update release notes

cowtowncoder · cowtowncoder · commit d6e315975153 · 2020-10-22T17:19:00.000-07:00
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
@@ -6,6 +6,8 @@ Project: jackson-databind
 
 2.9.10.7 (not yet released)
 
+#2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
+  external entity expansion in all cases [CVE-2020-25649]
 #2854: Block one more gadget type (javax.swing, CVE-2020-xxx)
  (reported by Yangkun(ICSL))
 
