Use only the first component of VERSION from /etc/os-release (#2070249)
Don't run power-on self-tests on DSA (#2061325)

Stop using typeof keyword for tss2 function prototypes (#2057490)
Ensure allowlist API is called before priority string construction (#1975421)

Increase GNUTLS_MAX_ALGORITHM_NUM for allowlisting (#2033220)
Ensure allowlisting API is called before priority string is constructed (#2042532)

Compile out GOST algorithm IDs (#1945292)

Fix upstream testsuite in fips mode (#2051637)

Specify FIPS140-3 module name and version
fips: allow a few more primes in RSA key generation
fips: tighten PKCS#12 algorithm checks
Correct return value of KTLS stub API

Disable config reload in order to not break allowlisting (#2042532)

Build with TPM2 support, patch from Alexander Sosedkin (#2033220)

Update to gnutls 3.7.3 (#2033220)

Update gnutls_{hash,hmac}_copy man-pages as well (#1999639)

Drop support for GNUTLS_NO_EXPLICIT_INIT envvar in favor of
Expand documentation of gnutls_{hash,hmac}_copy, mentioning that

Fix race condition when resolving SYSTEM priority in allowlisting mode (#2012249)

Fix issues in bundled libopts, spotted by covscan (#1938730)

Enable Intel CET
Remove unnecessary CCASFLAGS setting for annocheck

Temporarily disable LTO for aarch64 and ppc64le