+PH/02 There are now 20 of each type of ACL variable by default (instead of 10).
+ It is also possible to change the numbers by setting ACL_CVARS and/or
+ ACL_MVARS in Local/Makefile. Backward compatibility is maintained if you
+ upgrade to this release with existing messages containing ACL variable
+ settings on the queue. However, going in the other direction
+ (downgrading) will not be compatible; the values of ACL variables will be
+ lost.
+
+PH/03 If quota_warn_message contains a From: header, Exim now refrains from
+ adding the default one. Similarly, if it contains a Reply-To: header, the
+ errors_reply_to option, if set, is not used.
+
+PH/04 The variables $auth1, $auth2, $auth3 are now available in authenticators,
+ containing the same values as $1, $2, $3. The new variables are provided
+ because the numerical variables can be reset during string expansions
+ (for example, during a "match" operation) and so may lose the
+ authentication data. The preferred variables are now the new ones, with
+ the use of the numerical ones being deprecated, though the support will
+ not be removed, at least, not for a long time.
+
+PH/05 The "control=freeze" ACL modifier can now be followed by /no_tell. If
+ the global option freeze_tell is set, it is ignored for the current
+ message (that is, nobody is told about the freezing), provided all the
+ "control=freeze" modifiers that are obeyed in the current message have
+ the /no_tell option.
+
+PH/06 In both GnuTLS and OpenSSL, an expansion of tls_privatekey that results
+ in an empty string is now treated as unset.
+
+PH/07 There is a new log selector called sender_verify_fail, which is set by
+ default. If it is unset, the separate log line that gives details of a
+ sender verification failure is not written. Log lines for the rejection
+ of SMTP commands (e.g. RCPT) contain just "sender verify failed", so some
+ detail is lost.
+
+PH/08 The default for dns_check_names_pattern now allows slashes within names,
+ as there are now some PTR records that contain slashes. This check is
+ only to protect against broken name servers that fall over on strange
+ characters, so the fact that it applies to all lookups doesn't matter.
+
+PH/09 The default for rfc4131_query_timeout has been changed from 30s to 5s.
+
+PH/10 When compiled on FreeBSD, NetBSD, or BSD/OS, the pipe transport has a new
+ Boolean option called use_classresources, defaulting false. If it is set
+ true, the setclassresources() function is used to set resource limits
+ when a pipe transport is run to perform a delivery. The limits for the
+ uid under which the pipe is to run are obtained from the login class
+ database.
+