4483. [func] Check prefixes in acls to make sure the address and prefix lengths are consistent. Warn only in BIND 9.11 and earlier. [RT #43367]
4401. [misc] Change LICENSE to MPL 2.0.
update copyright notice
2831. [security] Do not attempt to validate or cache out-of-bailiwick data returned with a secure answer; it must be re-fetched from its original source and validated in that context. [RT #20819]
2828. [security] Cached CNAME or DNAME RR could be returned to clients without DNSSEC validation. [RT #20737] 9.4-ESV, 9.5.3, 9.6.2, 9.7.0, 9.8.0(?)
2772. [security] When validating, track whether pending data was from the additional section or not and only return it if validates as secure. [RT #20438]