+# version 4.6.0 (not yet released)
+
+- New configuration options for allowing to require, check or generate file download passwords
+- Re-implemented server side encryption using PHP's `Sodium` extension (the formerly used `mcrypt` extension is deprecated)
+- Keep and show basic download stats
+- Removed Lighttpd's `mod_usertrack` from Docker config
+- Added `<meta name="viewport"…` to template header to support responsive themes
+- Removed usage of deprecated `strftime()` function
+- Few more little fixes
+- Typo and spelling mistakes
+
+New configuration items:
+- `download_password_requirement`, `download_password_gen_len`, `download_password_gen_chars`, `download_password_policy` and `download_password_policy_regex` for configuring file download passwords
+- `admin_ip` for limiting access to the admin interface to certain IP addresses
+- `admin_http_auth_user` is now an array (the possibility to use a string is preserved for backward compatibility)
+