add news item for git-annex 5.20140919

doc/news/version_5.20140709.mdwn

@@ -1,11 +0,0 @@
-git-annex 5.20140709 released with [[!toggle text="these changes"]]
-[[!toggleable text="""
-   * Fix race in direct mode merge code that could cause all files in the
-     repository to be removed. It should be able to recover repositories
-     experiencing this bug without data loss. See:
-     http://git-annex.branchable.com/bugs/bad\_merge\_commit\_deleting\_all\_files/
-   * Fix git version that supported --no-gpg-sign.
-   * Fix bug in automatic merge conflict resolution, when one side is an
-     annexed symlink, and the other side is a non-annexed symlink.
-   * Really fix bug that caused the assistant to make many unncessary
-     empty merge commits."""]]

doc/news/version_5.20140919.mdwn

@@ -0,0 +1,16 @@
+git-annex 5.20140919 released with [[!toggle text="these changes"]]
+[[!toggleable text="""
+   * Security fix for S3 and glacier when using embedcreds=yes with
+     encryption=pubkey or encryption=hybrid. CVE-2014-6274
+     The creds embedded in the git repo were *not* encrypted.
+     git-annex enableremote will warn when used on a remote that has
+     this problem. For details, see:
+     https://git-annex.branchable.com/upgrades/insecure\_embedded\_creds/
+   * assistant: Detect when repository has been deleted or moved, and
+     automatically shut down the assistant. Closes: #[761261](http://bugs.debian.org/761261)
+   * Windows: Avoid crashing trying to list gpg secret keys, for gcrypt
+     which is not yet supported on Windows.
+   * WebDav: Fix enableremote crash when the remote already exists.
+     (Bug introduced in version 5.20140817.)
+   * add: In direct mode, adding an annex symlink will check it into git,
+     as was already done in indirect mode."""]]