diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index d04d10fc1c..dc872260e1 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -4,8 +4,8 @@ curl and libcurl 8.22.0
  Command line options:         278
  curl_easy_setopt() options:   312
  Public functions in libcurl:  100
- Authors:                      1503
- Contributors:                 3761
+ Authors:                      1506
+ Contributors:                 3765
 
 This release includes the following changes:
 
@@ -22,8 +22,13 @@ This release includes the following bugfixes:
  o autotools: minor fixes and improvements [33]
  o build: always use local `inet_pton()`/`inet_ntop()` implementations [56]
  o build: assume POSIX `select()` is available [166]
+ o build: clear `Require.private` for static-only builds in `libcurl.pc` [188]
  o build: drop superfluous `STDC_HEADERS` macro [51]
  o build: enable thread-safe `getaddrinfo()` for OpenBSD [35]
+ o build: minor debug option message fixes/improvements [200]
+ o build: require `!NDEBUG` for debug-enabled (aka development) builds [202]
+ o build: strip duplicate spaces after `Libs.private:` in `libcurl.pc` [191]
+ o build: strip trailing spaces from `libcurl.pc` [194]
  o cd2nroff: fix backslashes for 4-space indent lines [104]
  o cd2nroff: stricter checks for asterisks for italics [73]
  o cf-ngtcp2-cmn: de-duplicate `ngtcp2_conn_client_new()` call code [156]
@@ -37,6 +42,7 @@ This release includes the following bugfixes:
  o cmake: replace `remove` command with `rm` and pass arg safely [11]
  o cmake: robustify base path in local file reference [15]
  o cmake: stop probing unused `float.h` for `STDC_HEADERS` [10]
+ o cmake: use built-in variable and target property dump functions with CMake 4.5+ [155]
  o configure: clarify --enable-debug option [133]
  o configure: fix misleading error messages [42]
  o configure: link `-lcrypt32` instead of `-lm` for wolfSSL on Windows [79]
@@ -46,7 +52,9 @@ This release includes the following bugfixes:
  o conncache: apply multi limits to transfers using a shared pool [41]
  o conncache: conn upkeep/alive: move and enhance [152]
  o conncache: connection alive checks intervals [20]
+ o conncache: don't assume curl_off_t increment wrap-around [138]
  o connect: connection close tweaks [112]
+ o content_encoding: exact-match the identity transfer-coding token [189]
  o content_encoding: give a clear error on multi-member gzip [46]
  o cookie: refuse to load cookies set against a PSL domain [139]
  o CREDENTIALS.md: remove comment about empty user/pass [50]
@@ -61,14 +69,17 @@ This release includes the following bugfixes:
  o CURLOPT_UNRESTRICTED_AUTH.md: 'Authorization', not 'Authentication' [74]
  o CURLSHOPT_(UN)SHARE.md: do not modify shares while in use [44]
  o DEPRECATE.md: HTTP/2 Server Push gets removed in March 2027 [174]
+ o dict: avoid busy-loop in sendf() when the socket is not writable [99]
  o dnsd: fix bounds check in `read_https_alpn_part()` [143]
  o docs/INTERNALS.md -> docs/DEPENDENCIES.md [127]
+ o DoH: improvements [203]
  o FTP: fix TLS session reuse on the data connection [80]
  o ftp: reject control bytes in ACCT and alternative-to-user [26]
  o gitignore: maintenance updates [170]
  o gopher: reject CR and LF in the selector [1]
  o h2: bootstrap max streams from multi handle if in use [132]
  o h3-proxy: fix NULL deref when non-:status header arrives before :status [167]
+ o header api: add guards [168]
  o HISTORY: add when c-ares support was introduced (2004)
  o hostip: only cache negative resolves for authoritative answers [16]
  o http2: make server push transfers inherit share from parent [81]
@@ -80,6 +91,8 @@ This release includes the following bugfixes:
  o idn: restore `MultiByteToWideChar()` `MB_ERR_INVALID_CHARS` flag [103]
  o INSTALL.md: add building-from-source overview section [29]
  o INTERNALS.md: require quiche 0.20.0+ [101]
+ o keylog: add a random size argument to Curl_tls_keylog_write() [180]
+ o ldap: reject control characters in URL-decoded filter values [196]
  o ldap: support empty username and password [106]
  o ldap: support insecure mode for Windows native LDAP [3]
  o lib1587: fix gcc `-Wconversion` with LibreSSL on Windows, test in CI [6]
@@ -89,6 +102,10 @@ This release includes the following bugfixes:
  o lib: fix 'ns' -> 'us' in trace messages [57]
  o lib: ratelimit timestamps [14]
  o lib: update mentions of the legacy "sessionhandle" [157]
+ o libcurl.pc: add `License` tag [190]
+ o libcurl.pc: add Copyright tag to the pkgconf file
+ o libcurl.pc: add the Link.ABI and Source tags [210]
+ o mbedtls: enforce verifyhost when verifypeer is disabled [208]
  o mbedtls: replace `memset()` with `psa_hash_operation_init()` [28]
  o md5: replace magic numbers with `MD5_DIGEST_LEN` [122]
  o mime.c: avoid integer overflow in base64 size calculation [105]
@@ -96,7 +113,10 @@ This release includes the following bugfixes:
  o mod_curltest: fix compiler warnings [49]
  o mqtt: reject control bytes in the topic [43]
  o multi: forbid curl_easy_pause from within multi socket callback [22]
+ o multi: hold timeout values in 'int' instead of 'long' [165]
  o multi: remove #if 0'ed code that uses old struct [150]
+ o multi: use index list for expire timeouts [197]
+ o multihandle: move two struct fields [163]
  o ngtcp2: clean up after ngtcp2 in `curl_global_cleanup` [126]
  o ngtcp2: let verify failures win over expiry processing errors [98]
  o openldap: handle Curl_sasl_continue() returns better [45]
@@ -105,6 +125,7 @@ This release includes the following bugfixes:
  o openssl: drop unused pre-OpenSSL3 `ctx_option_t` typedef [8]
  o openssl: prefer modern API flavors for `EVP_MD_CTX` new/free [47]
  o openssl: replace stray legacy API variant with `EVP_DigestInit_ex()` [27]
+ o progress: cleanup, less memory [179]
  o psl: update a comment to understandable English [162]
  o pytest: update two H3 tests for nghttp3 1.18.0+ [158]
  o quiche: set the max field section size [100]
@@ -115,6 +136,7 @@ This release includes the following bugfixes:
  o runtests: restore `-k` option and actively process as no-op [32]
  o sasl: fix zero-length response encoding [36]
  o schannel: fix error check logic in `get_client_cert()` file reader [144]
+ o schannel: reuse the send buffer [195]
  o schannel: shut off experimental TLS 1.3 support for Win 10 [25]
  o scorecard: fix `max_upload` init value in `ul_parallel()` [142]
  o scripts/badwords.txt: do not recommend using 'will' in rewrites [141]
@@ -149,6 +171,7 @@ This release includes the following bugfixes:
  o tests: target Python 3.8 as the minimum Python version
  o tests: use simpler constructions in Python code
  o thrdpool: retry failed thread starts while items wait [62]
+ o thrdqueue: drop name strdups from Curl_thrdq_create [181]
  o tidy-up: `TEXT()` vs `_TEXT()` vs `_T()` use (Windows) [102]
  o tidy-up: comments, messages, formatting [172]
  o tidy-up: drop redundant includes [110]
@@ -163,13 +186,18 @@ This release includes the following bugfixes:
  o tool_cb_hdr: de-duplicate filename setter [24]
  o tool_cb_prg: avoid integer overflows [93]
  o tool_doswin: add stdin relay auth [130]
+ o tool_operate: limit `is_using_schannel()` call to Windows [140]
+ o tool_operate: only check for schannel if on windows [187]
  o tool_operate: remove call to abort() [23]
  o tool_xattr: add support for Windows alternate data stream [129]
  o typecheck-gcc: allow passing `char[]` as callback data [153]
+ o uint-bset: add slot0 member [173]
  o uint-spbset: reused empty chunks [67]
  o unit3214: fix to pass on systems with >=128-bit pointers [107]
+ o url: fix negotiate/ntlm connection reuse [176]
  o url: reject control codes in credentials set via CURLOPT [70]
  o urlapi: allow URLs to not have userauth (hostname) [92]
+ o urlapi: avoid dedotdotify() if possible [182]
  o urlapi: clear password buffer on error path [121]
  o urlapi: do not keep an internal port string [31]
  o urlapi: improved return codes [148]
@@ -205,7 +233,7 @@ Planned upcoming removals include:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
-  11soda11, 1rhino2 on hackerone, AlanKingPL, Alb3e3, Alhuda Khan,
+  11soda11, 1rhino2 on hackerone, AlanKingPL, Alb3e3, Alhuda Khan, anupamme,
   Bartel Sielski, Bigtang on hackerone, Bill Mill, Bryan Henderson,
   Carlos Henrique Lima Melara, CatboxParadox, Christian Ullrich,
   Christoph Reiter, claudex on github, Collin Funk, Dan Fandrich,
@@ -213,13 +241,14 @@ advice from friends like these:
   ed0d2b2ce19451f2 on github, Emmanuel Ugwu, Eunsoo Kim, firexinghe on github,
   Graham Campbell, Hendrik Hübner, HwangRock, itzTanos29, Joel Depooter,
   Johannes Schindelin, Keng-Yu Lin, kit-ty-kate on github, Laurent Sabourin,
-  Marcel Jamin, Matthew John Cheetham, Memduh Çelik, Patrick Monnerat,
-  Pavel Sobolev, pszemus on github, Ramesh Adhikari, Ray Satiro, renovate[bot],
-  Rito Rhymes, RMMoreton on github, Roger Leigh, Ross Burton, Sameeh Jubran,
-  Sam James, Samuel Dainard, Sergei Zimmerman, smaeljaish on hackerone,
-  Stefan Eissing, Stephan Zeisberg, stze on hackerone, Viktor Szakats,
-  xmoezzz on github, Yoshiro Yoneya
-  (56 contributors)
+  Marcel Jamin, Martin Dukek, Matthew John Cheetham, Max Dymond, Memduh Çelik,
+  Patrick Monnerat, Pavel Sobolev, pszemus on github, Ralf Mueller,
+  Ramesh Adhikari, Ray Satiro, renovate[bot], Rito Rhymes, RMMoreton on github,
+  Roger Leigh, Ross Burton, Sameeh Jubran, Sam James, Samuel Dainard,
+  Sergei Zimmerman, smaeljaish on hackerone, Stefan Eissing, Stephan Zeisberg,
+  stze on hackerone, Thomas Chauchefoin, Viktor Szakats, xmoezzz on github,
+  Yoshiro Yoneya
+  (61 contributors)
 
 References to bug reports and discussions on issues:
 
@@ -321,6 +350,7 @@ References to bug reports and discussions on issues:
  [96] = https://curl.se/bug/?i=22323
  [97] = https://curl.se/bug/?i=22318
  [98] = https://curl.se/bug/?i=22317
+ [99] = https://curl.se/bug/?i=22576
  [100] = https://curl.se/bug/?i=22331
  [101] = https://curl.se/bug/?i=22333
  [102] = https://curl.se/bug/?i=22334
@@ -357,7 +387,9 @@ References to bug reports and discussions on issues:
  [134] = https://curl.se/bug/?i=22515
  [135] = https://curl.se/bug/?i=22413
  [137] = https://curl.se/bug/?i=22341
+ [138] = https://curl.se/bug/?i=22569
  [139] = https://curl.se/bug/?i=22500
+ [140] = https://curl.se/bug/?i=22568
  [141] = https://curl.se/bug/?i=22422
  [142] = https://curl.se/bug/?i=22421
  [143] = https://curl.se/bug/?i=22420
@@ -372,6 +404,7 @@ References to bug reports and discussions on issues:
  [152] = https://curl.se/bug/?i=21806
  [153] = https://curl.se/bug/?i=22409
  [154] = https://curl.se/bug/?i=22270
+ [155] = https://curl.se/bug/?i=22566
  [156] = https://curl.se/bug/?i=22401
  [157] = https://curl.se/bug/?i=22463
  [158] = https://curl.se/bug/?i=22397
@@ -379,11 +412,34 @@ References to bug reports and discussions on issues:
  [160] = https://curl.se/bug/?i=22460
  [161] = https://curl.se/bug/?i=22505
  [162] = https://curl.se/bug/?i=22502
+ [163] = https://curl.se/bug/?i=22565
  [164] = https://curl.se/bug/?i=22494
+ [165] = https://curl.se/bug/?i=22564
  [166] = https://curl.se/bug/?i=22448
  [167] = https://curl.se/bug/?i=22449
+ [168] = https://curl.se/bug/?i=22530
  [169] = https://curl.se/bug/?i=22447
  [170] = https://curl.se/bug/?i=22445
  [171] = https://curl.se/bug/?i=22444
  [172] = https://curl.se/bug/?i=22443
+ [173] = https://curl.se/bug/?i=22561
  [174] = https://curl.se/bug/?i=22490
+ [176] = https://curl.se/bug/?i=22528
+ [179] = https://curl.se/bug/?i=22547
+ [180] = https://curl.se/bug/?i=22560
+ [181] = https://curl.se/bug/?i=22555
+ [182] = https://curl.se/bug/?i=22557
+ [187] = https://curl.se/bug/?i=22552
+ [188] = https://curl.se/bug/?i=22548
+ [189] = https://curl.se/bug/?i=22541
+ [190] = https://curl.se/bug/?i=22545
+ [191] = https://curl.se/bug/?i=22544
+ [194] = https://curl.se/bug/?i=22536
+ [195] = https://curl.se/bug/?i=22540
+ [196] = https://curl.se/bug/?i=22524
+ [197] = https://curl.se/bug/?i=22473
+ [200] = https://curl.se/bug/?i=22532
+ [202] = https://curl.se/bug/?i=22484
+ [203] = https://curl.se/bug/?i=22514
+ [208] = https://curl.se/bug/?i=22475
+ [210] = https://curl.se/bug/?i=22519