@seph Thanks for the changelog work! About the rebase merge: I've been a user of rebase merge a few times (we also have a label for that), it was a conscious choice. Squash is good if you can keep the work medium size to small size and "one" commit, but that's not always possible. Sometimes the work that you have to do is big and there's no way around it. So you split it in multiple commits that have to go all together in the same PR, otherwise reviewing them separately makes no sense. They should also stay separate after, because when you are looking at them after, you really want them to be separated to not look at one giant diff. It also helps with bisecting. I understand the automation problem, but maybe we could then just emulate what the squash merge does to mention PRs? About categorization: I would say that that can be either categorized as a change for a possible security issue or hardening, not a bug. If we had no other category, everything fits with "bug fix", because a bug is something that's not working as expected. But that's a bit too generic. There's nothing broken there, it's a openssl feature that fits correctly with everything else, we simply deemed it insecure, as other software did in the past.