmpString` (#1794)
- `Crl` builder (#1759)
- `Time::now` method (#1761)
- `Validity::infinity` helper (#1528)
- `Validity::new` method (#1529)
- Re-export `spki` types without `*Owned` suffixes (#1534)
- `x509_cert::builder::AsyncBuilder` using `AsyncSigner` (#1280)

## Changed
- Decompose `AsExtension` into `Criticality + AsExtension` (#2109)
- Improve extension API flexibility and ergonomics (#2120)
- Expose `Profile` in the `CrlBuilder` (#1870)
- Ensure a serial number can be stored in a database (#1868)
- Move the CSR builder `x509_cert::request` (#1581)
- Rename `x509_cert::builder::Profile` to `BuilderProfile` (#1514, #1517)
- `Name` is now a new type over `RdnSequence` (#1499)
- make `RelativeDistinguishedName` fields private (#1510)
- make `RdnSequence` fields private (#1508)
- make (Tbs)`CertificateInner` fields private (#1505)
- rename helpers to `get_extension`/`filter_extensions` (#1497)
- `check_name_encoding` now allow extraneous components (#1447)
- Accept RFC-invalid certificates as TrustAnchors (#1403)
- Edition changed to 2024 and MSRV bumped to 1.85 (#1689)
- Bump `rand` to `v0.10` (#2212)
- Bump `der` to `v0.8` (#2234)
- Bump `digest` to `v0.11` (#2237)
- Bump `sha2` to `v0.11` (#2273)
- Bump `spki` to `v0.8` (#2277)
- Bump `signature` to `v3` (#2326)

## Fixed
- Converting from `SystemTime` should use `UtcTime` if date <= 2049 (#1969)
- Underflow on empty input in `Certificate::load_pem_chain` (#1965)
- Domain validated should accept CNs (#1815)
- Serialization of email addresses (#1425)

## Removed
- `std` requirement for `x509_cert::builder` (#1709)
- `RelativeDistinguishedName::encode_from_string` (#1509)

Co-authored-by: Tony Arcieri <bascule@gmail.com>