diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8811cff94..bbb557e49 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,7 +37,15 @@ implementation (#4414).
 - The static endpoint can no longer reach outside code-server. However the
   vscode-remote-resource endpoint still can.
 - OpenVSX has been made the default marketplace. However this means web
-  extensions like Vim are now broken.
+  extensions like Vim may be broken.
+
+### Deprecated
+
+- `--link` is now deprecated (#4562).
+
+### Security
+
+- We fixed a XSS vulnerability by escaping HTML from messages in the error page (#4430).
 
 ## [3.12.0](https://github.com/cdr/code-server/releases/tag/v3.12.0) - 2021-09-15