Amend 2.16 with release notes for 2.16.1
Change-Id: I9df0941307a08d36d0a2f04dd957aca2647b1708
diff --git a/pages/site/releases/2.16.md b/pages/site/releases/2.16.md
index 91d086c..db96a62 100644
--- a/pages/site/releases/2.16.md
+++ b/pages/site/releases/2.16.md
@@ -6,9 +6,11 @@
toc: true
---
-Download: **[2.16](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.war)**
+Download: **[2.16.1](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.1.war)**
+| [2.16](https://gerrit-releases.storage.googleapis.com/gerrit-2.16.war)
-Documentation: **[2.16](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16/index.html)**
+Documentation: **[2.16.1](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16.1/index.html)**
+| [2.16](https://gerrit-documentation.storage.googleapis.com/Documentation/2.16/index.html)
## Release Highlights
@@ -522,7 +524,11 @@
Fix invalid requests to Elasticsearch.
* [Issue 10021](https://bugs.chromium.org/p/gerrit/issues/detail?id=10021):
-Quote and encode project names in download commands.
+Security - Disallow create project to execute arbitrary code on the client
+by quoting and encoding project names.
+
+* [Issue 10106](https://bugs.chromium.org/p/gerrit/issues/detail?id=10106):
+Documentaiton - REST API for updating project rights amended with correct payload.
* [Issue 10143](https://bugs.chromium.org/p/gerrit/issues/detail?id=10143):
Fix internal server error when running the `kill` command.
@@ -555,12 +561,6 @@
JSON tried to get account IDs of all reviewers. This failed when the
change had any reviewers by email.
-* Use dynamic binding for `UrlFormatter`.
-
- The `UrlFormatter` interface had a fixed binding to its default
- implementation, which meant it was not possible for plugins to
- provide a different implementation as intended.
-
* Do not create index on `account_group_members` table in postgres database.
The `account_group_members` table was deleted, but the postgres
@@ -576,3 +576,16 @@
The assignee field's status showed the change owner's status text.
* Add missing documentation of the 'Read As' capability.
+
+#### Breaking changes
+
+* [Change-Id: I3752456](https://gerrit-review.googlesource.com/c/gerrit/+/205682) Use dynamic binding for `UrlFormatter`.
+
+ The `UrlFormatter` interface had a fixed binding to its default
+ implementation, which meant it was not possible for plugins to
+ provide a different implementation but were merely injecting it
+ when needed
+
+ It is now possible to replace the default implementation using
+ a DynamicItem<UrlFormatter> which requires a change in how it is
+ injected and used in plugins.
