Update change log for 7.8.5.

Author: hjoliver

CHANGES.md

@@ -14,24 +14,23 @@ Server Side Template Injection (SSTI) where it takes the "source" parameter as
 a template object, renders it, and then returns it. The attacker can exploit it
 with `{{INJECTION COMMANDS}}` in a URI*
 
-- cylc-7 (7.8.x branch, written in Python 2) has a bundled copy of Jinja2 2.10
-that cannot be updated because the new Jinja2 requires Python 3. However **this
-CVE does not impact cylc-7 because Cylc workflow definitions are not web
-pages**.
-- cylc-8 (master branch, Python 3 - not yet released) does not bundle Jinja2,
-  and uses the fixed version 2.10.1.
+cylc-7.8.x (which supports Python 2.6 and 2.7 bundles Jinja2 2.10. But **this
+CVE does not impact cylc-7 because Cylc workflow definitions are not web pages**.
 
--------------------------------------------------------------------------------
-## __cylc-7.8.5 (2019-Q4?)__
+cylc-7.9.x (which requires Python 2.7) bundles Jinja2 2.11.
+
+cylc-8 (master branch, Python 3 - not yet released) uses proper Python package
+management and does not bundle Jinja2.
 
+-------------------------------------------------------------------------------
+## __cylc-7.8.5 (2020-04-22)__
 
 ### Enhancements
 
 [#3349](https://github.com/cylc/cylc-flow/pull/3349) - new command `cylc
 ref-graph` to generate text-format "reference graphs" without PyGTK (back-port
 from Python 3 master for Cylc 8).
 
-
 ## Fixes
 
 [#3514](https://github.com/cylc/cylc-flow/pull/3514) - Fix expanded ids

etc/dev-notes/new-release.md

@@ -9,7 +9,7 @@ If all Issues assigned to the milestone are done:
 - check out the 7.8.x branch locally
 - make sure the test battery passes (Travis CI, and locally at NIWA and Met Office)
 - update `CHANGES.md` for the release and commit (to the 7.8.x branch)
-- tag the new release: `git tag -a x.y.z "Release x.y.z"`
+- tag the new release: `git tag -a -m "Release x.y.z" x.y.z`
 - push (new commit and tag) to the 7.8.x branch of `cylc/cylc-flow`
 - use the GH release page to make a release from the new tag