diff --git a/ChangeLog b/ChangeLog
index b33ea5d9..559dfaef 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -98,7 +98,7 @@
 	returned structure and are more robust to successive calls. They
 	are implemented with the libc's getxxyyy_r() functions if
 	available.
-	* libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
+	* NEWS, libmisc/limits.c, libmisc/entry.c, libmisc/chowntty.c,
 	libmisc/addgrps.c, libmisc/myname.c, libmisc/rlogin.c,
 	libmisc/pwdcheck.c, src/newgrp.c, src/login_nopam.c, src/login.c,
 	src/userdel.c, src/lastlog.c, src/grpck.c, src/gpasswd.c,
diff --git a/NEWS b/NEWS
index 2bc29cc7..1f6316ce 100644
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,8 @@ shadow-4.0.18.1 -> shadow-4.0.18.2					UNRELEASED
 - userdel: Fix the homedir prefix checking.
 - passwd, usermod: Refuse to unlock an account when it would result in a
   passwordless account.
+- Full review of the usage of getpwnam(), getpwuid(), getgrnam(),
+  getgrgid(), and getspnam(). There should be no functional changes.
 
 *** documentation:
 - Generate the translated manpages from PO at build time.