v0.28.3: update changelog for security release

1 files changed, 15 insertions, 0 deletions

diff --git a/docs/changelog.md b/docs/changelog.md
index d6ad2a9ce..6166f5cac 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,18 @@
+v0.28.3
+-------
+
+This is a security release fixing the following issues:
+
+* A carefully constructed commit object with a very large number
+  of parents may lead to potential out-of-bounds writes or
+  potential denial of service.
+
+* The ProgramData configuration file is always read for compatibility
+  with Git for Windows and Portable Git installations.  The ProgramData
+  location is not necessarily writable only by administrators, so we
+  now ensure that the configuration file is owned by the administrator
+  or the current user.
+
 v0.28.2
 -------