Commit cb1645e83b for openssl.org

commit cb1645e83bd99b775092552f5ca39b4617f49603
Author: Bob Beck <beck@openssl.org>
Date:   Wed Feb 18 18:17:39 2026 -0700

    Add a changes entry

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    MergeDate: Tue Feb 24 14:04:47 2026
    (Merged from https://github.com/openssl/openssl/pull/29612)

diff --git a/CHANGES.md b/CHANGES.md
index 7d1ec71221..4a9c0642c8 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -519,6 +519,13 @@ OpenSSL 3.6

    *Dimitri John Ledkov*

+ * SSL_add1_host and SSL_set1_host were deprecated. The new replacement functions
+   SSL_add1_dnsname, SSL_set1_dnsname, SSL_add1_ipaddr, and SSL_set1_ipaddr were added.
+   API was added to support checking multiple names against a certificate with
+   X509_VERIFY_PARAM.  See X509_VERIFY_PARAM_set_flags(3) for full details.
+
+   * Bob Beck *
+
  * Added `X509_CRL_get0_tbs_sigalg()` accessor for the signature
    `AlgorithmIdentifier` inside CRL's `TBSCertList`.