diff --git a/CHANGES.md b/CHANGES.md
index 8651d735a8..d6d90b05c8 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,6 +8,33 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.123.2 (2026-11-05) {: #3.123.2 }
+
+### REST API {: #3.123.2-rest-api }
+
+#### Bugfixes {: #3.123.2-rest-api-bugfix }
+
+- Fixed uploads of files whose names start with `artifact` when the media root is empty.
+  [#8041](https://github.com/pulp/pulpcore/issues/8041)
+- Insures that `Content-Disposition`, `Content-Security-Policy`, and `X-Content-Type-Options`
+  are set consistently in the content-app. This addresses CVE-2026-84232.
+
+### Plugin API {: #3.123.2-plugin-api }
+
+#### Bugfixes {: #3.123.2-plugin-api-bugfix }
+
+- Pulp's `gpg_verify()` function now respects the system policy for the sequoia crypto library in `/etc/crypto-policies/back-ends/sequoia.config` (or the path set by the environment variable `SEQUOIA_CRYPTO_POLICY`).
+
+### Pulp File {: #3.123.2-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.123.2-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.123.1 (2026-10-23) {: #3.123.1 }
 
 ### REST API {: #3.123.1-rest-api }
@@ -356,6 +383,32 @@ No significant changes.
 
 ---
 
+## 3.118.6 (2026-11-05) {: #3.118.6 }
+
+### REST API {: #3.118.6-rest-api }
+
+#### Bugfixes {: #3.118.6-rest-api-bugfix }
+
+- Fixed uploads of files whose names start with `artifact` when the media root is empty.
+  [#8041](https://github.com/pulp/pulpcore/issues/8041)
+- Increased the default maximum HTTP header field size for the pulpcore gunicorn config from 8190 to 16384 bytes to support PQC (post-quantum) X.509 certificates forwarded via the `X-CLIENT-CERT` header.
+
+### Plugin API {: #3.118.6-plugin-api }
+
+#### Bugfixes {: #3.118.6-plugin-api-bugfix }
+
+- Pulp's `gpg_verify()` function now respects the system policy for the sequoia crypto library in `/etc/crypto-policies/back-ends/sequoia.config` (or the path set by the environment variable `SEQUOIA_CRYPTO_POLICY`).
+
+### Pulp File {: #3.118.6-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.118.6-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.118.5 (2026-10-23) {: #3.118.5 }
 
 ### REST API {: #3.118.5-rest-api }
@@ -1615,6 +1668,32 @@ No significant changes.
 
 ---
 
+## 3.105.26 (2026-11-05) {: #3.105.26 }
+
+### REST API {: #3.105.26-rest-api }
+
+#### Bugfixes {: #3.105.26-rest-api-bugfix }
+
+- Fixed uploads of files whose names start with `artifact` when the media root is empty.
+  [#8041](https://github.com/pulp/pulpcore/issues/8041)
+- Increased the default maximum HTTP header field size for the pulpcore gunicorn config from 8190 to 16384 bytes to support PQC (post-quantum) X.509 certificates forwarded via the `X-CLIENT-CERT` header.
+
+### Plugin API {: #3.105.26-plugin-api }
+
+#### Bugfixes {: #3.105.26-plugin-api-bugfix }
+
+- Pulp's `gpg_verify()` function now respects the system policy for the sequoia crypto library in `/etc/crypto-policies/back-ends/sequoia.config` (or the path set by the environment variable `SEQUOIA_CRYPTO_POLICY`).
+
+### Pulp File {: #3.105.26-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.105.26-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.105.25 (2026-10-23) {: #3.105.25 }
 
 ### REST API {: #3.105.25-rest-api }
@@ -3192,6 +3271,26 @@ No significant changes.
 
 ---
 
+## 3.85.35 (2026-11-05) {: #3.85.35 }
+
+### REST API {: #3.85.35-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.85.35-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.85.35-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.85.35-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.85.34 (2026-10-23) {: #3.85.34 }
 
 ### REST API {: #3.85.34-rest-api }
@@ -4750,6 +4849,26 @@ No significant changes.
 
 ---
 
+## 3.73.48 (2026-11-05) {: #3.73.48 }
+
+### REST API {: #3.73.48-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.73.48-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.73.48-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.73.48-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.73.47 (2026-10-23) {: #3.73.47 }
 
 ### REST API {: #3.73.47-rest-api }
@@ -6519,6 +6638,26 @@ No significant changes.
 
 ---
 
+## 3.63.50 (2026-11-05) {: #3.63.50 }
+
+### REST API {: #3.63.50-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.63.50-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.63.50-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.63.50-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.63.49 (2026-10-22) {: #3.63.49 }
 
 ### REST API {: #3.63.49-rest-api }
@@ -8486,6 +8625,29 @@ No significant changes.
 
 ---
 
+## 3.49.73 (2026-11-05) {: #3.49.73 }
+
+### REST API {: #3.49.73-rest-api }
+
+#### Bugfixes {: #3.49.73-rest-api-bugfix }
+
+- Fixed a typo in `GroupRoleSerializer` that caused a 500 error when listing group roles with a domain set.
+  [#7095](https://github.com/pulp/pulpcore/issues/7095)
+
+### Plugin API {: #3.49.73-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.49.73-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.49.73-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.49.72 (2026-10-22) {: #3.49.72 }
 
 ### REST API {: #3.49.72-rest-api }