diff --git a/AppAuth.podspec b/AppAuth.podspec
index d7590d2dd..a33624c35 100644
--- a/AppAuth.podspec
+++ b/AppAuth.podspec
@@ -1,7 +1,7 @@
 Pod::Spec.new do |s|
 
   s.name         = "AppAuth"
-  s.version      = "2.1.0"
+  s.version      = "3.0.0"
   s.summary      = "AppAuth for iOS and macOS is a client SDK for communicating with OAuth 2.0 and OpenID Connect providers."
 
   s.description  = <<-DESC
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7ffa3aa3..00ee98e6a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,12 +1,13 @@
-# UNRELEASED
-- BREAKING: Updates made to support Xcode 27.
+# 3.0.0
+- BREAKING: Updates made to support Xcode 27. ([#972](https://github.com/openid/AppAuth-iOS/pull/972), [#973](https://github.com/openid/AppAuth-iOS/pull/973))
 -- Raised minimum deployment targets to iOS 15.0, macOS 12.0, tvOS 15.0 and watchOS 9.0 (minimum for Xcode 27).
 -- Swift Package Manager users: The required `swift-tools-version` bump from 5.3 to 5.7, to pickup the new platforms,
 	results in package resolution now requiring Swift 5.7 / Xcode 14 or later.
 -- Projects that must keep supporting iOS 12-14 should stay on AppAuth 2.x, which remains buildable with Xcode 26 and earlier.
-- BREAKING: `resumeExternalUserAgentFlowWithURL:error:` is now required in `OIDExternalUserAgentSession` to fix a Swift compiler crash (no workaround) caused by its `@optional` status with `NSError **`. Implementers must now provide this method. Affects projects since 2.1.0. ([#955](https://github.com/openid/AppAuth-iOS/pull/955))
-- Swift callers now spell the method `resumeExternalUserAgentFlow(_:)`. Since the method is no longer optional, you don't need optional-chaining anymore. For those migrating from 2.1.0, replace `try session.resumeExternalUserAgentFlow?(with: url)` with `try session.resumeExternalUserAgentFlow(url)`. Objective-C callers are unaffected. ([#966](https://github.com/openid/AppAuth-iOS/pull/966))
+- BREAKING: `resumeExternalUserAgentFlowWithURL:error:` is now required in `OIDExternalUserAgentSession` to fix a Swift compiler crash (no workaround) caused by its `@optional` status with `NSError **`. Implementers must now provide this method. Affects projects since 2.1.0. ([#955](https://github.com/openid/AppAuth-iOS/pull/955), [#970](https://github.com/openid/AppAuth-iOS/pull/970))
+- Swift callers now spell the method `resumeExternalUserAgentFlow(_:)`. Since the method is no longer optional, you don't need optional-chaining anymore. For those migrating from 2.1.0, replace `try session.resumeExternalUserAgentFlow?(with: url)` with `try session.resumeExternalUserAgentFlow(url)`. Objective-C callers are unaffected. ([#966](https://github.com/openid/AppAuth-iOS/pull/966), [#970](https://github.com/openid/AppAuth-iOS/pull/970))
 - Replace case range with explicit case labels in OIDTokenUtilities. Addresses issue #947. ([#963](https://github.com/openid/AppAuth-iOS/pull/963))
+- Update the `addressable` gem to address CVE-2026-35611. Addresses issue #958. ([#965](https://github.com/openid/AppAuth-iOS/pull/965))
 
 # 2.1.0
 - Add SwiftUI + Swift Package Manager sample app under `Examples/Example-iOS_Swift-SPM`. ([#952](https://github.com/openid/AppAuth-iOS/pull/952))