Add release notes

.release-notes/4588.md

@@ -0,0 +1,23 @@
+## Fix soundness problem with matching iso variables
+
+We previously switched our underlying type system model. In the process, a
+soundness hole was introduced. The following code that should not compile was accepted by the compiler:
+
+```pony
+class Bad
+  let _s: String iso
+
+  new iso create(s: String iso) =>
+    _s = consume s
+
+  fun ref take(): String iso^ =>
+    match _s
+    | let s': String iso => consume s'
+    end
+```
+
+The code should not compile because `let s': String iso` is aliasing `_s` an iso field. Consuming an aliases iso shouldn't return an iso^.
+
+The take-away is that "very bad things could happen" and the data race freedom guarantees of the Pony compiler were being violated.
+
+We've close the soundness hole. We recommend all Pony users update to the this release as soon as possible.