diff --git a/.hgtags b/.hgtags
--- a/.hgtags
+++ b/.hgtags
@@ -19,3 +19,4 @@ 2be921e01fa24bb102696ada596f87464c3666f6
 7198bdec29c2872c974431d55200d0398354cdb1 v4.7.1
 bd1c8d230fe741c2dfd7100a0ef39fd0774fd581 v4.7.2
 9731914f89765d9628dc4dddc84bc9402aa124c8 v4.8.0
+c5a2b7d0e4bbdebc4a62d7b624befe375207b659 v4.9.0
diff --git a/docs/admin/svn-http.rst b/docs/admin/svn-http.rst
--- a/docs/admin/svn-http.rst
+++ b/docs/admin/svn-http.rst
@@ -15,7 +15,21 @@ Prerequisites
   ``Apache HTTP Server`` and ``mod_dav_svn``.
 
 
-Using Ubuntu 14.04 Distribution as an example execute the following:
+.. tip::
+
+   We recommend using Wandisco repositories which provide latest SVN versions
+   for most platforms. Below is example how to add the wandisco repositories
+   for Ubuntu.
+
+    .. code-block:: bash
+
+        $ sudo sh -c 'echo "deb http://opensource.wandisco.com/ubuntu `lsb_release -cs` svn19" >> /etc/apt/sources.list.d/subversion19.list'
+        $ sudo wget -q http://opensource.wandisco.com/wandisco-debian.gpg -O- | sudo apt-key add -
+        $ sudo apt-get update
+
+
+Using Ubuntu 14.04/16.04 Distribution as an example execute the following to
+install required components:
 
 .. code-block:: bash
 
@@ -67,6 +81,9 @@ 1. To configure Apache, create and edit 
         DocumentRoot /var/www/html
         ErrorLog ${'${APACHE_LOG_DIR}'}/error.log
         CustomLog ${'${APACHE_LOG_DIR}'}/access.log combined
+        LogLevel info
+        # allows custom host names, prevents 400 errors on checkout
+        HttpProtocolOptions Unsafe
         Include /home/user/.rccontrol/enterprise-1/mod_dav_svn.conf
     </VirtualHost>
 
diff --git a/docs/release-notes/release-notes-4.9.0.rst b/docs/release-notes/release-notes-4.9.0.rst
new file mode 100644
--- /dev/null
+++ b/docs/release-notes/release-notes-4.9.0.rst
@@ -0,0 +1,66 @@
+|RCE| 4.9.0 |RNS|
+-----------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2017-08-12
+
+
+New Features
+^^^^^^^^^^^^
+
+
+
+General
+^^^^^^^
+
+- Off cycle Minor release to fix SCM vulnerabilities.
+
+
+Security
+^^^^^^^^
+
+- security(critical): Bumped GIT to 2.9.5 fixes CVE-2017-1000117
+  https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1466490.html
+- security(critical): Bumped SVN to 1.9.7 fixes CVE-2017-9800
+  https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
+- security(critical): Bumped Mercurial to 4.2.3 fixes  CVE-2017-1000116
+  https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.282017-08-10.29
+
+
+Performance
+^^^^^^^^^^^
+
+- Fixed Mercurial Stream support for very large repositories. Due to discovered
+  bug in WebOb library we manage to fix Mercurial stream support.
+  Now cloning very large repos e.g 100GB, ~1mln commits should be much
+  faster, and use less memory.
+
+
+Fixes
+^^^^^
+
+- Fixed problem with default-reviewers in EE package that was missing panel
+  title and in some occasions generate 500 errors.
+- Fixed problem with potential URL generation inside our integration.
+  This was introduced during pyramid porting. We know ensure that proper
+  routing generation is done on all events.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+
+- The 4.9.0 release is an off-cycle release. Due to the fact that we needed to
+  bump Mercurial from 4.1.X to 4.2.X, and Subversion from 1.9.4 to 1.9.7, we
+  released this version not as 4.8.1 security bug fix but 4.9.0.
+  We know historically that SVN and Mercurial can have internal api changes.
+  We tested basic functionality for all 3 vcs-es but due to very short release
+  time we were unable to test everything. Please report any found problems to us
+  and we'll for sure address them.
+
+  Note to SVN users: Please make sure to upgrade mod_dav to 1.9.7 version.
+  At this time we know Wandisco provides 1.9.7 packages for most major distros.
+
+
diff --git a/docs/release-notes/release-notes.rst b/docs/release-notes/release-notes.rst
--- a/docs/release-notes/release-notes.rst
+++ b/docs/release-notes/release-notes.rst
@@ -9,6 +9,7 @@ Release Notes
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.9.0.rst
    release-notes-4.8.0.rst
    release-notes-4.7.2.rst
    release-notes-4.7.1.rst
diff --git a/rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako b/rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako
--- a/rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako
+++ b/rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako
@@ -21,6 +21,9 @@
 #         DocumentRoot /var/www/html
 #         ErrorLog ${'${APACHE_LOG_DIR}'}/error.log
 #         CustomLog ${'${APACHE_LOG_DIR}'}/access.log combined
+#         LogLevel info
+#         # allows custom host names, prevents 400 errors on checkout
+#         HttpProtocolOptions Unsafe
 #         Include /path/to/generated/mod_dav_svn.conf
 #     </VirtualHost>
 #