@@ -1,3 +1,11 @@
4+* If servers use the `BasicAuth` combinator and receive requests with missing or
5+ invalid credentials, the resulting error responses (401 and 403) could be
6+ overwritten by subsequent alternative routes. Now `BasicAuth` uses `FailFatal`
7+ and the error responses can't be overwritten anymore.