0.26.5

• rpc: guard against overflow when decoding nested attributes (CVE-2026-18938) [PR#777]

0.26.4

• Build fix [PR#773]
• Update translations [PR#743, PR#772]

0.26.3

• server: fixed stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit (CVE-2026-13757) [PR#768]
• fixed confusing error message when trying to store an existing cert with trust anchor [PR#770]
• fixed assert when parsing p11-kit files with value (") [PR#762]
• fixed numerous memory management issues [PR#751, PR#753, PR#754, PR#756, PR#758, PR#763, PR#764, PR#765, PR#766, PR#769]
• Build and test fixes [PR#746, PR#747, PR#752, PR#755, PR#757, PR#760, PR#761]

0.26.2

• rpc: fix NULL dereference via C_DeriveKey with specific NULL parameters (CVE-2026-2100) [PR#740]

0.26.1

• trust: Ensure compatibility of CKA_NSS_TRUST and CKA_TRUST [PR#738]

0.26.0

• pkcs11: Update PKCS11 headers to version 3.2 [PR#731]
• trust: Lookup DNs in reverse order (RFC4514 section 2.1) [PR#732]
• Update translations [PR#734]

0.25.10

• create a new release to fix issues caused by the 0.25.9 reroll
• ci fixes [PR#722, PR#723]

0.25.9

• subprojects/pkcs11-json: Update git submodule [PR#719]

0.25.8

• rpc: Unbreak protocol compatibility by reverting "rpc: Correctly map Mozilla certificate distrust attributes" [#716]

0.25.7

• Build fixes from tarball with Meson [#714]