Merge 'preferred-email' into stable-2.5
* preferred-email:
Require preferred email to be a verified address
diff --git a/ReleaseNotes/ReleaseNotes-2.5.1.txt b/ReleaseNotes/ReleaseNotes-2.5.1.txt
index 967d78d..ba4e204 100644
--- a/ReleaseNotes/ReleaseNotes-2.5.1.txt
+++ b/ReleaseNotes/ReleaseNotes-2.5.1.txt
@@ -7,7 +7,7 @@
There are no schema changes from 2.5, or 2.5.1.
-However, if upgrading from anything earlier version, follow the upgrade
+However, if upgrading from a version older than 2.5, follow the upgrade
procedure in the 2.5 link:ReleaseNotes-2.5.html[Release Notes].
Security Fixes
diff --git a/ReleaseNotes/ReleaseNotes-2.5.2.txt b/ReleaseNotes/ReleaseNotes-2.5.2.txt
index 5e99ebf..ceb23c2 100644
--- a/ReleaseNotes/ReleaseNotes-2.5.2.txt
+++ b/ReleaseNotes/ReleaseNotes-2.5.2.txt
@@ -7,7 +7,7 @@
There are no schema changes from 2.5, or 2.5.1.
-However, if upgrading from anything earlier version, follow the upgrade
+However, if upgrading from a version older than 2.5, follow the upgrade
procedure in the 2.5 link:ReleaseNotes-2.5.html[Release Notes].
Bug Fixes
diff --git a/ReleaseNotes/ReleaseNotes-2.5.3.txt b/ReleaseNotes/ReleaseNotes-2.5.3.txt
new file mode 100644
index 0000000..60efa7a
--- /dev/null
+++ b/ReleaseNotes/ReleaseNotes-2.5.3.txt
@@ -0,0 +1,22 @@
+Release notes for Gerrit 2.5.3
+==============================
+
+Gerrit 2.5.3 is now available:
+
+link:http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.5.3.war[http://code.google.com/p/gerrit/downloads/detail?name=gerrit-2.5.3.war]
+
+There are no schema changes from any of the 2.5.x versions.
+
+However, if upgrading from a version older than 2.5, follow the upgrade
+procedure in the 2.5 link:ReleaseNotes-2.5.html[Release Notes].
+
+Security Fixes
+--------------
+* Patch vulnerabilities in OpenID client library
++
+Installations using OpenID for authentication were vulnerable to a
+number of attacks over the network. The openid4java client library
+was identified as the entry point. In this release Gerrit updated to
+the latest 0.9.8 release, which patches the known attack vectors.
+
+No other changes since 2.5.2.
diff --git a/ReleaseNotes/index.txt b/ReleaseNotes/index.txt
index e2487bc..641974a 100644
--- a/ReleaseNotes/index.txt
+++ b/ReleaseNotes/index.txt
@@ -4,6 +4,7 @@
[[2_5]]
Version 2.5.x
-------------
+* link:ReleaseNotes-2.5.3.html[2.5.3]
* link:ReleaseNotes-2.5.2.html[2.5.2]
* link:ReleaseNotes-2.5.1.html[2.5.1]
* link:ReleaseNotes-2.5.html[2.5]
