diff --git a/.changeset/knex-3-2-9-security.md b/.changeset/knex-3-2-9-security.md
deleted file mode 100644
index 9ee413642..000000000
--- a/.changeset/knex-3-2-9-security.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-"nostream": patch
----
-
-fix(deps): bump knex to 3.2.9 for the search_path SQL injection (AIKIDO-2026-10469)
-
-knex 0.0.1–3.2.8 interpolates values passed to `searchPath` for the Postgres
-dialect into generated SQL without validating or escaping them, so a value an
-attacker can influence becomes an injected identifier. 3.2.9 escapes the double
-quotes (#6411); this repository declares `knex` 2.4.2 on both the default branch
-and `rewrite/main`.
-
-nostream never sets `searchPath` — `grep -rn "search_path" src/` finds nothing —
-so the reachable path is not exercised today, and the bump is taken to remove a
-vulnerable dependency from the image, not to close a reachable hole.
-
-knex 3.0.0 drops Node < 16, which the repo already requires (>=24.14.1), and 3.2.0
-tightens `RawBinding`. The one compile error that surfaced,
-`src/scripts/benchmark-queries.ts` passing `bindings as readonly unknown[]` to
-`db.raw()`, is fixed by dropping the assertion: `toSQL().bindings` is already the
-accepted type. The emitted JavaScript is byte-identical with and without the
-assertion.
diff --git a/.changeset/peering-peer-auth.md b/.changeset/peering-peer-auth.md
deleted file mode 100644
index 3e374edd7..000000000
--- a/.changeset/peering-peer-auth.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-"nostream": minor
----
-
-feat(peering): authenticate peer relays with NIP-42 using the relay keypair
-
-Adds the peering identity layer: a configured `peering.peers` trust list keyed
-by relay pubkey (hex or `npub`), outbound NIP-42 AUTH signed with the relay's own
-keypair, and inbound recognition of a verified peer pubkey on the connection
-state. Peer status is tied to the NIP-42 session, so it expires or clears with
-the socket; a valid AUTH from an unconfigured pubkey stays an ordinary client.
-
-`peering.peers[].relayUrl` is the outbound address only — identity is always the
-verified pubkey, never the URL. Relay key storage and the AUTH exchange are
-documented in `docs/PEERING.md`, and the new fields are validated with the rest
-of the settings document.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 11de27b14..5a6fde675 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,43 @@
 # nostream
 
+## 3.11.0
+
+### Minor Changes
+
+- [#1030](https://github.com/cameri/nostream/pull/1030) [`9b585db`](https://github.com/cameri/nostream/commit/9b585db93796b4149d3932487686a46a597b7643) Thanks [@Ferryx349](https://github.com/Ferryx349)! - feat(peering): authenticate peer relays with NIP-42 using the relay keypair
+
+  Adds the peering identity layer: a configured `peering.peers` trust list keyed
+  by relay pubkey (hex or `npub`), outbound NIP-42 AUTH signed with the relay's own
+  keypair, and inbound recognition of a verified peer pubkey on the connection
+  state. Peer status is tied to the NIP-42 session, so it expires or clears with
+  the socket; a valid AUTH from an unconfigured pubkey stays an ordinary client.
+
+  `peering.peers[].relayUrl` is the outbound address only — identity is always the
+  verified pubkey, never the URL. Relay key storage and the AUTH exchange are
+  documented in `docs/PEERING.md`, and the new fields are validated with the rest
+  of the settings document.
+
+### Patch Changes
+
+- [#1024](https://github.com/cameri/nostream/pull/1024) [`eb304b8`](https://github.com/cameri/nostream/commit/eb304b80c9cb997634509df8ef8155fe8ef619dd) Thanks [@chappie-daemon](https://github.com/chappie-daemon)! - fix(deps): bump knex to 3.2.9 for the search_path SQL injection (AIKIDO-2026-10469)
+
+  knex 0.0.1–3.2.8 interpolates values passed to `searchPath` for the Postgres
+  dialect into generated SQL without validating or escaping them, so a value an
+  attacker can influence becomes an injected identifier. 3.2.9 escapes the double
+  quotes ([#6411](https://github.com/cameri/nostream/issues/6411)); this repository declares `knex` 2.4.2 on both the default branch
+  and `rewrite/main`.
+
+  nostream never sets `searchPath` — `grep -rn "search_path" src/` finds nothing —
+  so the reachable path is not exercised today, and the bump is taken to remove a
+  vulnerable dependency from the image, not to close a reachable hole.
+
+  knex 3.0.0 drops Node < 16, which the repo already requires (>=24.14.1), and 3.2.0
+  tightens `RawBinding`. The one compile error that surfaced,
+  `src/scripts/benchmark-queries.ts` passing `bindings as readonly unknown[]` to
+  `db.raw()`, is fixed by dropping the assertion: `toSQL().bindings` is already the
+  accepted type. The emitted JavaScript is byte-identical with and without the
+  assertion.
+
 ## 3.10.2
 
 ### Patch Changes
diff --git a/package.json b/package.json
index c8bd052b9..754f439be 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nostream",
-  "version": "3.10.2",
+  "version": "3.11.0",
   "packageManager": "pnpm@10.33.0",
   "private": true,
   "description": "A Nostr relay written in Typescript.",