diff --git a/release-notes/9849.md b/release-notes/9849.md
new file mode 100644
index 0000000000..c3c0fd9ee0
--- /dev/null
+++ b/release-notes/9849.md
@@ -0,0 +1,4 @@
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/8885844e72fedc3585a1f42f16c430ab0cbeb90f) prevent commit API from leaking user's hidden email address on valid GPG signed commits
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/449b5bf10e3ba4baf2ef33b535b5e8ba15711838) prevent writing to out-of-repo symlink destinations while evaluating template repos
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/afbf1efe028a33fb79c1af208d28a993db8ca2af) prevent .forgejo/template from being out-of-repo content
+fix: [commit](https://codeberg.org/forgejo/forgejo/commit/fa1a2ba669301238cf3da6a3e746912d76e47f36) return on error if an LFS token cannot be parsed