Update 2.14 release notes

- Upgrade JGit version

- Mention new requirement on JRE 8

- Mention removal of digest authentication

Change-Id: I52173a3907d01f8c04824c3da58128e69bdde7fa

releases/2.14.md

diff --git a/releases/2.14.md b/releases/2.14.md
index db804d3..d0cd7e8 100644
--- a/releases/2.14.md
+++ b/releases/2.14.md
@@ -21,6 +21,11 @@
   java -jar gerrit.war init -d site_path
 ```
 
+### Java 8
+
+Gerrit now requires Java Runtime Environment (JRE) version 8. It is no longer
+possible to run Gerrit on JRE 7.
+
 ### Bouncy Castle Libraries
 
 The [Bouncy Castle Crypto API libraries](https://www.bouncycastle.org/) are now
@@ -29,6 +34,18 @@
 downloaded Bouncy Castle `.jar` files remaining in the site's `/lib` folder will
 be disabled by appending `.disabled` to the file name.
 
+### HTTP Digest Authentication Removed
+
+Support for HTTP Digest Authentiation is removed.
+
+With the move to NoteDB, the per-account data (including the HTTP password) will
+be stored in a branch in the `All-Users` repo, where it is subject to Gerrit ACLs.
+Since these are notoriously hard to setup correctly, we want to avoid storing the
+password in plaintext.
+
+Existing passwords will be migrated to a hashed password during site initialization
+when upgrading from an earlier version of Gerrit.
+
 ### Deprecation of Velocity Email Templates
 
 This release deprecates the use of Velocity mail templates. In a future release
@@ -155,6 +172,8 @@
 
 * Update JavaEWAH to 1.1.6
 
+* Update JGit to 4.7.0.201704051617-r
+
 * Update jsch to 0.54
 
 * Update Lucene to 5.5.2