3.13.0

 * Fix OWNER role to handle multiple relations (pierreclr)
 * Fix acl.resolvePermission for wildcard req (Farid Neshat)
 * CODEOWNERS: add zbarbuto (Miroslav Bajtoš)

3.12.0

 * Fix relation race condition in model glob (Zak Barbuto)
 * CODEOWNERS: add lehni (Miroslav Bajtoš)

3.11.1

 * Handle missing getUpdateOnlyProperties fn (Kevin Delisle)

3.11.0

 * Support createOnlyInstance in model (strongloop#3548) (Rashmi Hunt)
 * Add stalebot configuration (Kevin Delisle)
 * Catch errors on invalidate update (loay)
 * Update Issue and PR Templates (strongloop#3568) (Sakib Hasan)

3.10.1

 * fix(validatePassword): reword error message (Samuel Reed)
 * Do not add isStatic properties to method settings (Jürg Lehni)

3.10.0

 * Allow glob-style patterns for remote options (Zak Barbuto)
 * Fix case of values per doc issue (crandmck)
 * Update translated strings Q3 2017 (Allen Boone)
 * Revert "Validate on updateAll" (Sakib Hasan)
 * Add tests of HTTP normalization on app level (Jürg Lehni)
 * travis: drop Node.js 7.x, add 8.x (Miroslav Bajtoš)
 * Validate on updateAll (ssh24)
 * Update juggler version (loay)
 * update messages.json (Diana Lau)
 * small fix for the title (Michael Alaev)
 * Changed http to https (Michael Alaev)
 * Update Travis registry (loay)
 * Add unit test for empty password (loay)
 * Add CODEOWNER file (Diana Lau)

3.9.0

 * Remove observers from Model on end of the stream (Alexei Smirnov)
 * Fix Model#settings.acls doc type signature (Farid Nouri Neshat)
 * Use `localhost` instead of `::` for local (Daijiro Wachi)
 * Fix API doc for Model class property type (Candy)
 * Update package.json (sqlwwx)
 * Support remoting adapters with no ctx.req object (Piero Maltese)
 * update strong-error-handler (sqlwwx)

3.8.0

 * Refactor access token to make it extensible (Raymond Feng)

3.7.0

 * Remote method /user/:id/verify (ebarault)
 * Implement more secure password flow (Miroslav Bajtoš)
 * Add User.setPassword(id, new, cb) (Miroslav Bajtoš)
 * Fix method setup in authorization-scopes.test (Miroslav Bajtoš)
 * Add missing tests for reset password flow (Miroslav Bajtoš)
 * forwarding context options in user.verify (ebarault)
 * update deprecated dependencies (Diana Lau)
 * Add support for scoped access tokens (Miroslav Bajtoš)
 * Fix user-literal rewrite for anonymous requests (Aaron Buchanan)

2.38.3

 * use lower version of karma-browserify (Diana Lau)
 * update karma-browserify to 5.x (Diana Lau)
 * update translation msg (Diana Lau)
 * Fix user-literal rewrite for anonymous requests (Aaron Buchanan)
 * Forward options in prepareForTokenInvalidation (Miroslav Bajtoš)