What are the changes for 8.23.1?

[GabenGar]

They aren't in the changelog.

[g4lb]

22 commits, mostly fixes: https://github.com/brianc/node-postgres/compare/pg@8.23.0...pg@8.23.1

The main one: TLS now checks the server certificate also when you connect to an IP address (#3756).

[GabenGar]

Why are these not in changelog? After all vulnerabilities involving highjacking build pipeline I am very allergic when version increments are not followed by any sort of changelog, especially when there is a version mismatch between the repo and the published package. At least a changelog somewhat acts as a proof it's not just malware incrementing the version.

[charmander]

At least a changelog somewhat acts as a proof it's not just malware incrementing the version.

I know you already said “somewhat”, but for emphasis – not really! The permissions required to create a tag (which was created) are the same as those required to create a changelog entry. Best practice is to review the code diff in the npm package.

As for the why, from CHANGELOG.md:

We do not include break-fix version release in this file.