diff --git a/src/httpcore2/CHANGELOG.md b/src/httpcore2/CHANGELOG.md
index d4eb2091..6c4f4594 100644
--- a/src/httpcore2/CHANGELOG.md
+++ b/src/httpcore2/CHANGELOG.md
@@ -4,6 +4,17 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.14.0 (October 18th, 2026)
+
+### Fixed
+
+* Keep `CONNECT` and absolute-form proxy targets when the request sets the `target` extension.
+  ([#1262](https://github.com/pydantic/httpx2/pull/1262))
+* Stop blocking reads when an HTTP/2 server lowers `SETTINGS_MAX_CONCURRENT_STREAMS` while requests are in flight.
+  ([#1217](https://github.com/pydantic/httpx2/pull/1217))
+* Raise `WriteError` instead of `anyio.EndOfStream` when writing after the peer closes a TLS connection without `close_notify`.
+  ([#1263](https://github.com/pydantic/httpx2/pull/1263))
+
 ## 2.13.1 (September 23rd, 2026)
 
 ### Fixed
diff --git a/src/httpx2/CHANGELOG.md b/src/httpx2/CHANGELOG.md
index 3c283dbc..985d95d0 100644
--- a/src/httpx2/CHANGELOG.md
+++ b/src/httpx2/CHANGELOG.md
@@ -4,6 +4,31 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.14.0 (October 18th, 2026)
+
+### Added
+
+* Match IP CIDR ranges, like `192.168.0.0/16` and `[fe80::]/10`, in `NO_PROXY` and `mounts`. Requests to any address in the range now bypass the proxy; previously only the network address itself did.
+  ([#1165](https://github.com/pydantic/httpx2/pull/1165))
+* Accept bracketed IPv6 addresses, like `[::1]` and `[::1]:8080`, in `NO_PROXY`.
+  ([#1267](https://github.com/pydantic/httpx2/pull/1267))
+
+### Changed
+
+* Raise `InvalidURL` for a `mounts` key with an IP host followed by anything other than a valid CIDR prefix, like `all://10.0.0.0/33`.
+  ([#1165](https://github.com/pydantic/httpx2/pull/1165))
+
+### Fixed
+
+* Ignore `NO_PROXY` entries that cannot be parsed, instead of raising `InvalidURL` when the client is created.
+  ([#1267](https://github.com/pydantic/httpx2/pull/1267))
+* Import `httpx2` on FIPS-enforced Python builds without `hashlib.md5`. `DigestAuth` raises `ProtocolError` when the server asks for an unavailable algorithm.
+  ([#1130](https://github.com/pydantic/httpx2/pull/1130))
+* Handle reads after an ASGI WebSocket app shuts down, instead of leaking `anyio` exceptions.
+  ([#1233](https://github.com/pydantic/httpx2/pull/1233))
+* Stop the sync WebSocket session from hanging on exit when its event queue is full.
+  ([#1123](https://github.com/pydantic/httpx2/pull/1123))
+
 ## 2.13.1 (September 23rd, 2026)
 
 ### Fixed
diff --git a/tests/httpx2/websockets/test_api.py b/tests/httpx2/websockets/test_api.py
index cd4f8982..98693800 100644
--- a/tests/httpx2/websockets/test_api.py
+++ b/tests/httpx2/websockets/test_api.py
@@ -974,7 +974,7 @@ def wait_for_session_threads(expected: int) -> None:
         for _ in range(100):
             if len(session_threads()) == expected:
                 return
-            time.sleep(0.05)
+            time.sleep(0.05)  # pragma: no cover - only runs if the threads are still exiting
         assert len(session_threads()) == expected  # pragma: no cover
 
     with server_factory(websocket_endpoint) as socket: