Update release notes wrt fix for #90 (by #87)

Author: cowtowncoder

datetime/src/main/java/com/fasterxml/jackson/datatype/jsr310/DecimalUtils.java

@@ -23,16 +23,13 @@
  * Utilities to aid in the translation of decimal types to/from multiple parts.
  *
  * @author Nick Williams
- * @since 2.2.0
+ * @since 2.2
  */
 public final class DecimalUtils
 {
     private static final BigDecimal ONE_BILLION = new BigDecimal(1_000_000_000L);
 
-    private DecimalUtils()
-    {
-        throw new RuntimeException("DecimalUtils cannot be instantiated.");
-    }
+    private DecimalUtils() { }
 
     public static String toDecimal(long seconds, int nanoseconds)
     {

release-notes/CREDITS-2.x

@@ -38,5 +38,14 @@ Sonny Gill (sonnygill@github)
    (2.9.6)
 
 Adrian Palanques (devdevx@github)
-  #78: Year deserialization ignores `@JsonFormat` pattern
+  * Reported #78: (datetime) Year deserialization ignores `@JsonFormat` pattern
    (2.9.7)
+
+Andriy Plokhotnyuk (plokhotnyuk@github)
+  * Reported #90 (datetime): Performance issue with malicious `BigDecimal` input,
+   `InstantDeserializer`, `DurationDeserializer`
+   (2.9.8)
+
+Todd Jonker (toddjonker@github)
+  * Contributed fix for #90 (see above)
+   (2.9.8)

release-notes/VERSION-2.x

@@ -8,6 +8,12 @@ Modules:
 === Releases ===
 ------------------------------------------------------------------------
 
+2.9.8 (not yet released)
+
+#90 (datetime): Performance issue with malicious `BigDecimal` input,
+   `InstantDeserializer`, `DurationDeserializer`
+ (reported by Andriy P, fix contributed by Todd J)
+
 2.9.7 (19-Sep-2018)
 
 #78: Year deserialization ignores `@JsonFormat` pattern