From 3ab5e89db00a01089dfb6e122fac6be49e7dd49e Mon Sep 17 00:00:00 2001
From: Joe Previte <jjprevite@gmail.com>
Date: Wed, 8 Dec 2021 15:11:53 -0700
Subject: [PATCH] chore: update CHANGELOG

---
 CHANGELOG.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8811cff94c7b..bbb557e49264 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,7 +37,15 @@ implementation (#4414).
 - The static endpoint can no longer reach outside code-server. However the
   vscode-remote-resource endpoint still can.
 - OpenVSX has been made the default marketplace. However this means web
-  extensions like Vim are now broken.
+  extensions like Vim may be broken.
+
+### Deprecated
+
+- `--link` is now deprecated (#4562).
+
+### Security
+
+- We fixed a XSS vulnerability by escaping HTML from messages in the error page (#4430).
 
 ## [3.12.0](https://github.com/cdr/code-server/releases/tag/v3.12.0) - 2021-09-15