diff --git a/CHANGES b/CHANGES
index 94ed8160ae..9d87a9242a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,87 @@
+2025.02.13, released April 21, 2026
+
+	Changes with potentially large impact:
+
+	- openssl was updated to 3.5.0 which has a few incompatible changes.
+	  See https://github.com/openssl/openssl/releases/tag/openssl-3.5.0
+
+	Important / security related fixes:
+
+	asterisk: CVE-2026-23739, CVE-2026-23741, CVE-2026-23738,
+	  CVE-2026-23740
+	bind: https://gitlab.isc.org/isc-projects/bind9/-/issues/5751,
+	  CVE-2026-1519, https://gitlab.isc.org/isc-
+	  projects/bind9/-/issues/5817, https://gitlab.isc.org/isc-
+	  projects/bind9/-/issues/5800, https://gitlab.isc.org/isc-
+	  projects/bind9/-/issues/5826
+	cpp-httplib: CVE-2026-33745, CVE-2026-34441, CVE-2026-21428,
+	  CVE-2026-22776, CVE-2026-28434, CVE-2026-28435, CVE-2026-29076,
+	  CVE-2026-31870, CVE-2026-32627
+	expat: CVE-2026-32776, CVE-2026-32777, CVE-2026-32778
+	gpsd: CVE-2025-67268, CVE-2025-67269
+	libarchive: [no CVE tracking]
+	libcurl: CVE-2026-3805, CVE-2026-3784, CVE-2026-3783, CVE-2026-1965
+	libde265: CVE-2026-33164, CVE-2026-33165
+	libheif: CVE-2025-68431
+	libmicrohttpd: CVE-2025-59777, CVE-2025-62689
+	libopenssl: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-4575,
+	  CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469,
+	  CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419,
+	  CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796,
+	  CVE-2026-31790, CVE-2026-2673, CVE-2026-28387, CVE-2026-28388,
+	  CVE-2026-28389, CVE-2026-28390, CVE-2026-31789
+	libpng: CVE-2026-33416, CVE-2026-33636, CVE-2026-34757,
+	  GHSA-6fr7-g8h7-v645
+	libxml2: CVE-2026-1757, CVE-2026-0990, CVE-2026-0992, CVE-2025-10911,
+	  CVE-2026-0989
+	mongoose: CVE-2025-65502
+	musl: CVE-2025-26519
+	nfs-utils: CVE-2025-12801
+	nghttp2: CVE-2026-27135
+	perl: CVE-2026-4176
+	python-django: CVE-2026-25673, CVE-2026-25674
+	python-flask: CVE-2026-27205
+	python-pyasn1: CVE-2026-23490
+	python-pyjwt: CVE-2026-32597,  GHSA-752w-5fwx-jx9f
+	python-tornado: CVE-2025-67724, CVE-2025-67725, CVE-2025-67726
+	python-wheel: CVE-2026-24049
+	quickjs: CVE-2025-62490, CVE-2025-62491, CVE-2025-62492,
+	  CVE-2025-62493, CVE-2025-62494, CVE-2025-62495, CVE-2025-62496
+	rauc: CVE-2026-34155
+	redis: [No CVE tracking]
+	ruby: CVE-2025-27221, CVE-2025-58767, CVE-2025-61594, CVE-2026-27820
+	tor: TROVE-2026-003, TROVE-2026-004
+	wireshark: CVE-2025-11626
+
+	Toolchain:
+
+	- uclibc: bump to 1.0.57
+	- musl: bump to 1.2.6
+	- linux-headers: bump to 6.12.81, 6.6.134, 6.1.168, 5.15.202, 5.10.252
+
+	Infrastructure updates/fixes:
+
+	- Add SECURITY.md
+	- Automatically add 2025.02.x prefix for b4 users
+	- generate-cyclonedx: add source attribute with NVD reference for CVEs
+	- Fix cve-check's CVE URLs
+	- New runtime test for connman.
+	- Added support for "secondary" target that are less often tested in
+	  autobuilders
+	- New runtime test for memcached
+	- Fix error handling in br2-external
+
+	Updated defconfigs: aarch64_efi, nitrogen*
+
+	Updated / fixed packages: asterisk, bind, cpp-httplib, expat, faketime,
+	freeradius-server, giflib, gpsd, ibm-sw-tpm2, leafnode2, libarchive,
+	libcurl, libde265, libftdi1, libheif, libmicrohttpd, libopenssl, libpng,
+	libspdm, libxml2, linux, linux-headers, ltp-testsuite, luvi, mongoose,
+	mpd, musl, nfs-utils, nghttp2, perl, python-djange, python-flask,
+	python-pyasn1, python-pyjwt, python-tornado, quickjs, rauc, redis, ruby,
+	sway, tor, uboot, uclibc, wireshark, zfs
+
+
 2025.02.12, released March 17, 2026
 
 	Important / security related fixes: