From ead7c496a4bdd0eb8e2282ce982e1292846e7c91 Mon Sep 17 00:00:00 2001
From: Tim Graham <timograham@gmail.com>
Date: Wed, 25 Sep 2013 09:33:29 -0400
Subject: [PATCH] [1.4.x] Added 1.4.9 release notes

Backport of 2eb8f15516 from master
---
 docs/releases/1.4.9.txt | 21 +++++++++++++++++++++
 docs/releases/index.txt |  2 +-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 docs/releases/1.4.9.txt

diff --git a/docs/releases/1.4.9.txt b/docs/releases/1.4.9.txt
new file mode 100644
index 0000000000..de66eb78f8
--- /dev/null
+++ b/docs/releases/1.4.9.txt
@@ -0,0 +1,21 @@
+==========================
+Django 1.4.9 release notes
+==========================
+
+*October 22, 2013*
+
+Django 1.4.9 fixes a security-related bug in the 1.4 series and one other
+data corruption bug.
+
+Readdressed denial-of-service via password hashers
+--------------------------------------------------
+
+Django 1.4.8 imposes a 4096-byte limit on passwords in order to mitigate a
+denial-of-service attack through submission of bogus but extremely large
+passwords. In Django 1.5.5, we've reverted this change and instead improved
+the speed of our PBKDF2 algorithm by not rehashing the key on every iteration.
+
+Bugfixes
+========
+
+* Fixed a data corruption bug with ``datetime_safe.datetime.combine`` (#21256).
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index 56b1155fac..4673b5a302 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -14,12 +14,12 @@ up to and including the new version.
 Final releases
 ==============
 
-
 1.4 release
 -----------
 .. toctree::
    :maxdepth: 1
 
+   1.4.9
    1.4.8
    1.4.7
    1.4.6