Update release notes wrt micro-patches
@@ -14,10 +14,28 @@ JSON library.
=== Releases ===
------------------------------------------------------------------------
-2.7.10 (not yet released)
+2.7.9.4 (not yet released)
#354: Buffer size dependency in UTF8JsonGenerator writeRaw
+2.7.9.3:
+
+#1872: NullPointerException in SubTypeValidator.validateSubType when
+ validating Spring interface
+#1931: Two more c3p0 gadgets to exploit default typing issue
+
+2.7.9.2 (20-Dec-2017)
+
+#1607: `@JsonIdentityReference` not used when setup on class only
+#1628: Don't print to error stream about failure to load JDK 7 types
+#1680: Blacklist couple more types for deserialization
+#1737: Block more JDK types from polymorphic deserialization
+#1855: Blacklist for more serialization gadgets (dbcp/tomcat, spring)
+
+2.7.9.1 (18-Apr-2017)
+
+#1599: Jackson Deserializer security vulnerability
+
2.7.9 (04-Feb-2017)
No changes since 2.7.8
