Summarized Changelog:
- Fix a bug which caused decoding a certificate which contained more than one name in a single RDN
- Fix a bug which caused OID lookup failures when run in a locale which uses thousands separators
- DNS names in name constraints were compared with case sensitivity, which could cause valid certificates to be rejected
- X.509 name constraint extensions were rejected if non-critical
- X.509 name constraints were incorrectly applied to the certificate which included the constraint
Full changelog available here.