chore(release): 2.4.0

[lakhansamani]

Draft — do not merge until the checklist below is green.

Promotes [Unreleased] to ## [2.4.0] - 2026-08-14. Content is unchanged; only the heading moves, leaving an empty [Unreleased] for post-release work.

Release checklist

• 2.4.0-rc.21 cut, all four release jobs green (smoke, tests, build+push, Trivy)
• Images live in both registries, amd64 + arm64 — quay.io/authorizer/authorizer:2.4.0-rc.21, docker.io/lakhansamani/authorizer:2.4.0-rc.21
• Docker Hub credential confirmed valid (rc.20 and rc.21 both pushed successfully)
• Examples verified against a build of main — demo.mjs and mcp-agent.mjs --verify both pass end to end
• Docs, examples, deploy repos and SDK test suites updated for the --url requirement
• Deploy repos bumped to the final tag — helm-chart, railway, render, heroku and public-demo are all pinned to 2.4.0-rc.18. ./release.sh 2.4.0 --push handles all five
• SDK releases — authorizer-js is at 4.0.0-rc.0 (npm latest is 3.3.0); authorizer-react at 2.2.0-rc.7 (npm latest is 2.0.7). The docs describe the rc APIs, so latest installs will not match the docs until these ship
• Security advisories — see below
• Tag 2.4.0 (non-prerelease, so :latest moves)

Security advisories — action needed before/with the release

Four advisories are fixed but still sitting in triage, patched in 2.4.0-rc.20:

Advisory	Status
GHSA-qxfq-3qvw-w5fr — SSRF via IPv6 transition addresses	Fixed (#763). Regression test TestSSRFGuardBlocksIPv6TransitionRanges
GHSA-m82j-rq33-qjx2 — password-reset poisoning via Host header	Fixed (#764). The mitigation is --url becoming mandatory. Submitted affected range is malformed (a bare commit sha)
GHSA-89vc-q979-qwxv — unescaped regex dots in the allowlist	Fixed (#763), probe-verified
GHSA-63w4-vxm7-v2mg	Duplicate of GHSA-89vc — identical root cause, filed the same day. Publish one, close the other as a duplicate

Two more need correcting:

• GHSA-j558-mp2m-fhrp — not reproducible. Its PoC claims a wildcard AllowedOrigins makes redirect_uri validation pass. It does not: with ["*"], IsValidRedirectURI rejects https://evil.com, //evil.com and javascript:alert(1) alike. Recommend closing as invalid. What would change this: a redirect_uri that IsValidRedirectURI accepts on ≥2.2.1.
• GHSA-x3f4-v83f-7wp2 is published with no patched version — it currently tells readers they are vulnerable with nowhere to go. The validator landed in 2.2.1 (085dc31, fix(security): prevent HMAC key leak in JWKS and fix redirect URI wildcard #570); GHSA-89vc then describes that fix as incomplete, fully closed in 2.4.0-rc.20.

Headline changes in 2.4.0

Two flags now stop the server from starting, which is the whole upgrade story for existing deployments:

• --url is required. Without it the server derived its own host from request headers — a forged Host makes a genuine password-reset link point at an attacker-controlled domain (CWE-640). It is not --allowed-origins: --url is where this server is, --allowed-origins is the apps it may redirect to.
• --encryption-key is required for RS*/ES* deployments. Versions 2.2.1–2.4.0-rc.13 fell back to a public constant compiled into the source; treat TOTP enrollments from those versions as compromised.

Plus enterprise SSO (SAML IdP, verified domains, home realm discovery), WebAuthn/passkeys, SCIM 2.0 groups, the redesigned MFA model, remote MCP over HTTP, CIMD/DCR, and agent-identity permission intersection.