chore: release prep for 2.4.2

[lakhansamani]

Release prep for 2.4.2. Renames [Unreleased] to 2.4.2 and documents everything in it.

Why this is more than a rename

Sixteen PRs have merged since the 2.4.1 tag. [Unreleased] documented three of them, and none of the five advisory fixes. A security release whose notes omit its own security fixes gives nobody a reason to upgrade — which is the operator-facing half of exactly the failure the SECURITY.md triage process exists to prevent.

Contents

Security — the six advisories now closed, and the three reachable dependency advisories:

Advisory	PR
GHSA-m46m-j9p5-5j99 (high) — trusted-URL pin bypassed on gRPC/REST	#814
GHSA-25j3-4jg3-w352 (high) — public gRPC methods skipped the delegated-scope gate	#799
GHSA-44vr-f829-xfch (high) — /verify_email delivered tokens in the query string	#798
GHSA-qx8r-9p3g-vcp4 — password-only change did not revoke sessions	#796
GHSA-cqr5-83v5-mx8f — validate_jwt_token did not bind the signed token_type	#796
GHSA-hhhh-p743-q3cp — /authorize/consent accepted a delegated token	#815

Plus gRPC v1.83.2 (#797), OpenTelemetry v1.45.0 (#807), golang.org/x/net v0.60.0 (#811), and the Go 1.27 builder (#800). Each states why it was reachable here, not just that it was bumped — including the gRPC version subtlety, where the advisory names v1.82.2 as the fix but on the 1.83.x line it landed in v1.83.2, so v1.83.1 is still affected.

Fixed — the audit-filter parity bugs (#802) and the Cassandra index probe that never waited (#810).

Changed — direct-gRPC x-authorizer-url now yields to --url (#814), and the dropped Cassandra audit_log(created_at) index (#812).

Added — the audit plumbing (#806), stated explicitly as writing no new records and changing no behaviour so nobody reads it as a live feature, plus the two deployment entries (#801, #808).

Upgrade notes — three of these did not exist before

The previously-written notes were incomplete in ways an operator would have discovered in production:

• Any two audit filters now scan on Cassandra/ScyllaDB, not only the timestamp range. The earlier note mentioned only ranges, but the code adds ALLOW FILTERING for any second restriction — one query can be served by one index. _audit_logs(action:, actor_id:) is an ordinary admin search and it now scans. Still better than the pre-2.4.2 behaviour, where that exact combination errored outright on ScyllaDB.
• ScyllaDB first start after upgrade may take longer, now that the readiness probes genuinely block where they previously returned immediately. Bounded at 90s total.
• The manual DROP INDEX for the removed audit_log(created_at) index, with the CQL. Existing deployments keep the index until dropped; nothing breaks if left.

The ScyllaDB view-build note is now scoped to ScyllaDB specifically: global secondary indexes are materialized views there, whereas Apache Cassandra builds local 2i with no view-build step and no nodetool viewbuildstatus. The previous wording was headed "CassandraDB/ScyllaDB" and would have sent Cassandra operators looking for a command that does not apply.

Decisions worth noting

• Section order leads with Security, matching 2.4.1. This file orders by what matters for the release at hand rather than a fixed sequence — 2.4.0, a feature release, leads with Added.
• ci: bump scorecard-action to v2.4.4 (GCR -> GHCR) #791 and docs(changelog): add Unreleased section for #802, #806, #807 #809 are deliberately omitted. A Scorecard action bump and the previous changelog edit are not user-facing; Keep a Changelog asks for notable changes, not a commit log.
• No version file to bump. Confirmed against 2.4.1's own prep commit (chore: release prep for 2.4.1 #790), which touched CHANGELOG.md only — the image tag comes from the release.

Verification

The release candidate was re-verified before this was written, on b5012cbc:

go build ./...      OK
go vet ./...        clean
make test-all-db    0 failures    7/7 backends
make smoke          PASS          internal/e2e 23.5s

Backend coverage was confirmed explicitly rather than inferred from a failure count — postgres, sqlite, mongodb, arangodb, scylladb, dynamodb, couchbase, each running the full 9-case audit-log group, with TestNotFoundContractIsUniform and TestDeleteUserCascadeIsUniform both passing.

Docs-only change, so no code risk here; the entries were written from each commit's own body rather than from the PR titles.