diff --git a/NEWS b/NEWS
index 2543de124..8706548b5 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,11 @@
+What's new in Sudo 1.8.23
+
+ * PAM account management modules and BSD auto approval modules are
+   now run even when no password is required.
+
+ * The new cvtsudoers utility replaces both the "sudoers2ldif"
+   script and the "visudo -x" functionality.
+
 What's new in Sudo 1.8.22
 
  * Commands run in the background from a script run via sudo will
diff --git a/configure b/configure
index 3cd6b119f..a368b0aeb 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for sudo 1.8.22.
+# Generated by GNU Autoconf 2.69 for sudo 1.8.23.
 #
 # Report bugs to <https://bugzilla.sudo.ws/>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='sudo'
 PACKAGE_TARNAME='sudo'
-PACKAGE_VERSION='1.8.22'
-PACKAGE_STRING='sudo 1.8.22'
+PACKAGE_VERSION='1.8.23'
+PACKAGE_STRING='sudo 1.8.23'
 PACKAGE_BUGREPORT='https://bugzilla.sudo.ws/'
 PACKAGE_URL=''
 
@@ -1539,7 +1539,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures sudo 1.8.22 to adapt to many kinds of systems.
+\`configure' configures sudo 1.8.23 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1604,7 +1604,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of sudo 1.8.22:";;
+     short | recursive ) echo "Configuration of sudo 1.8.23:";;
    esac
   cat <<\_ACEOF
 
@@ -1863,7 +1863,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-sudo configure 1.8.22
+sudo configure 1.8.23
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2572,7 +2572,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by sudo $as_me 1.8.22, which was
+It was created by sudo $as_me 1.8.23, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -26997,7 +26997,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by sudo $as_me 1.8.22, which was
+This file was extended by sudo $as_me 1.8.23, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -27063,7 +27063,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-sudo config.status 1.8.22
+sudo config.status 1.8.23
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index def437a9b..a008d323a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4,7 +4,7 @@ dnl
 dnl Copyright (c) 1994-1996,1998-2017 Todd C. Miller <Todd.Miller@sudo.ws>
 dnl
 AC_PREREQ([2.59])
-AC_INIT([sudo], [1.8.22], [https://bugzilla.sudo.ws/], [sudo])
+AC_INIT([sudo], [1.8.23], [https://bugzilla.sudo.ws/], [sudo])
 AC_CONFIG_HEADER([config.h pathnames.h])
 AC_CONFIG_SRCDIR([src/sudo.c])
 dnl
diff --git a/doc/UPGRADE b/doc/UPGRADE
index b44ffec0b..4789efc48 100644
--- a/doc/UPGRADE
+++ b/doc/UPGRADE
@@ -1,6 +1,28 @@
 Notes on upgrading from an older release
 ========================================
 
+o Upgrading from a version prior to 1.8.23:
+
+    In sudo 1.8.23 the "sudoers2ldif" script and the "visudo -c"
+    functionality has been superseded by the "cvtsudoers" utility.
+    The cvtsudoers utility is intended to be a drop-in replacement
+    for "sudoers2ldif".  Because it uses the same parser as sudo
+    and visudo, cvtsudoers can perform a more accurate conversion
+    than sudoers2ldif could.
+
+    To convert a sudoers file to JSON, the format option must be
+    specified.  For example, instead of:
+
+    visudo -f sudoers_file -x output_file
+
+    one would use:
+
+    cvtsudoers -f json -o output_file sudoers_file
+
+    Note that unlike "visudo -x", "cvtsudoers" reads from the
+    standard input by default.  Also, the base DN may be specified
+    on the command line, if desired, using the -b option.
+
 o Upgrading from a version prior to 1.8.20:
 
     Prior to version 1.8.20, when log_input, log_output or use_pty
@@ -14,7 +36,7 @@ o Upgrading from a version prior to 1.8.20:
     a pipe is only used for the standard input.  Likewise, if
     log_output is set without log_input, a pipe is only used for
     the standard output and standard error.  This results in a
-    noticable change in behavior if the use_pty flag is set and no
+    noticeable change in behavior if the use_pty flag is set and no
     terminal is present when running commands such as scripts that
     execute other commands asynchronously (in the background).
     Previously, sudo would exit immediately, causing background