anchor.diff:    have been hashed with `bcrypt` and are not affected.
   
   .enhancements
  -
   * TLS 1.2 is now the default protocol.
   * Clients that do not support pre-emptive basic authentication can now support both anonymous and authenticated access
     by specifying the `shield.authc.anonymous.authz_exception` <<anonymous-access,setting>> with a value of `false`.
   * Reduced logging for common SSL exceptions, such as a client closing the connection during a handshake.
   
   .bug fixes
  -
   * The `esusers` and `syskeygen` tools now work correctly with environment variables in the RPM and DEB installation
     environment files `/etc/sysconfig/elasticsearch` and `/etc/default/elasticsearch`.
   * Default ciphers no longer include `TLS_DHE_RSA_WITH_AES_128_CBC_SHA`.
  
positive.code: [float]
  ==== 1.2.3
  
  * Fixes <<enable-message-authentication,message authentication>> serialization to work with Shield 1.2.1 and earlier.
  ** NOTE: if you are upgrading from Shield 1.2.2 a {ref}/setup-upgrade.html#restart-upgrade[cluster restart upgrade]
  will be necessary. When upgrading from other versions of Shield, follow the normal <<upgrade-instructions,upgrade procedure>>.
  
negative.code: [float]
  ==== 1.0.2
  
  .bug fixes
  * Filter out sensitive settings from the settings APIs
  * Significant memory footprint reduction of internal data structures
  
  [float]
  ==== 1.0.1
  
  .bug fixes
  * Fixed dependency issues with Elasticsearch 1.4.3 and (Lucene 4.10.3 that comes with it)
  * Fixed bug in how user roles were handled. When multiple roles were defined for a user, and one of the
    roles only had cluster permissions, not all privileges were properly evaluated.
  