From 3146bef5b637d8f47cba428cb5ee9994228153e8 Mon Sep 17 00:00:00 2001
From: Pranav Verma <ltprince0112@gmail.com>
Date: Sat, 17 Oct 2026 13:45:36 +0000
Subject: [PATCH] Prepare the 0.1.0 release notes

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b475f96..e4d0336 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@ follow [Semantic Versioning](https://semver.org/) from the first tagged release.
 
 ## [Unreleased]
 
+## [0.1.0] - 2026-10-17
+
+First stable release. It is the 0.1.0-rc.1 candidate (below) plus the TLS change listed here, proven end to end by the release pipeline and by the lab (107 of 107 real Log4j JNDI lookups flagged, no miss, leak or false positive). Verify what you download as described in [docs/releasing.md](docs/releasing.md), run in monitor mode first, and read [docs/threat-model.md](docs/threat-model.md).
+
 ### Changed
 - TLS 1.2 now accepts only forward-secret AEAD cipher suites by default (ECDHE with AES-GCM or ChaCha20-Poly1305). CBC and SHA-1 suites are off. Old clients that need them can be served with `tls_legacy_ciphers` (`-tls-legacy-ciphers`).