v0.32.5

CHANGELOG.md

@@ -3,6 +3,18 @@
 > Operator-facing release history. Historical engineering notes are kept in
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.32.5
+
+- Add bounded DNS/DDNS hostnames as **allow-only** client ACL rules in reusable
+  profiles, host policies, vhosts, locations and Docker ACL assignments.
+- Refresh A/AAAA answers asynchronously every 60 seconds and after config
+  publication; cache immutable, expiring address sets for lock-free request
+  checks. Fail closed on lookup failure and initial unresolved state.
+- Add IP/CIDR vs DNS/DDNS selection in the ACL profile editor and localized
+  operator guidance; preserve the JSON ACL rule format and previous policies.
+- Add DNS ACL validation/regression tests. Cargo and real rotation testing
+  remain required on a Rust-enabled staging host.
+
 ## 0.32.4
 
 - Fix Rust `E0382` in retry construction: clone the upstream URI before