diff --git a/CHANGES.md b/CHANGES.md
index f3d8754c..a321136c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,6 +8,20 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.38.0 (2026-11-02) {: #3.38.0 }
+
+#### Features {: #3.38.0-feature }
+
+- Added custom (non-PEP 740) support for verifying attestations signed with a per-domain public key configured via `ATTESTATION_VERIFICATION_KEYS`.
+  [#1340](https://github.com/pulp/pulp_python/issues/1340)
+
+#### Bugfixes {: #3.38.0-bugfix }
+
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings.
+
+---
+
 ## 3.37.1 (2026-10-08) {: #3.37.1 }
 
 #### Bugfixes {: #3.37.1-bugfix }
@@ -37,6 +51,14 @@
 
 ---
 
+## 3.36.5 (2026-11-02) {: #3.36.5 }
+
+#### Bugfixes {: #3.36.5-bugfix }
+
+- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings.
+
+---
+
 ## 3.36.4 (2026-10-08) {: #3.36.4 }
 
 #### Bugfixes {: #3.36.4-bugfix }
@@ -272,6 +294,14 @@
 
 ---
 
+## 3.27.8 (2026-11-02) {: #3.27.8 }
+
+#### Bugfixes {: #3.27.8-bugfix }
+
+- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings.
+
+---
+
 ## 3.27.7 (2026-10-08) {: #3.27.7 }
 
 #### Bugfixes {: #3.27.7-bugfix }
@@ -534,6 +564,14 @@
 
 ---
 
+## 3.19.6 (2026-11-02) {: #3.19.6 }
+
+#### Bugfixes {: #3.19.6-bugfix }
+
+- Remote include and exclude ranges accept matching prerelease versions without deprecation warnings.
+
+---
+
 ## 3.19.5 (2026-10-08) {: #3.19.5 }
 
 #### Bugfixes {: #3.19.5-bugfix }