- GA of Bucket v1 API with proxy, mTLS, and custom STS support; GitRepository, OCIRepository, and HelmRelease gain optional fields for OIDC, proxy, and schema‑validation control
- Controllers rebuilt with Go 1.23 and updated dependencies: Kubernetes 1.31, Helm 3.16, SOPS 3.9, Cosign 2.4, Notation 1.2
- Upgrade from v2.3.0 to v2.4.0 via bootstrap or GitHub Action; update CRDs to v1 and note that deprecated API versions will be removed after 6 months