diff --git a/CHANGES b/CHANGES
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,14 @@
 User-visible changes in hledger-api. See also hledger, hledger-lib.
 
 
+# 1.9 (2018/3/31)
+
+* support ghc 8.4, latest deps
+
+* when the system text encoding is UTF-8, ignore any UTF-8 BOM prefix
+  found when reading files
+
+
 # 1.5 (2017/12/31)
 
 * remove upper bounds on all but hledger* and base (experimental)
diff --git a/hledger-api.1 b/hledger-api.1
--- a/hledger-api.1
+++ b/hledger-api.1
@@ -1,5 +1,5 @@
 
-.TH "hledger\-api" "1" "December 2017" "hledger\-api 1.5" "hledger User Manuals"
+.TH "hledger\-api" "1" "March 2018" "hledger\-api 1.9" "hledger User Manuals"
 
 
 
@@ -35,13 +35,34 @@
 requests, by default.
 You can change this with \f[C]\-\-host\f[], eg
 \f[C]\-\-host\ 0.0.0.0\f[] to listen on all addresses.
-Note there is no other access control, so you will need to hide
-hledger\-api behind an authenticating proxy if you want to restrict
-access.
-You can change the TCP port (default: 8001) with \f[C]\-p\ PORT\f[].
+Note there is no other access control, and hledger\-api allows file
+browsing, so on shared machines you will certainly need to put it behind
+an authenticating proxy to restrict access.
 .PP
-If invoked as \f[C]hledger\-api\ \-\-swagger\f[], instead of starting a
-server the API docs will be printed in Swagger 2.0 format.
+You can change the TCP port it listens on (default: 8001) with
+\f[C]\-p\ PORT\f[].
+.PP
+API methods look like:
+.IP
+.nf
+\f[C]
+/api/v1/accountnames
+/api/v1/transactions
+/api/v1/prices
+/api/v1/commodities
+/api/v1/accounts
+/api/v1/accounts/ACCTNAME
+\f[]
+.fi
+.PP
+See \f[C]/api/swagger.json\f[] for a full list in Swagger 2.0 format.
+(Or you can run \f[C]hledger\-api\ \-\-swagger\f[] to print this in the
+console.)
+.PP
+hledger\-api also serves files, from the current directory by default,
+and the \f[C]/\f[] path will also show a directory listing.
+This is convenient for serving client\-side web code, in addition to the
+server\-side api.
 .SH OPTIONS
 .PP
 Note: if invoking hledger\-api as a hledger subcommand, write
diff --git a/hledger-api.cabal b/hledger-api.cabal
--- a/hledger-api.cabal
+++ b/hledger-api.cabal
@@ -2,10 +2,10 @@
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: fb76194ccf25e07379b144d9ac8eb4ae4936140b939cd8610c7c6fc6ee07f9c9
+-- hash: f3634e33165cee47d5e654d9261a1c38195c0466a0c52c659e5833033a73416a
 
 name:           hledger-api
-version:        1.5
+version:        1.9
 synopsis:       Web API server for the hledger accounting tool
 description:    This is a simple web API server for hledger data.
                 It comes with a series of simple client-side web app examples.
@@ -32,12 +32,10 @@
     CHANGES
     examples/01.html
     examples/02.html
-    README
-
-data-files:
     hledger-api.1
     hledger-api.info
     hledger-api.txt
+    README
 
 source-repository head
   type: git
@@ -46,17 +44,17 @@
 executable hledger-api
   main-is: hledger-api.hs
   ghc-options: -threaded
-  cpp-options: -DVERSION="1.5"
+  cpp-options: -DVERSION="1.9"
   build-depends:
       Decimal
     , aeson
-    , base >=4.8 && <5
+    , base >=4.8 && <4.12
     , bytestring
     , containers
     , docopt
     , either
-    , hledger >=1.5 && <1.6
-    , hledger-lib >=1.5 && <1.6
+    , hledger >=1.9 && <2.0
+    , hledger-lib >=1.9 && <2.0
     , microlens >=0.4
     , microlens-platform >=0.2.3.1
     , safe
diff --git a/hledger-api.hs b/hledger-api.hs
--- a/hledger-api.hs
+++ b/hledger-api.hs
@@ -36,12 +36,12 @@
 import Hledger.Query
 import Hledger.Cli hiding (Reader, version)
 
-hledgerApiVersion="1.5"
+hledgerApiVersion="1.9"
 
 -- https://github.com/docopt/docopt.hs#readme
 doc :: Docopt
 doc = [docopt|
-hledger-api 1.5
+hledger-api 1.9
 
 Serves hledger data and reports as a JSON web API.
 
diff --git a/hledger-api.info b/hledger-api.info
--- a/hledger-api.info
+++ b/hledger-api.info
@@ -3,7 +3,7 @@
 
 File: hledger-api.info,  Node: Top,  Next: OPTIONS,  Up: (dir)
 
-hledger-api(1) hledger-api 1.5
+hledger-api(1) hledger-api 1.9
 ******************************
 
 hledger-api is a simple web API server, intended to support client-side
@@ -19,12 +19,28 @@
    The server listens on IP address 127.0.0.1, accessible only to local
 requests, by default.  You can change this with '--host', eg '--host
 0.0.0.0' to listen on all addresses.  Note there is no other access
-control, so you will need to hide hledger-api behind an authenticating
-proxy if you want to restrict access.  You can change the TCP port
-(default: 8001) with '-p PORT'.
+control, and hledger-api allows file browsing, so on shared machines you
+will certainly need to put it behind an authenticating proxy to restrict
+access.
 
-   If invoked as 'hledger-api --swagger', instead of starting a server
-the API docs will be printed in Swagger 2.0 format.
+   You can change the TCP port it listens on (default: 8001) with '-p
+PORT'.
+
+   API methods look like:
+
+/api/v1/accountnames
+/api/v1/transactions
+/api/v1/prices
+/api/v1/commodities
+/api/v1/accounts
+/api/v1/accounts/ACCTNAME
+
+   See '/api/swagger.json' for a full list in Swagger 2.0 format.  (Or
+you can run 'hledger-api --swagger' to print this in the console.)
+
+   hledger-api also serves files, from the current directory by default,
+and the '/' path will also show a directory listing.  This is convenient
+for serving client-side web code, in addition to the server-side api.
 * Menu:
 
 * OPTIONS::
@@ -64,7 +80,7 @@
 
 Tag Table:
 Node: Top72
-Node: OPTIONS1216
-Ref: #options1301
+Node: OPTIONS1658
+Ref: #options1743
 
 End Tag Table
diff --git a/hledger-api.txt b/hledger-api.txt
--- a/hledger-api.txt
+++ b/hledger-api.txt
@@ -29,15 +29,30 @@
        The server listens on IP address 127.0.0.1, accessible  only  to  local
        requests,   by   default.    You   can  change  this  with  --host,  eg
        --host 0.0.0.0 to listen on all addresses.   Note  there  is  no  other
-       access  control, so you will need to hide hledger-api behind an authen-
-       ticating proxy if you want to restrict access.  You can change the  TCP
-       port (default: 8001) with -p PORT.
+       access  control,  and  hledger-api  allows  file browsing, so on shared
+       machines you will certainly need to put  it  behind  an  authenticating
+       proxy to restrict access.
 
-       If  invoked  as hledger-api --swagger, instead of starting a server the
-       API docs will be printed in Swagger 2.0 format.
+       You can change the TCP port it listens on (default: 8001) with -p PORT.
 
+       API methods look like:
+
+              /api/v1/accountnames
+              /api/v1/transactions
+              /api/v1/prices
+              /api/v1/commodities
+              /api/v1/accounts
+              /api/v1/accounts/ACCTNAME
+
+       See /api/swagger.json for a full list in Swagger 2.0 format.   (Or  you
+       can run hledger-api --swagger to print this in the console.)
+
+       hledger-api  also  serves files, from the current directory by default,
+       and the / path will also show a directory listing.  This is  convenient
+       for serving client-side web code, in addition to the server-side api.
+
 OPTIONS
-       Note: if invoking hledger-api as a hledger subcommand, write --  before
+       Note:  if invoking hledger-api as a hledger subcommand, write -- before
        options as shown above.
 
        -f --file=FILE
@@ -64,23 +79,23 @@
 
 ENVIRONMENT
        LEDGER_FILE The journal file path when not specified with -f.  Default:
-       ~/.hledger.journal  (on  windows,  perhaps C:/Users/USER/.hledger.jour-
+       ~/.hledger.journal (on  windows,  perhaps  C:/Users/USER/.hledger.jour-
        nal).
 
 FILES
-       Reads data from one or more files in hledger journal, timeclock,  time-
-       dot,   or   CSV   format   specified   with  -f,  or  $LEDGER_FILE,  or
-       $HOME/.hledger.journal          (on          windows,           perhaps
+       Reads  data from one or more files in hledger journal, timeclock, time-
+       dot,  or  CSV  format  specified   with   -f,   or   $LEDGER_FILE,   or
+       $HOME/.hledger.journal           (on          windows,          perhaps
        C:/Users/USER/.hledger.journal).
 
 BUGS
-       The  need  to precede options with -- when invoked from hledger is awk-
+       The need to precede options with -- when invoked from hledger  is  awk-
        ward.
 
 
 
 REPORTING BUGS
-       Report bugs at http://bugs.hledger.org (or on the #hledger IRC  channel
+       Report  bugs at http://bugs.hledger.org (or on the #hledger IRC channel
        or hledger mail list)
 
 
@@ -94,7 +109,7 @@
 
 
 SEE ALSO
-       hledger(1),      hledger-ui(1),     hledger-web(1),     hledger-api(1),
+       hledger(1),     hledger-ui(1),     hledger-web(1),      hledger-api(1),
        hledger_csv(5), hledger_journal(5), hledger_timeclock(5), hledger_time-
        dot(5), ledger(1)
 
@@ -102,4 +117,4 @@
 
 
 
-hledger-api 1.5                  December 2017                  hledger-api(1)
+hledger-api 1.9                   March 2018                    hledger-api(1)
