update CHANGES

docs/changes.rst

@@ -144,8 +144,8 @@ Compatibility notes:
 Change Log 2.x
 ==============
 
-Version 2.0.0b17 (2025-05-23)
------------------------------
+Version 2.0.0b18 (not released yet)
+-----------------------------------
 
 Please note:
 
@@ -156,6 +156,43 @@ above.
 
 New features:
 
+- serve: add --permissions option as an alternative to BORG_REPO_PERMISSIONS env var
+- create: auto-exclude items based on xattrs or NODUMP, see #4972
+
+  no options yet, just hardcoded macOS and Linux xattrs.
+  removed the --exclude-nodump option, it is also done automagically now.
+
+  also: create: read stat attrs, xattrs, ACLs early, before file contents.
+
+Other changes:
+
+- refactor the chunkers, #8882 #8883:
+
+  - transform buzhash chunker C code to Cython
+  - split concerns into FileFMAPReader, FileReader, Chunker*:
+
+    - FileFMAPReader reads blocks from the input file, supporting sparse
+      files and fmaps.
+    - FileReader uses FileFMAPReader to fill its buffer and offers clients a
+      `.read(size)` method so they can read pieces of the data.
+    - both chunkers now use the FileReader/FileFMAPReader code
+- ChunkerParams: reject even window size for buzhash, #8868
+- tests / CI:
+
+  - CI: add bandit, a security-oriented static analysis tool
+  - CI: disable windows as the file:// repo URLs are still broken on windows.
+  - tests: tox: use native pyproject.toml configuration
+  - more chunker-related tests
+- docs:
+
+  - fix mistyped CVE number
+
+
+Version 2.0.0b17 (2025-05-23)
+-----------------------------
+
+New features:
+
 - transfer: implement --chunker-params to re-chunk while transferring, #8706
 - list --depth=N: list files up to N depth in path hierarchy, #8268
 - compact: also clean up files cache, #8852