flyingcircusio
diff --git a/‎changelog.d/20241030_191209_PL-133062-nfs-hard-remount-v2_scriv.md
-23 b/‎changelog.d/20241030_191209_PL-133062-nfs-hard-remount-v2_scriv.md
-23
diff --git a/‎changelog.d/20241031_142143_PL-132477-dheat-ssh_scriv.md
-22 b/‎changelog.d/20241031_142143_PL-132477-dheat-ssh_scriv.md
-22
diff --git a/‎changelog.d/20241102_174031_FC-41601-devhost-channel-metadata_scriv.md
-17 b/‎changelog.d/20241102_174031_FC-41601-devhost-channel-metadata_scriv.md
-17
diff --git a/‎changelog.d/20241102_183935_phil\-FC-41403_varnish-service-reload-breakage_scriv.md
-20 b/‎changelog.d/20241102_183935_phil\-FC-41403_varnish-service-reload-breakage_scriv.md
-20
diff --git a/‎changelog.d/20241105_161901_PL-133141-update-nixpkgs-2405-update-nixpkgs-2024-11-04_scriv.md
-32 b/‎changelog.d/20241105_161901_PL-133141-update-nixpkgs-2405-update-nixpkgs-2024-11-04_scriv.md
-32
diff --git a/‎changelog.d/CHANGELOG.md
+40 b/‎changelog.d/CHANGELOG.md
+40
@@ -0,0 +1,40 @@
+# Release 2024_031
+
+## Impact
+
+- NFS clients will be rebooted to activate the new configuration. This happens
+  as a side effect of a kernel update. In the future changes to NFS client
+  settings will cause explicit reboot requests.
+
+- Activate DDoS SSH rules in fail2ban for non-production machines
+
+- Machines will schedule a maintenance reboot to activate the new kernel.
+
+## NixOS XX.XX platform
+
+- Make NFS clients more resilient against missing servers during bootstrap,
+  upgrades, and reboot scenarios. (PL-133062)
+
+- Activate DDoS SSH rules in fail2ban for non-production machines. (PL-132477)
+  This may have impact if you have multiple unauthenticated SSH connections in a short time.
+  We will roll out this change to production VMs too if no problems occur.
+
+- Explain how to use the the new release metadata URLs in DevHosts. (FC-41601)
+
+- varnish: Fix syntax error handling during hot reloads. We silently did
+  not fail on errors which masked issues until the next reboot causing
+  varnish to then fail e.g. during scheduled maintenance. We now fail
+  more visibly but keep running the old config, still. (FC-41403)
+
+- Pull upstream NixOS changes, security fixes and package updates:
+    - chromium: 129.0.6668.100 -> 130.0.6723.69 (CVE-2024-10229, CVE-2024-10230, CVE-2024-10231)
+    - discourse: 3.2.5 -> 3.3.2
+    - docker: 27.3.0 -> 27.3.1
+    - element-web: 1.11.81 -> 1.11.82
+    - firefox: 131.0.3 -> 132.0
+    - github-runner: 2.319.1 -> 2.320.0
+    - gitlab: 17.2.8 -> 17.3.6
+    - grafana: 10.4.10 -> 10.4.11
+    - linux: 5.15.164 -> 5.15.169
+    - nss_latest: 3.105 -> 3.106
+    - unifi8: 8.4.62 -> 8.5.6