;doc: update changelogs

CHANGES.md

@@ -9,7 +9,7 @@
 General changes in the hledger project (and notable all-package releases).
 For package-specific changes and minor releases, see the hledger package changelogs.
 
-# 2c96e6f1f
+# 53d9455bd
 
 - `make list-commits` and `make showauthors` show those things.
 

hledger-lib/CHANGES.md

@@ -9,7 +9,7 @@
 Internal/api/developer-ish changes in the hledger-lib (and hledger) packages.
 For user-visible changes, see the hledger package changelog.
 
-# 06312c353
+# 53d9455bd
 
 API changes
 

hledger-ui/CHANGES.md

@@ -9,7 +9,7 @@
 User-visible changes in hledger-ui.
 See also the hledger changelog.
 
-# a3cacca71
+# 53d9455bd
 
 Improvements
 

hledger-web/CHANGES.md

@@ -9,7 +9,7 @@ __      _____| |__
 User-visible changes in hledger-web.
 See also the hledger changelog.
 
-# ddeeee604
+# 53d9455bd
 
 Improvements
 
@@ -23,6 +23,15 @@ Improvements
 
 - Require base >=4.11, prevent red squares on Hackage's build matrix.
 
+Fixes
+
+- An XSS (cross-site scripting) vulnerability has been fixed.
+  Previously (since hledger-web 0.24), javascript code could be added 
+  to any autocompleteable field and could be executed automatically 
+  by subsequent visitors viewing the journal.
+  Thanks to Gaspard Baye and Hamidullah Muslih for reporting this vulnerability.
+  (#1525, Arsen Arsenović)
+
 # 1.22.2 2021-08-07
 
 - Use hledger 1.22.2.

hledger/CHANGES.md

@@ -9,7 +9,7 @@
 User-visible changes in the hledger command line tool and library.
 
 
-# 0ce518f12
+# 53d9455bd
 
 Features