diff --git a/CHANGES.md b/CHANGES.md
index ebf22d864e..c85f09a5af 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,6 @@
-# Unreleased
+# 4.9.0 - 2020-08-04
 
+* Add check for CVE-2020-8166 (Jamie Finnigan)
 * Avoid warning when `safe_yaml` is used via `YAML.load(..., safe: true)`
 * Add check for user input in `ERB.new` (Matt Hickman)
 * Add `--ensure-ignore-notes` (Eli Block)
diff --git a/lib/brakeman/version.rb b/lib/brakeman/version.rb
index d9c3d18f33..647b7d4bf2 100644
--- a/lib/brakeman/version.rb
+++ b/lib/brakeman/version.rb
@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "4.8.2"
+  Version = "4.9.0"
 end