move SECURITY before BUGFIXES

Author: 6543

.changelog.yml

@@ -1,44 +1,44 @@
 repo: go-gitea/gitea
 groups:
-  - 
+  -
     name: BREAKING
     labels:
       - kind/breaking
-  - 
+  -
     name: FEATURE
     labels:
       - kind/feature
+  -
+    name: SECURITY
+    labels:
+      - kind/security
   -
     name: BUGFIXES
     labels:
       - kind/bug
-  - 
+  -
     name: ENHANCEMENT
     labels:
       - kind/enhancement
       - kind/refactor
       - kind/ui
   -
-    name: SECURITY
-    labels:
-      - kind/security
-  - 
     name: TESTING
     labels:
       - kind/testing
-  - 
+  -
     name: TRANSLATION
     labels:
       - kind/translation
-  - 
+  -
     name: BUILD
     labels:
       - kind/build
       - kind/lint
-  - 
+  -
     name: DOCS
     labels:
       - kind/docs
-  - 
+  -
     name: MISC
-    default: true
+    default: true

CHANGELOG.md

@@ -5,6 +5,9 @@ without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.io).
 
 ## [1.10.3](https://github.com/go-gitea/gitea/releases/tag/v1.10.3) - 2020-01-17
+* SECURITY
+  * Prevent redirect to Host (#9678) (#9680)
+  * Hide public repos owned by private orgs (#9609) (#9616)
 * BUGFIXES
   * Fix dump non-exist log directory (#9818) (#9820)
   * Fix compare (#9808) (#9815)
@@ -14,9 +17,6 @@ been added to each release, please refer to the [blog](https://blog.gitea.io).
   * Fix cache problem on dashboard (#9358) (#9703)
   * Send tag create and push webhook when release created on UI (#8671) (#9702)
   * Branches not at ref commit ID should not be listed as Merged (#9614) (#9639)
-* SECURITY
-  * Prevent redirect to Host (#9678) (#9680)
-  * Hide public repos owned by private orgs (#9609) (#9616)
 * MISC
   * Never allow an empty password to validate (#9682) (#9684)