Add RELEASE-NOTES for security patches