@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/KarpelesLab/httpsd/compare/v0.1.1...v0.2.0) - 2026-07-05
+
+### Fixed
+
+- *(h3)* enforce max field-section size and harden frame-length cast
+- *(quic)* anchor loss-recovery timers to connection construction
+
+### Other
+
+- expose max_conns_per_ip (F6)
+- thread the per-IP limiter through the TCP runtimes (F6)
+- add per-IP concurrent-connection limiter (F6)
+- close TOCTOU/symlink-escape with race-free confined open
+- silence dead_code for still_root_after_drop on non-unix
+- harden connection engine against five HTTP/2 DoS findings
+- add MIN_PROGRESS slow-trickle floor to serve loop
+- fix accept-backoff loop freeze and EINTR shutdown
+- verify gid drop and fail when still root [MED]
+- route on percent-decoded path, reject encoded separators [HIGH]
+- require https:// for the ACME directory URL
+- authoritative host validation at ACME entry points
+- create key temp file with O_EXCL + target mode (no world-readable race)
+- fix percent-decode trailing triplet, canonicalize root once, 404 on symlink escape
+- fix three request-parsing security findings
+- Stop tracking .claude/ (accidentally committed Claude memory)
+- add a default host for SNI-less connections
+- parse the leaf cert for expiry, not the whole chain
+
 ## [0.1.1](https://github.com/KarpelesLab/httpsd/compare/v0.1.0...v0.1.1) - 2026-06-30
 
 ### Fixed
 
@@ -1,6 +1,6 @@
 [package]
 name = "httpsd"
-version = "0.1.1"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.88"
 description = "A pure-Rust HTTP/HTTPS server — usable as a sans-I/O library with pluggable runtimes (thread pool, tokio, mio) or as a CLI that serves a directory or a TOML config."