diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc3fa411f8..f4cd341b71 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 0.28.1 (6th December, 2024)
+
+* Fix SSL case where `verify=False` together with client side certificates.
+ 
 ## 0.28.0 (28th November, 2024)
 
 The 0.28 release includes a limited set of deprecations.
@@ -28,6 +32,7 @@ Our revised [SSL documentation](docs/advanced/ssl.md) covers how to implement th
 * Ensure `certifi` and `httpcore` are only imported if required. (#3377)
 * Treat `socks5h` as a valid proxy scheme. (#3178)
 * Cleanup `Request()` method signature in line with `client.request()` and `httpx.request()`. (#3378)
+* Bugfix: When passing `params={}`, always strictly update rather than merge with an existing querystring. (#3364)
 
 ## 0.27.2 (27th August, 2024)
 
diff --git a/httpx/__version__.py b/httpx/__version__.py
index 0a684ac3a9..801bfacf67 100644
--- a/httpx/__version__.py
+++ b/httpx/__version__.py
@@ -1,3 +1,3 @@
 __title__ = "httpx"
 __description__ = "A next generation HTTP client, for Python 3."
-__version__ = "0.28.0"
+__version__ = "0.28.1"
diff --git a/httpx/_client.py b/httpx/_client.py
index 018d440c17..2249231f8c 100644
--- a/httpx/_client.py
+++ b/httpx/_client.py
@@ -620,8 +620,6 @@ class Client(BaseClient):
     * **http2** - *(optional)* A boolean indicating if HTTP/2 support should be
     enabled. Defaults to `False`.
     * **proxy** - *(optional)* A proxy URL where all the traffic should be routed.
-    * **proxies** - *(optional)* A dictionary mapping proxy keys to proxy
-    URLs.
     * **timeout** - *(optional)* The timeout configuration to use when sending
     requests.
     * **limits** - *(optional)* The limits configuration to use.
diff --git a/httpx/_config.py b/httpx/_config.py
index dbd2b46cd1..467a6c90ae 100644
--- a/httpx/_config.py
+++ b/httpx/_config.py
@@ -39,10 +39,9 @@ def create_ssl_context(
             # Default case...
             ctx = ssl.create_default_context(cafile=certifi.where())
     elif verify is False:
-        ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-        ssl_context.check_hostname = False
-        ssl_context.verify_mode = ssl.CERT_NONE
-        return ssl_context
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
     elif isinstance(verify, str):  # pragma: nocover
         message = (
             "`verify=<str>` is deprecated. "
diff --git a/requirements.txt b/requirements.txt
index 53fd0a6c25..0d8ba2eff0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -11,19 +11,20 @@ chardet==5.2.0
 # Documentation
 mkdocs==1.6.1
 mkautodoc==0.2.0
-mkdocs-material==9.5.39
+mkdocs-material==9.5.47
 
 # Packaging
-build==1.2.2
-twine==5.1.1
+build==1.2.2.post1
+twine==6.0.1
 
 # Tests & Linting
 coverage[toml]==7.6.1
-cryptography==43.0.1
-mypy==1.11.2
-pytest==8.3.3
-ruff==0.6.8
-trio==0.26.2
+cryptography==44.0.0
+mypy==1.13.0
+pytest==8.3.4
+ruff==0.8.1
+trio==0.27.0
 trio-typing==0.10.0
-trustme==1.1.0
-uvicorn==0.31.0
+trustme==1.1.0; python_version < '3.9'
+trustme==1.2.0; python_version >= '3.9'
+uvicorn==0.32.1
diff --git a/tests/models/test_requests.py b/tests/models/test_requests.py
index d2a458d57e..b31fe007be 100644
--- a/tests/models/test_requests.py
+++ b/tests/models/test_requests.py
@@ -226,3 +226,16 @@ def content() -> typing.Iterator[bytes]:
     request.read()
     pickle_request = pickle.loads(pickle.dumps(request))
     assert pickle_request.content == b"test 123"
+
+
+def test_request_params():
+    request = httpx.Request("GET", "http://example.com", params={})
+    assert str(request.url) == "http://example.com"
+
+    request = httpx.Request(
+        "GET", "http://example.com?c=3", params={"a": "1", "b": "2"}
+    )
+    assert str(request.url) == "http://example.com?a=1&b=2"
+
+    request = httpx.Request("GET", "http://example.com?a=1", params={})
+    assert str(request.url) == "http://example.com"