@@ -0,0 +1,95 @@
+Changes with Apache Traffic Server 10.2.1
+  #13553 - origin_server_auth: Improve log messages
+  #13567 - Metrics: Revert added locking and annotations
+  #13505 - Add hidden metrics and MAX/MIN/incremental derived metric aggregation
+  #13538 - Fix records_yaml startup lookup race
+  #13510 - doc: rate_limit uses max_age, not max-age
+  #13238 - prefetch: move cache key acquisition to CACHE_LOOKUP_COMPLETE
+  #13580 - compress: add Vary to cached client responses
+  #13506 - Per upstream server connection metrics via hidden and derived metrics
+  #13577 - Fix silently dropped Streams.all autest assertions
+  #13110 - Add `_reload` directive support for config reload framework.
+  #13589 - Skip rate_limit AuTests when plugin not built
+  #13593 - Fix Clang 21 analyzer findings
+  #13576 - Fix client certificate context updates
+  #13578 - Remove dead JSONRPC server_shutdown handler
+  #13227 - Fix data race in SSLCertContext copy & assignment
+  #13642 - Proxy Verifier v3.2.0
+  #13558 - dns: fix remaining-space tracking when copying address records
+  #13570 - Argparser variable arg option parsing fix/improvement.
+  #13583 - Metrics: close the id lookup race and bounds gaps left by the lock revert
+  #13652 - Restore regex_remap's default PCRE2 match limit
+  #13646 - header_rewrite: build the matcher for %{LAST-CAPTURE} conditions
+  #13514 - Share HTTP accept properties
+  #13645 - Cleanup LogField Registration
+  #13063 - Add changelog generation tool for GitHub milestones
+  #13574 - Fix TransformVConnection leak in abort_tunnel()
+  #13450 - h2origin autest: honor the 30s squid.log wait budget
+  #13672 - header_rewrite: guard the i == 0 case in HRWSimpleTokenizer
+  #13673 - Fix build errors with LLVM 23
+  #13616 - Allow a metric to be unlisted
+  #13697 - Fix strncasecmp checks that accepted a prefix as equal
+  #13355 - Add --version CLI flag to hrw4u
+  #13666 - Retract per server metrics when the mode changes
+  #13700 - Fix the 9.2 compatibility cache key for paths that carry ";params"
+  #13696 - hrw4u: admit SESSION_VARS as a denyable section
+  #13611 - Make the 9.2 compatibility cache key usable end to end
+  #13571 - Use __atomic builtins as the freelist 128-bit CAS fallback
+  #13655 - QPACK: use || in the varint decode range guards
+  #13656 - hrw4u: exit non-zero on compile errors
+  #13699 - hrw4u: add an AST round-trip test over the whole corpus
+  #13675 - hrw4u: enforce sandbox NOT and in on their implicit spellings
+  #13653 - Handle all cachekey regex capture groups
+  #13715 - Test 103 Early Hints before a cached range response
+  #13718 - cache: retry without O_DIRECT for an explicit file span
+  #13560 - Honor allow_half_open when a client aborts early
+  #13455 - Reuse deleted MIME field slots
+  #13677 - Fix global TLS ticket key use for certificate contexts
+  #13717 - tests: cover the global TLSv1.3 session ticket count
+  #13740 - Coverity: avoid unsigned wrap in AIO cache_op loop
+  #13728 - Fix SSL 2.0 version code in JA4 fingerprints
+  #13736 - Bind session ticket keys to the dest_ip certificate
+  #13719 - Hex-encode non-alphanumeric ALPN bytes in JA4 fingerprints
+  #13725 - Include signature algorithms in JA4 fingerprints
+  #13762 - Python 3.15: accommodate PyYAML without CLoader
+  #13761 - Handle OpenSSL 4 handshake buffer exhaustion
+  #13760 - Support OpenSSL 4 certificate accessors in WASM
+  #13695 - Fix HTTP flow control policy reload
+  #13759 - Remove unused globals rejected by Clang 23
+  #13766 - Harden shutdown against repeated exit signals
+  #13782 - Fix parsing of bodyless HTTP/2 origin responses over 4 KB
+  #13351 - Handle HTTP/2 1xx interim responses from the origin
+  #13447 - HTTP/2 to origin session pool and reliability fixes
+  #13776 - compress: use weak ETags for compressed responses
+  #13783 - Drain an HTTP/2 origin session after it sends GOAWAY
+  #13723 - tests: drive tls_sni_groups with openssl s_client
+  #13780 - Deliver H2 END_STREAM that arrives while read is throttled
+  #13729 - Honor TLS handshake hook pauses on BoringSSL
+  #13763 - Frame empty TLS origin responses in AuTests
+  #13674 - hrw4u: enforce sandbox policy on value functions
+  #13767 - cache: keep the stripe locked after the shutdown dir sync
+  #13559 - Build the well-known-string table at compile time
+  #13376 - Reduce repeated work in HTTP header parsing
+  #13739 - hrw4u: report each sandbox warning at the use that triggers it
+  Fix use-after-free in wasm plugin TXN_CLOSE epilogue
+  Compare h2 Content-Length and payload at full width
+  wasm: Validate metric ID before making API call
+  http: reject HEAD requests carrying Content-Length/Transfer-Encoding
+  Throttle @ header strip logs
+  tsmemcache: bind to loopback by default and add configurable bind address
+  Regex: optionally require whole-subject matches for policy rules
+  Strip unauthorized x-amz- request headers in origin_server_auth
+  CVE-2025-55702 - Fix request with POST Expect: 100-continue
+  Require a matching client certificate for outbound session reuse
+  magick: require signing key and allowlist convert operators
+  origin_server_auth: clarify x-amz- stripping scope in docs and comments
+  proxy: reject resumed TLS sessions missing a required client cert
+  Fix mTLS for TLS resumption scenarios
+  Drop the special case for badly formed 302 responses
+  doc: correct the regex matching contract where sites enforce full match
+  Size chunked passthrough writes without dropped trailers
+  chunked_encoding: add regression test for chunked responses with trailers
+  Reuse an origin connection only after its request body is written
+  doc: record the security release in the release notes
+  Count the Pad Length field in the h2 DATA padding check
+  Fix a SIGSEGV in UnixNetVConnection::net_write_io on dechunked POST responses
@@ -233,6 +233,58 @@ Plugins
   :file:`sni.yaml` already require a whole-subject match and are unaffected by
   the setting (CVE-2026-22068).
 
+Changes in 10.2.1
+-----------------
+
+These are the behavior changes in 10.2.1 that are not security hardening. The
+security-related ones, including the new ``reject_head_with_content`` default, are
+under `Security Hardening`_ and `TLS Session Resumption`_ above.
+
+* JA4 fingerprints change. ``ja4_fingerprint`` and ``jax_fingerprint`` now hash
+  the client's signature algorithms into the last section of the fingerprint, as
+  the JA4 specification requires, hex-encode ALPN bytes that are not
+  alphanumeric, and report the correct version code for SSL 2.0. The last section
+  of almost every fingerprint differs from 10.2.0, so stored fingerprints, and
+  any allow or deny rules built from them, must be regenerated.
+
+* ``compress`` sends a weak ``ETag`` (``W/"abc"``) for a compressed response and
+  adds ``Vary`` to cached client responses. A client holding a compressed copy can
+  still revalidate with ``If-None-Match``, but ``If-Match`` and ``If-Range``
+  compare strongly and no longer match it. See :ref:`admin-plugins-compress`.
+
+* TLS session ticket keys follow the global ticket key configuration for every
+  certificate context, and for a ``dest_ip`` certificate they are derived from
+  that certificate, so a ticket issued for one certificate is not accepted for
+  another. Tickets issued by 10.2.0 may not resume after the upgrade and
+  complete a full handshake. A context whose keys cannot be bound to a
+  certificate neither issues nor accepts tickets, counted by
+  :ts:stat:`proxy.process.ssl.total_tickets_no_certificate`.
+
+* With :ts:cv:`proxy.config.http.allow_half_open` set to ``0``, a client that
+  aborts before the origin has sent its response header again tears down the
+  origin connection. Since 10.1 it was held open until the response arrived.
+
+* When :ts:cv:`proxy.config.http.cache.try_compat_key_read` is enabled, a
+  legacy object is revalidated without conditional headers so the full response
+  is stored under the current key, and invalidations are sent to both keys. Plan
+  for the extra origin transfer on first revalidation.
+
+* :program:`hrw4u` exits ``1`` when any input fails to compile, where it
+  previously exited ``0``. Build scripts that ignored the status will now fail.
+  Its sandbox policy also applies to more spellings than before, so a
+  configuration that passed with a deny list on 10.2.0 may now be rejected.
+
+* ``ts::Metrics`` no longer has an iterator; see the API note later in this
+  section.
+
+* New configuration: :ts:cv:`proxy.config.http.per_server.connection.metric_aggregate`
+  and :ts:cv:`proxy.config.http.per_server.connection.metric_prefix`, alongside
+  the documented
+  :ts:cv:`proxy.config.http.per_server.connection.metric_enabled`. With
+  ``metric_enabled`` set and ``metric_aggregate`` at its default of ``0``, behavior
+  is unchanged; values ``2`` and ``3`` stop publishing the per group metrics for
+  match type ``both``.
+
 Incompatible Changes
 --------------------
 
 
@@ -66,6 +66,59 @@ installation does not have, is:
 * ``magick`` requires a signing key and will not load without one, and allowlists
   the ImageMagick ``convert`` operators it will run.
 
+Changes in 10.2.1
+-----------------
+
+The 10.2.1 maintenance release adds 95 commits from 19 contributors to 10.2.0.
+Besides the security fixes above, the changes an operator or plugin author is
+likely to notice are below. The sections that follow describe 10.2 as a whole,
+including these changes where they touch the same feature. Behavior changes that
+need action before upgrading from 10.2.0 are collected under ``Changes in
+10.2.1`` in :ref:`upgrading`.
+
+* Per upstream server connection metrics. Setting
+  :ts:cv:`proxy.config.http.per_server.connection.metric_enabled` publishes
+  ``current_connection``, ``total_connection`` and ``blocked_connection`` for
+  each upstream server group, and the new
+  :ts:cv:`proxy.config.http.per_server.connection.metric_aggregate` can instead
+  publish only per hostname sums and a ``current_connection.max`` gauge, which
+  keeps the metric count proportional to hostnames rather than to addresses. The
+  optional :ts:cv:`proxy.config.http.per_server.connection.metric_prefix`
+  distinguishes metrics of separate ``match`` configurations. See
+  :ref:`per-server-connection-metrics`.
+* The metrics store supports hidden metrics, which are recorded but never
+  published, and MAX, MIN and incremental derived metrics. See the
+  ``ts::Metrics`` documentation in the developer guide.
+* Configuration reload accepts *reload directives*: operational parameters, such
+  as scoping a reload to one entry, passed to a single handler with
+  ``traffic_ctl config reload -D config_key.directive=value`` or under a
+  ``_reload`` key in the RPC payload. They are delivered to the handler
+  separately from the configuration content.
+* HTTP/2 to the origin is considerably more robust: 1xx interim responses are
+  handled, header blocks split across ``CONTINUATION`` frames are accepted,
+  responses to ``HEAD`` and ``304`` are validated correctly, a half-closed or
+  ``GOAWAY``-draining session is no longer reused, one request's
+  ``Connection: close`` no longer poisons a long-lived session, and a request the
+  origin reports as unprocessed (``GOAWAY`` or ``REFUSED_STREAM``) is retried when
+  its body can be replayed. New counters
+  :ts:stat:`proxy.process.http.origin.reuse_fail`,
+  :ts:stat:`proxy.process.http.origin.retry_admitted` and
+  :ts:stat:`proxy.process.http.origin.retry_body_unavailable` expose this.
+* :ts:cv:`proxy.config.http.cache.try_compat_key_read` is now usable end to end:
+  revalidating a legacy object stores the full response under the current key and
+  invalidations are sent to both keys.
+* The ``compress`` plugin adds ``Vary`` to cached client responses and sends a
+  weak ``ETag`` for compressed responses.
+* ``ja4_fingerprint`` and ``jax_fingerprint`` now follow the JA4 specification.
+* :program:`hrw4u` exits non-zero on compile errors, has a ``--version`` option,
+  and its sandbox policy covers value functions, string interpolation, implicit
+  ``NOT`` and ``in`` spellings, and the ``SESSION_VARS`` section.
+* ``TSStatIdIsValid()`` lets a plugin validate a statistic index received from an
+  external source before using it.
+* A new tool generates the changelog from a GitHub milestone.
+* Builds were fixed for LLVM 23 and Clang 21 and 23 diagnostics, OpenSSL 4
+  handshake buffers and certificate accessors, and Python 3.15.
+
 Configuration Reload
 --------------------