Release notes for NSS 3.89.1

2 files changed, 65 insertions, 29 deletions

diff --git a/doc/rst/releases/index.rst b/doc/rst/releases/index.rst
index d0a1e04ef..398ca7b58 100644
--- a/doc/rst/releases/index.rst
+++ b/doc/rst/releases/index.rst
@@ -8,6 +8,7 @@ Releases
    :glob:
    :hidden:
 
+   nss_3_89_1.rst
    nss_3_89.rst
    nss_3_88_1.rst
    nss_3_88.rst
@@ -52,8 +53,8 @@ Releases
 
 .. note::
 
-   **NSS 3.88.1** is the latest version of NSS.
-   Complete release notes are available here: :ref:`mozilla_projects_nss_nss_3_88_1_release_notes`
+   **NSS 3.89.1** is the latest version of NSS.
+   Complete release notes are available here: :ref:`mozilla_projects_nss_nss_3_89_1_release_notes`
 
    **NSS 3.79.4** is the latest ESR version of NSS.
    Complete release notes are available here: :ref:`mozilla_projects_nss_nss_3_79_4_release_notes`
@@ -61,33 +62,9 @@ Releases
 
 .. container::
 
-   Changes in 3.88.1 included in this release:
+   Changes in 3.89.1 included in this release:
 
-   - Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
+   - Bug 1804505 - Update the technical constraints for KamuSM.
+   - Bug 1822921 - Add BJCA Global Root CA1 and CA2 root certificates.
 
-   Changes in 3.88 included in this release:
 
-   - Bug 1815870 - use a different treeherder symbol for each docker image build task.
-   - Bug 1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images 
-   - Bug 1810702 - remove nested table in rst doc
-   - Bug 1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. 
-   - Bug 1812671 - build failure while implicitly casting SECStatus to PRUInt32. r=nss-reviewers,mt
-   - Bug 1212915 - Add check for ClientHello SID max length. This is tested by Bogo tests 
-   - Bug 1771100 - Added EarlyData ALPN test support to BoGo shim. 
-   - Bug 1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup.
-   - Bug 1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm. 
-   - Bug 1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test.
-   - Bug 1771100 - Added Bogo ECH rejection test support.
-   - Bug 1771100 - Added ECH 0Rtt support to BoGo shim. 
-   - Bug 1747957 - RSA OAEP Wycheproof JSON
-   - Bug 1747957 - RSA decrypt Wycheproof JSON
-   - Bug 1747957 - ECDSA Wycheproof JSON
-   - Bug 1747957 - ECDH Wycheproof JSON
-   - Bug 1747957 - PKCS#1v1.5 wycheproof json
-   - Bug 1747957 - Use X25519 wycheproof json
-   - Bug 1766767 - Move scripts to python3
-   - Bug 1809627 - Properly link FuzzingEngine for oss-fuzz.
-   - Bug 1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) 
-   - Bug 1804091 NSS needs to move off of DSA for integrity checks
-   - Bug 1805815 - Add initial testing with ACVP vector sets using acvp-rust
-   - Bug 1806369 - Don't clone libFuzzer, rely on clang instead
diff --git a/doc/rst/releases/nss_3_89_1.rst b/doc/rst/releases/nss_3_89_1.rst
new file mode 100644
index 000000000..963aded8b
--- /dev/null
+++ b/doc/rst/releases/nss_3_89_1.rst
@@ -0,0 +1,59 @@
+.. _mozilla_projects_nss_nss_3_89_1_release_notes:
+
+NSS 3.89.1 release notes
+========================
+
+`Introduction <#introduction>`__
+--------------------------------
+
+.. container::
+
+   Network Security Services (NSS) 3.89.1 was released on *5th May 2023**.
+
+
+.. _distribution_information:
+
+`Distribution Information <#distribution_information>`__
+--------------------------------------------------------
+
+.. container::
+
+   The HG tag is NSS_3_89_1_RTM. NSS 3.89.1 requires NSPR 4.35 or newer.
+
+   NSS 3.89.1 source distributions are available on ftp.mozilla.org for secure HTTPS download:
+
+   -  Source tarballs:
+      https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_89_1_RTM/src/
+
+   Other releases are available :ref:`mozilla_projects_nss_releases`.
+
+.. _changes_in_nss_3.89.1:
+
+`Changes in NSS 3.89.1 <#changes_in_nss_3.89.1>`__
+--------------------------------------------------
+
+.. container::
+
+   - Bug 1804505 - Update the technical constraints for KamuSM.
+   - Bug 1822921 - Add BJCA Global Root CA1 and CA2 root certificates.
+
+
+`Compatibility <#compatibility>`__
+----------------------------------
+
+.. container::
+
+   NSS 3.89.1 shared libraries are backwards-compatible with all older NSS 3.x shared
+   libraries. A program linked with older NSS 3.x shared libraries will work with
+   this new version of the shared libraries without recompiling or
+   relinking. Furthermore, applications that restrict their use of NSS APIs to the
+   functions listed in NSS Public Functions will remain compatible with future
+   versions of the NSS shared libraries.
+
+`Feedback <#feedback>`__
+------------------------
+
+.. container::
+
+   Bugs discovered should be reported by filing a bug report on
+   `bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).