Merge pull request #490 from tumblr/will-collins-2.1.0

Update changelog for 2.1.0 release

CHANGELOG.md

@@ -1,3 +1,22 @@
+# 2.1.0 2016/11/17
+
+Collins 2.1.0 has a very important security patch.
+
+Collins has a feature that allows you to [encrypt certain attributes](http://tumblr.github.io/collins/configuration.html#features) on every asset.  It also had a permission that restricted which users could read those encrypted tags.  It did NOT have a permission that restricted which users could modify encrypted tags.
+
+*It is strongly recommended that you upgrade to collins 2.1.0 if you are using the encrypted tags feature, as well as rotate any values stored in encrypted tags.*
+
+The severity of this vulnerability depends heavily upon how you use collins in your infrastructure.  If you do not use the encrypted tags feature, you are not vulnerable to this problem.  If you do use the encrypted tags feature, you will need to explore your automation and consider how vulnerable you are.
+
+If, for example, your infrastructure has automation that regularly sets the root password on servers to match a value that is in collins, an attacker without the ability to read the current password could set it to a value that they know, wait for the automation to change the password, and then gain root on a server.
+
+This change is backwards compatible with collins v2.0.0, though once you upgrade it will stop any writes to encrypted tags by users that have not been granted `feature.canWriteEncryptedTags` permission.  We have also renamed `feature.canSeePasswords` to `feature.canSeeEncryptedTags`, but collins will continue to respect the value of `feature.canSeePasswords` if `feature.canSeeEncryptedTags` is not set.  Once `feature.canSeeEncryptedTags` is set, collins will ignore the value of `feature.canSeePasswords`.
+
+Full set of changes:
+
+- Ensure that we build only with java 1.7 #473 @Primer42
+- Write encrypted tags permission #486 @Primer42
+
 # 2.0.0 2016/09/19
 
 Collins 2.0.0 is finally released!  As of this release, we will start following semantic versioning (http://semver.org/).  There