Release v2.4.4

[cipherboy]

SECURITY

• core/identity: Correctly lowercase policy names on identity groups to prevent root policy assignment. CVE-2025-64761 / GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13 / CVE-2025-5999. [GH-2143]

IMPROVEMENTS

• command: operator diagnose certificate expiration warnings are now raised if less than 15% of the certificate's validity period remains. Previously, any certificate that was set to expire in the next 30 days would be flagged. This made little sense for short-lived certificates. [GH-2062]

BUG FIXES

• auth/cert: allow use of always-fresh OCSP servers which elide NextUpdate [GH-2079]
• auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all OIDC tokens after CEL support was introduced. [GH-2148]
• command: operator diagnose certificate expiration warnings now contain the correct time to expiration. [GH-2062]
• command: operator diagnose now correctly ignores trailing data in certificate files. [GH-2065]
• command: operator diagnose now correctly verifies intermediate certs if no root certs are supplied. [GH-2065]
• command: pki health check error now contains actual mount path instead of a template placeholder. [GH-2061]
• core: fix nil panic in the rare case were an expiration retry is running during shutdown [GH-2019]
• raft: fix memory leak when using only non-transactional operations. This was a regression introduced in release 2.4.2 with fix memory leak in raft #1889. [GH-2067]
• sdk/helper/ocsp: allow use of always-fresh OCSP servers which elide NextUpdate [GH-2079]

What's Changed

• 4bfd707: Add changelog for v2.4.4 (Add changelog for v2.4.4 #2147) (authored by @cipherboy)
• 841d077: Allow cache-less OCSP handling (Allow cache-less OCSP handling #2079) (Allow cache-less OCSP handling (#2079) #2142) (authored by @cipherboy, backported by @cipherboy)
• 8f40f06: Backport 2.4.x: use relative links in documentation (Backport 2.4.x: use relative links in documentation #2076) (authored by @JanMa)
• 3eb5245: Bump to Go 1.24.10, run bump-critical prior to release (Bump to Go 1.24.10, run bump-critical prior to release #2145) (authored by @cipherboy, backported by @cipherboy)
• 1818158: Correctly lowercase policies in identity groups (Correctly lowercase policies in identity groups #2143) (Correctly lowercase policies in identity groups (#2143) #2144) (authored by @cipherboy, backported by @cipherboy)
• 2aceb6b: Fix bug in JWT token renewal (Fix bug in JWT token renewal #2148) (Fix bug in JWT token renewal (#2148) #2149) (authored by @cipherboy, backported by @satoqz)
• 3bf99e5: Fix operator diagnose certificate expiration time calculation (Fix certificate expiration time calculation in operator diagnose #2062) (Fix operator diagnose certificate expiration time calculation (#2062) #2118) (authored by @satoqz, backported by @phil9909)
• 3c281c6: Fix operator diagnose certificate verification (Fix operator diagnose certificate verification #2065) (Fix operator diagnose certificate verification (#2065) #2119) (authored by @satoqz, backported by @phil9909)
• 19f8e41: Fix potential segfault during step down (Fix potential segfault during step down #2019) (Fix potential segfault during step down (#2019) #2121) (authored by @phil9909, backported by @phil9909)
• e4d4c01: PKI health check returning proper mount path (PKI health check returning proper mount path #2061) (PKI health check returning proper mount path (#2061) #2120) (authored by @wslabosz-reply, backported by @phil9909)
• da94d33: Revert namespace docs removal (Revert namespace docs removal #2069) (Revert namespace docs removal (#2069) #2141) (authored by @cipherboy, backported by @cipherboy)
• f0f5ae3: raft: send lowestActiveIndex also for put and delete operations (raft: send lowestActiveIndex also for put and delete operations #2067) (raft: send lowestActiveIndex also for put and delete operations (#2067) #2110) (authored by @phil9909, backported by @phil9909)