+ core
    + a formula calling an application Basic function is macro use too [Caolán McNamara]
    + add an advisory setAllowedExtRefPaths [Caolán]
    + add resetAllowedExtRefPaths to reset to the standard mode [Caolán McNamara]
    + an embedded document is not in a trusted location for link updates [Caolán McNamara]
    + apply the same source checks to a data pilot named by url [Caolán McNamara]
    + avmedia: fix MFPlay audio without player window (tdf#169697) [Jonathan Clark]
    + basic: check the PCode record length against the stream too [Caolán McNamara]
    + basic: keep p-code offset conversion within the code buffer [Caolán McNamara]
    + basic: keep the full string pool size in SbiImage [Caolán McNamara]
    + basic: SbiImage::MakeStrings takes a sal_uInt16 count [Caolán McNamara]
    + basic: stop reading user-defined type array dims at end of stream [Caolán McNamara]
    + be consistent for shared scripts permissions [Caolán McNamara]
    + bump product version to 26.2.7.1.0+ [Christian Lohmaier]
    + bump product version to 26.2.7.2 [Christian Lohmaier]
    + cff: byte 255 is reserved in the DICT encoding [Caolán McNamara]
    + cff: stop at the charstring end when reading hintmask and cntrmask bytes [Caolán McNamara]
    + compare trusted locations by their canonical file path [Caolán McNamara]
    + create a new external firebird database when the user names it [Caolán McNamara]
    + curl: upgrade to 8.23.0 [Xisco Fauli]
    + dbaccess: decide the macro execution mode during load [Caolán McNamara]
    + dbaccess: take SystemProperties only from the driver configuration [Caolán McNamara]
    + dbaccess: use trusted location rule for ado connections [Caolán McNamara]
    + dbaccess: use trusted location rule for db-driver options [Caolán McNamara]
    + don't abort on macOS thread IDs larger than UINT32_MAX (tdf#173917) [anthony.kinyon@hotmail.com]
    + don't assert on a cff dict operand that isn't an integer [Caolán McNamara]
    + don't create the document BasicManager on save to check module sizes [Caolán McNamara]
    + don't load the document Basic to parse formula names during ODF import [Caolán McNamara]
    + drawinglayer: compare doubles with epsilon (tdf#173993) [Dan Williams]
    + drawinglayer: Disable CairoSDPR by default (tdf#168910) [Jonathan Clark]
    + drop GraphicProvider's unused private:memorygraphic reader [Caolán McNamara]
    + EPUB export: take popup images only from a media directory the export names [Caolán McNamara]
    + escher export of a linked graphic works from the data it already has [Caolán McNamara]
    + extend the instance metadata check [Caolán McNamara]
    + f'up fix for C2487 on containerHasBasicMacros build failure with mergelib [Christian Lohmaier]
    + factor the data pilot url source check into a shared helper [Caolán McNamara]
    + firebird: make the two cygpath variables immediate assignments [Caolán McNamara]
    + firebird: quote the database path written to databases.conf [Caolán McNamara]
    + fix CppunitTest_tools_test on Windows: exclude test_hostfilter [Mike Kaganski]
    + fix Windows build of sfx2: C2487 on containerHasBasicMacros [Mike Kaganski]
    + freetype: upgrade to 2.15.0 [Xisco Fauli]
    + grey out a dynamic menu entry with a macro: url when macros are disabled [Caolán McNamara]
    + gstreamer: only autoplug demuxers for common self-contained media formats [Caolán McNamara]
    + handle customized bindings of a document like its other content [Caolán McNamara]
    + hsqldb: no text table files for an embedded database [Caolán McNamara]
    + hsqldb: treat an unset hsqldb.method_class_names like an empty one [Caolán McNamara]
    + hwpfilter: end the fixed-size string fields with a zero after reading them [Caolán McNamara]
    + if no glyph for hyphen characters use minus character (tdf#171555) [Patrick Luby]
    + isMacroCallCommand: count documentbaseurl like the other load arguments [Caolán McNamara]
    + isMacroCallCommand: count MacroExecutionMode and UpdateDocMode arguments too [Caolán McNamara]
    + l10ntools: std::size_t -> std::uint64_t [Xisco Fauli]
    + load the Basic project of a VBA mode Calc document after import [Caolán McNamara]
    + lxml: upgrade to 6.1.3 [Xisco Fauli]
    + md import: take a linked image's size from the link update [Caolán McNamara]
    + mysqlc: turn off LOAD DATA LOCAL [Caolán McNamara]
    + nss: upgrade to 3.131.1 [Xisco Fauli]
    + nss: upgrade to 3.132 [Xisco Fauli]
    + only create a form control from a form component service [Caolán McNamara]
    + only take an http or https url from a web query file (tdf#106359) [Caolán McNamara]
    + openldap: upgrade to 2.6.16 [Xisco Fauli]
    + postgresql: limit url keywords outside trusted locations [Caolán McNamara]
    + put refreshing database range imports under the link update control [Caolán McNamara]
    + read an IPv4-mapped IPv6 address as its IPv4 address in the metadata check [Caolán McNamara]
    + reuse INetURLObject::IsExoticProtocol for other binding command schemes [Caolán McNamara]
    + save the document Basic and dialog libraries without the BasicManager [Caolán McNamara]
    + scripting: refuse a script URL with a vnd.sun.star.tdoc location [Caolán McNamara]
    + sd: don't erase end() for a listener that was never added [Caolán McNamara]
    + senddoc: percent-encode the quote and the comma in uri-encode [Caolán McNamara]
    + senddoc: percent-encode the subject and body for the mozilla mailers [Caolán McNamara]
    + sfx2: loadMacro should test IsMacroDisabled too [Caolán McNamara]
    + sfx2: start an embedded object created empty with macros disallowed [Caolán McNamara]
    + sqlite: upgrade to 3.54.0 [Xisco Fauli]
    + sqlite: upgrade to 3.54.1 [Xisco Fauli]
    + start the JVM with an empty hsqldb.method_class_names [Caolán McNamara]
    + svgio: an SVG with no location of its own opens no external images [Caolán McNamara]
    + sw: restore the link update setting after saving with an active OLE object [Caolán McNamara]
    + test getUserAllowsLinkUpdate before every SwapIn in SwGrfNode::ReRead [Caolán McNamara]
    + unochart: Use m_pTableCursor.get() instead of &*m_pTableCursor [Neil Roberts]
    + UnTrustedScript: compare the script URL scheme ignoring case [Caolán McNamara]
    + update credits [Christian Lohmaier]
    + update git submodules [Christian Lohmaier]
    + vcl: only follow protocols that can name a picture file in loadFromURL [Caolán McNamara]
    + version 26.2.7.2, tag libreoffice-26.2.7.2 [Christian Lohmaier]
    + xmlsecurity: add import of `SigningCertificateV2` element [Michael Stahl]
    + xmlsecurity: improve validation performance [Michael Stahl]
    + xmlsecurity: read XAdES SigningCertificate element [Michael Stahl]
+ dictionaries
    + version 26.2.7.2, tag libreoffice-26.2.7.2 [Christian Lohmaier]
+ help
    + version 26.2.7.2, tag libreoffice-26.2.7.2 [Christian Lohmaier]
+ translations
    + update translations for 26.2.7 rc2 [Christian Lohmaier]