diff --git a/CHANGES b/CHANGES
index 90a04e576..f707494cc 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,7 +6,24 @@
 
                                   Changelog
 
+Daniel (4 October 2004)
+- Chris found a race condition resulting in CURLE_COULDNT_RESOLVE_HOST and
+  potential crash, in the windows threaded name resolver code.
+
+Daniel (3 October 2004)
+- Replaced the use of isspace() in cookie.c with our own version instead since
+  we have most data as 'char *' and that makes us pass in negative values if
+  there is 8bit data in the string. Changing to unsigned causes too much
+  warnings or too many required typecasts to the normal string functions.
+  Harshal Pradhan identified this problem.
+
 Daniel (2 October 2004)
+- Bertrand Demiddelaer found a case where libcurl could read already freed
+  data when CURLOPT_VERBOSE is used and a (very) persistent connection. It
+  happened when the dns cache entry for the connection was pruned while the
+  connection was still alive and then again re-used. We worked together on
+  this fix.
+
 - Gisle Vanem provided code that displays an error message when the (libidn
   based) IDN conversion fails. This is really due to a missing suitable
   function in the libidn API that I hope we can remove once libidn gets a
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 05990a883..3286153b4 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -14,10 +14,17 @@ This release includes the following changes:
  o added CURLINFO_OS_ERRNO
  o added CURLOPT_FTPSSLAUTH to allow ftp connects to attempt "AUTH TLS" instead
    before "AUTH SSL"
- o curl_getdate() completely rewritten, which may affect curl -z use cases
+ o curl_getdate() completely rewritten: may affect rare curl -z use cases
 
 This release includes the following bugfixes:
 
+ o a race condition sometimes resulting in CURLE_COULDNT_RESOLVE_HOST in the
+   windows threaded name resolver code
+ o isspace() invokes with negative values in the cookie code
+ o a case of read-already-freed-data when CURLOPT_VERBOSE is used and a (very)
+   persistent connection
+ o now includes descriptive error messages for IDN errors
+ o more forgivning PASS response code check for better working with proftpd
  o curl/multi.h works better included in winsock-using apps
  o curl_easy_reset() no longer enables the progress meter
  o build fix for SSL disabled curl with SSL Engine support present
@@ -27,10 +34,10 @@ This release includes the following bugfixes:
  o connect failures properly stores an error message in the errorbuffer
  o Rare Location:-following problem with bad original URL
  o -F can now add Content-Type on non-file sections
- o double Host: header when following Location: with replaced Host: fixed
- o curl_multi_add_handle() return code fix
+ o double Host: header when following Location: with replaced Host:
+ o curl_multi_add_handle() return code
  o "Proxy-Connection: close" is now understood and properly dealt with
- o curl_getdate() crash fixed
+ o curl_getdate() crash
  o downloading empty files now calls the write callback properly
  o no reverse DNS lookups for ip-only addresses with ipv6-enabled libcurl
  o libcurl works better multi-threaded on AIX (when built with xlc)
@@ -42,6 +49,8 @@ Other curl-related news since the previous public release:
 
  o AdacURL version 7.12.1 http://www.almroth.com/adacurl/index.html
  o pycurl version 7.12.1 http://pycurl.sourceforge.net/
+ o tclcurl version 0.12.1
+   http://personal1.iddeo.es/andresgarci/tclcurl/english/
 
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
@@ -50,6 +59,7 @@ advice from friends like these:
  Jacobsen, Ling Thio, Roman Koifman, Harshal Pradhan, Jonas Forsman, David
  Tarendash, Daniel at touchtunes, Bertrand Demiddelaer, Andreas Rieke,
  Jean-Claude Chauve, Dan Fandrich, Peter Sylvester, "Mekonikum", Jean-Philippe
- Barrette-LaPierre, Günter Knauf, Larry Campbell, Fedor Karpelevitch
+ Barrette-LaPierre, Günter Knauf, Larry Campbell, Fedor Karpelevitch,
+ Aleksandar Milivojevic, Gisle Vanem, Chris "Bob Bob"
 
         Thanks! (and sorry if I forgot to mention someone)
diff --git a/TODO-RELEASE b/TODO-RELEASE
index 11c7d3319..ed1fa415e 100644
--- a/TODO-RELEASE
+++ b/TODO-RELEASE
@@ -3,20 +3,10 @@ Issues not sorted in any particular order.
 To get fixed in 7.12.2 (planned release: mid October 2004)
 ======================
 
-40 - fixed
-
-41 - fixed
-
-42 - Bertrand Demiddelaer's CURLOPT_VERBOSE may read free()ed data patch
-
-43 - Gisle Vanem's IDN strerror patch
-
 44 - Alan Pinstein's SIGPIPE when uploading with CURLOPT_READDATA problem
 
-45 - Chris' suspected race condition in the windows threaded resolver
+To get fixed in 7.12.3 (planned release: December 2004)
+======================
 
-46 - fixed
+47 - Peter Sylvester's patch for SRP on the TLS layer
 
-47 - Peter Sylvester's patch related to the new SRP on the TLS layer
-
-48 - Harshal Pradhan's isspace() fix for 8bit cookie content