DOC Add additional info to 4.9.0 changelog

docs/en/04_Changelogs/4.9.0.md

@@ -2,13 +2,29 @@
 
 ## Overview
 
+- [Security audit and regression test](#audit)
+- [For development teams of Common Web Platform projects](#cwp-end)
 - [Features and enhancements](#features-and-enhancements)
     - [Image lazy loading](#image-lazy-loading)
     - [Manage your CMS sessions across devices](#session-manager)
     - [Default mail transport upgraded to sendmail](#sendmail)
+    - [Support for silverstripe/graphql v4](#graphqlv4)
     - [Other new features](#other-features)
 - [Bugfixes](#bugfixes)
 
+## Security audit and regression test{#audit}
+
+This release has gone through a regression test suite to identify any possible instability between modules.
+
+The release has also been audited by an independant security firm to identify possible security regressions.
+
+Review the [security audit report](INSERT-LINK-TO-AUDIT).
+
+## For development teams of Common Web Platform projects{#cwp-end}
+
+This release marks the first release for Common Web Platform projects to eject out of managing projects in the CWP 2.x version line and to begin following the standard CMS 4.x version line, by adopting the CMS Recipe.
+
+More information and guidance on how to manage your project composer.json file will be published as part of the CMS 4.9.0 stable release and supporting documentation.
 
 ## Features and enhancements {#features-and-enhancements}
 
@@ -89,6 +105,16 @@ Installations of Silverstripe CMS setup using silverstripe/installer 4.9.0 or gr
 
 It's highly recommended that existing Silverstripe CMS installation still using `Swift_MailTransport` upgrade to using `Swift_SendmailTransport` or another available transport, such as `Swift_SmtpTransport`. Details on how to use these classes are available in the [email section](https://docs.silverstripe.org/en/4/developer_guides/email/) of the developer docs.
 
+### Support for silverstripe/graphql v4 {#graphqlv4}
+
+The Silverstripe CMS 4.8.0 release added support for the experimental `silverstripe/graphql` v4 module. We made it easier for early adopters to run `silverstripe/graphql` v4 in this release:
+
+- Upgrade to the Silverstripe CMS 4.9.0 release.
+- Confirm your project `composer.json` file has a `"minimum-stability": "dev"` key.
+- Explicitely require `silverstripe/graphql` v4 by running `composer require silverstripe/graphql:^4`
+
+You don't need to inline any recipes anymore.
+
 ### Other new features
 
 * [Dot notation support in form fields](https://github.com/silverstripe/silverstripe-framework/pull/9192): Save directly into nested has_one relationships (see [docs](/developer_guides/forms/how_tos/handle_nested_data)).