v2.4.0.1

CVE-only release (see commit log for CVE numbers)