diff --git a/ChangeLog b/ChangeLog
index be4f0d1a..921d5a13 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,10 +18,19 @@ ver. 1.1.2-dev-1 (20??/??/??) - development nightly edition
 * `paths-*.conf`: add default banactions for several includes depending on default net-filter for distribution (gh-4224, gh-4229):
   `paths-arch.conf`, `paths-fedora.conf`, `paths-opensuse.conf` - nftables, `paths-freebsd.conf`, `paths-osx.conf ` - pf;
 
+### Deprecations
+* `action.d/xarf-login-attack.conf` - deprecated (emits obsolete x-arf 0.2);
+  superseded by the `xarf` action (XARF v4). Will be removed in a future release (gh-3820)
+
 ### New Features and Enhancements
 * `filter.d/cowrie.conf` - new filter and jail for Cowrie SSH/Telnet honeypot JSON log output (gh-4216)
 * `filter.d/gitlab.conf` - `logtype` option `json` adding support for the `application_json.log` format that
   superseded the deprecated `application.log`; default type `file` keeps the previous behaviour (gh-3566, gh-4230)
+* `action.d/xarf.py` - new action reporting login attacks as XARF v4
+  (https://xarf.org) by e-mail to the IP's abuse contact (resolved via the
+  Abusix Contact DB). Uses the optional `xarf` python package for schema
+  validation when installed, otherwise a built-in stdlib generator. Enable
+  via `action_xarf_v4` in jail.conf (gh-3820)
 
 
 ver. 1.1.1 (2026/08/15) - triple-one-win
@@ -101,10 +110,6 @@ ver. 1.1.1 (2026/08/15) - triple-one-win
 * `filter.d/vsftpd.conf` - fixed regex (if failures generated by systemd-journal, gh-3954)
 * `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075).
 
-### Deprecations
-* `action.d/xarf-login-attack.conf` - deprecated (emits obsolete x-arf 0.2);
-  superseded by the `xarf` action (XARF v4). Will be removed in a future release (gh-3820)
-
 ### New Features and Enhancements
 * `fail2ban-server` supports `systemd` socket activation (`sd_listen_fds(3)`); optional `fail2ban.socket` unit provided
 * backend `systemd` extended with new parameter `rotated` (default `false`, as prevention against "too many open files"),
@@ -148,11 +153,6 @@ ver. 1.1.1 (2026/08/15) - triple-one-win
 * `filter.d/vaultwarden.conf` - new filter and jail for Vaultwarden (gh-3979)
 * `filter.d/xrdp.conf` - new filter for XRDP, an open source RDP server (gh-3254)
 * `fail2ban-regex` extended with new option `-i` or `--invert` to output not-matched lines by `-o` or `--out` (gh-4001)
-* `action.d/xarf.py` - new action reporting login attacks as XARF v4
-  (https://xarf.org) by e-mail to the IP's abuse contact (resolved via the
-  Abusix Contact DB). Uses the optional `xarf` python package for schema
-  validation when installed, otherwise a built-in stdlib generator. Enable
-  via `action_xarf_v4` in jail.conf (gh-3820)
 
 
 ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km
diff --git a/fail2ban/tests/servertestcase.py b/fail2ban/tests/servertestcase.py
index 55b946bf..fefb5bf7 100644
--- a/fail2ban/tests/servertestcase.py
+++ b/fail2ban/tests/servertestcase.py
@@ -2411,4 +2411,3 @@ class ServerConfigReaderTests(LogCaptureTestCase):
 					ticket = _actions.Actions.ActionInfo(ticket, dmyjail)
 					action.ban(ticket)
 					self.assertLogged(*tests[test], all=True)
-