Release v2.4.2

Author: ericmj

CHANGELOG.md

@@ -1,6 +1,26 @@
 # CHANGELOG
 
-## v2.4.2-dev
+## v2.4.2 (2026-04-30)
+
+### Enhancements
+
+* Add download stats and release dates to `mix hex.info`
+* Show `mix hex.package diff` commands in `mix hex.outdated` output
+* Update docs published message to indicate docs may not be immediately available
+
+### Bug fixes
+
+* Clean up paths in `mix hex.package diff` output
+* Fix organization auth to create user key instead of organization key
+* Fix registry cache purging
+* Fix `mix deps.get` timing out when fetching private packages in parallel
+* Skip auth prompts in `mix deps.get` when only public packages are needed
+* Restrict user OAuth fallback to trusted repositories
+* Only exchange API keys for OAuth tokens on repositories that opted in
+
+### Security fixes
+
+* Raise on `mix.lock` checksum mismatches instead of silently rewriting them (CVE-2026-32148)
 
 ## v2.4.1 (2026-03-24)
 

lib/hex/http/ca-bundle.crt

@@ -1,7 +1,7 @@
 ##
 ## Bundle of CA Root Certificates
 ##
-## Certificate data from Mozilla last updated on: Wed Feb 11 18:26:30 2026 GMT
+## Certificate data from Mozilla as of: Thu Apr 30 17:57:20 2026 GMT
 ##
 ## Find updated versions here: https://curl.se/docs/caextract.html
 ##
@@ -15,7 +15,7 @@
 ## an Apache+mod_ssl webserver for SSL client authentication.
 ## Just configure this file as the SSLCACertificateFile.
 ##
-## Conversion done with mk-ca-bundle.pl version 1.32.
+## Conversion done with mk-ca-bundle.pl version 1.33.
 ## SHA256: 3b98d4e3ff57a326d9587c33633039c8c3a9cf0b55f7ca581d7598ff329eb1f3
 ##
 

mix.exs

@@ -1,7 +1,7 @@
 defmodule Hex.MixProject do
   use Mix.Project
 
-  @version "2.4.2-dev"
+  @version "2.4.2"
 
   def project do
     [