diff --git a/.github/workflows/web-api-publish.yml b/.github/workflows/web-api-publish.yml
index fd838e764..276b8ccdc 100644
--- a/.github/workflows/web-api-publish.yml
+++ b/.github/workflows/web-api-publish.yml
@@ -35,8 +35,8 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: update-web-api-client
-          commit-message: "web: Update Web API Client version"
-          title: "web: Update Web API Client version"
-          body: "web: Update Web API Client version"
+          commit-message: "web: bump API Client version"
+          title: "web: bump API Client version"
+          body: "web: bump API Client version"
           delete-branch: true
           signoff: true
diff --git a/SECURITY.md b/SECURITY.md
index 4ddfe4e5b..162c2b4a0 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -8,6 +8,7 @@
 | ---------- | ------------------ |
 | 2022.6.x   | :white_check_mark: |
 | 2022.7.x   | :white_check_mark: |
+| 2022.8.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 
diff --git a/website/docs/releases/v2022.8.md b/website/docs/releases/v2022.8.md
index 49d0f2d16..6ed9ce354 100644
--- a/website/docs/releases/v2022.8.md
+++ b/website/docs/releases/v2022.8.md
@@ -37,16 +37,17 @@ slug: "2022.8"
 -   internal: fix race conditions when accessing settings before bootstrap
 -   internal: walk config in go, check, parse and load from scheme like in python
 -   lifecycle: optimise container lifecycle and process signals (#3332)
--   providers/oauth2: don't separate scopes by comma-space
+-   providers/oauth2: don't separate scopes by comma-space in created events
 -   providers/oauth2: fix scopes without descriptions not being saved in consent
 -   providers/proxy: add caddy endpoint (#3330)
 -   providers/proxy: add is_superuser to ak_proxy object, only show full error when superuser
 -   providers/proxy: no exposed urls (#3151)
 -   root: fix dockerfile for blueprints
+-   sources/oauth: correctly concatenate URLs to allow custom parameters to be passed to authorization server
 -   sources/oauth: only send header authentication for OIDC source
 -   sources/oauth: use mailcow full_name as username for mailcow source (#3299)
 -   stages/\*: use stage-bound logger when possible
--   stages/authentiactor_validate: improve error handling for duo
+-   stages/authenticator_validate: improve error handling for duo
 -   stages/authenticator_duo: fix imported Duo Device not having a name
 -   stages/authenticator_sms: use twilio SDK, improve docs
 -   stages/authenticator_totp: remove single device per user limit