diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 10709d79f6..0003951687 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -43,5 +43,8 @@
         <cve>CVE-2021-21290</cve>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
+        <cve>CVE-2021-43797</cve>
     </suppress>
 </suppressions>
diff --git a/CHANGES.txt b/CHANGES.txt
index 39a0f64e0b..5580102ad5 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -96,6 +96,14 @@
 Merged from 4.0:
  * Streaming tasks handle empty SSTables correctly (CASSANDRA-16349)
  * Prevent SSTableLoader from doing unnecessary work (CASSANDRA-16349)
+Merged from 3.0:
+ * Suppress inapplicable CVEs (CASSANDRA-17368)
+ * Fix flaky test - test_cqlsh_completion.TestCqlshCompletion (CASSANDRA-17338)
+ * Fixed TestCqlshOutput failing tests (CASSANDRA-17386)
+ * Lazy transaction log replica creation allows incorrect replica content divergence during anticompaction (CASSANDRA-17273)
+ * LeveledCompactionStrategy disk space check improvements (CASSANDRA-17272)
+
+4.0.3
  * Deprecate otc_coalescing_strategy, otc_coalescing_window_us, otc_coalescing_enough_coalesced_messages,
    otc_backlog_expiration_interval_ms (CASSANDRA-17377)
  * Improve start up processing of Incremental Repair information read from system.repairs (CASSANDRA-17342)