From 8de392ac50714d4b2144ba735da61af3eab13c8e Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 09:26:11 +0000 Subject: [PATCH] docs(changelog): backfill 6.22.0 release commit short-SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Appends `aa5ba5b` to the [6.22.0] heading, matching every other shipped version header. Lands after the post-release reset of develop to main — a backfill pushed before that sync is silently discarded, which is the order #1004 followed after 6.20.1. The tag pushed at release time never carries its own suffix; main acquires it one release later, when this commit rides the next release PR. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01D1wR59A8Z7d3QGYnm8q2KQ --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 13eca99e..a8918455 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ The format follows [Keep a Changelog] (https://keepachangelog.com/en/1.1.0/). ## [Unreleased] -## [6.22.0] (2026-09-04) +## [6.22.0] (2026-09-04) — `aa5ba5b` ### Deprecated - ⚠ **`check_verification()`'s `$token` argument** (#1048): `RateLimiter::check_verification()` and `RateLimitChecker::check_verification()` accept a token they have never read — verification throttling is keyed on the IP alone (10/hour, 30/day). No caller passes it. It will be **removed in 6.24.0**; call with `$ip` only. A per-token limit is not needed: the 12-character `[A-Z0-9]` auth code (~62 bits, globally unique) makes the distributed brute-force it would defend against unviable.