From 2f86cc4001a90dcba82599ee074d62bb6c45acec Mon Sep 17 00:00:00 2001
From: Hari <hari.om2@ibm.com>
Date: Wed, 3 Jun 2026 18:27:30 +0530
Subject: [PATCH] chore(release): update changelog and version to 1.15.4
 (#13651)

---
 CHANGELOG.md    | 25 +++++++++++++++++++++++++
 version/VERSION |  2 +-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f14febd18..41e92271c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,30 @@
 # 📦 Changelog
 
+## 1.15.4 (June 3, 2026)
+
+### DEPRECATIONS:
+
+* hcp/sbom: removed Syft binary download and handling from the HCP SBOM provisioner; Syft binary management is now deprecated in favor of the native flow.
+    [GH-13636](https://github.com/hashicorp/packer/pull/13636)
+
+### BUG FIXES:
+
+* security: addressed authorization-bypass related issues by upgrading `go-git` and `golang.org/x/crypto`.
+    [GH-13645](https://github.com/hashicorp/packer/pull/13645)
+* sbom: bump CycloneDX dependency to improve BOM generation handling.
+    [GH-13638](https://github.com/hashicorp/packer/pull/13638)
+
+### DEPENDENCIES:
+
+* deps: bump `github.com/hashicorp/packer-plugin-sdk` to `v0.6.9`.
+    [GH-13640](https://github.com/hashicorp/packer/pull/13640)
+* deps: update `github.com/Azure/go-ntlmssp` to `v0.1.1`.
+    [GH-13622](https://github.com/hashicorp/packer/pull/13622)
+* deps: update `go-git` and `golang.org/x/crypto`.
+    [GH-13645](https://github.com/hashicorp/packer/pull/13645)
+* build/deps: bump GitHub Actions dependencies group (7 updates).
+    [GH-13649](https://github.com/hashicorp/packer/pull/13649)
+
 ## 1.15.3 (April 27, 2026)
 
 ### BUG FIXES:
diff --git a/version/VERSION b/version/VERSION
index f2380cc7a..e34208c93 100644
--- a/version/VERSION
+++ b/version/VERSION
@@ -1 +1 @@
-1.15.3
+1.15.4