Update release notes wrt #1585

Author: cowtowncoder

release-notes/CREDITS

@@ -596,6 +596,11 @@ Joshua Jones
    with a non-default constructor and a mutator annotated with `@JsonUnwrapped`
    (2.8.8)
 
+Ivo Studens ([email protected])
+  * Contributed #1585: Invoke ServiceLoader.load() inside of a privileged block
+    when loading modules using `ObjectMapper.findModules()`
+  (2.8.9)
+
 Connor Kuhn (ckuhn@github)
   * Contributed #1341: FAIL_ON_MISSING_EXTERNAL_TYPE_ID_PROPERTY
    (2.9.0)

release-notes/VERSION

@@ -3,6 +3,12 @@ Project: jackson-databind
 === Releases ===
 ------------------------------------------------------------------------
 
+2.8.9 (not yet released)
+
+#1585: Invoke ServiceLoader.load() inside of a privileged block when loading
+  modules using `ObjectMapper.findModules()`
+ (contributed by Ivo S)
+
 2.8.8 (05-Apr-2017)
 
 (partial) #994: `DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS` only works for POJOs, Maps