diff --git a/cmd/version.go b/cmd/version.go
index e2190834..57a46025 100644
--- a/cmd/version.go
+++ b/cmd/version.go
@@ -11,7 +11,7 @@ var (
 	GitDescribe string
 
 	// Version is main version number that is being run at the moment.
-	Version = "v4.48.2"
+	Version = "v4.49.1"
 
 	// VersionPrerelease is a pre-release marker for the version. If this is "" (empty string)
 	// then it means that it is a final release. Otherwise, this is a pre-release
diff --git a/release_notes.txt b/release_notes.txt
index 4762af7f..32e9da07 100644
--- a/release_notes.txt
+++ b/release_notes.txt
@@ -1,3 +1,8 @@
+4.49.1:
+  - Added `--security` flags to disable env and file ops #2515
+  - Fixing TOML ArrayTable parsing issues #1758
+  - Fixing parsing of escaped characters #2506
+
 4.48.2:
   - Strip whitespace when decoding base64 #2507
   - Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
index cdb72893..fc080f15 100644
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -1,5 +1,5 @@
 name: yq
-version: 'v4.48.2'
+version: 'v4.49.1'
 summary: A lightweight and portable command-line data file processor
 description: |
   `yq` uses [jq](https://github.com/stedolan/jq) like syntax but works with yaml, json, xml, csv, properties and TOML files.
@@ -27,6 +27,6 @@ parts:
     build-environment:
       - CGO_ENABLED: 0
     source: https://github.com/mikefarah/yq.git
-    source-tag: v4.48.2
+    source-tag: v4.49.1
     build-snaps:
       - go/latest/stable