Update package.xml for next release

package.xml

@@ -32,10 +32,10 @@ Also Lzma2 compressed archives are supported with xz extension.</description>
   <email>stig@php.net</email>
   <active>no</active>
  </helper>
- <date>2020-09-15</date>
- <time>14:03:45</time>
+ <date>2020-11-19</date>
+ <time>22:06:48</time>
  <version>
-  <release>1.4.10</release>
+  <release>1.4.11</release>
   <api>1.4.0</api>
  </version>
  <stability>
@@ -44,8 +44,8 @@ Also Lzma2 compressed archives are supported with xz extension.</description>
  </stability>
  <license uri="http://www.opensource.org/licenses/bsd-license.php">New BSD License</license>
  <notes>
-* Fix block padding when the file buffer length is a multiple of 512 and smaller than Archive_Tar buffer length
-* Don't try to copy username/groupname in chroot jail
+* Fix Bug #27002: Filename manipulation vulnerabilities (CVE-2020-28948 /
+   CVE-2020-28949) [mrook]
  </notes>
  <contents>
   <dir name="/">
@@ -75,6 +75,22 @@ Also Lzma2 compressed archives are supported with xz extension.</description>
  </dependencies>
  <phprelease />
  <changelog>
+   <release>
+    <version>
+     <release>1.4.10</release>
+     <api>1.4.0</api>
+    </version>
+    <stability>
+     <release>stable</release>
+     <api>stable</api>
+    </stability>
+    <date>2020-09-15</date>
+    <license uri="http://www.opensource.org/licenses/bsd-license.php">New BSD License</license>
+    <notes>
+ * Fix block padding when the file buffer length is a multiple of 512 and smaller than Archive_Tar buffer length
+ * Don&apos;t try to copy username/groupname in chroot jail
+    </notes>
+  </release>
   <release>
    <version>
     <release>1.4.9</release>