diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..35fc0c4
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,15 @@
+# Changelog
+
+## 0.2.4 - 2026-11-09
+
+### Security
+
+- Restrict the pycurl high-level API to HTTP and HTTPS. `file://` and other non-HTTP schemes are rejected, and libcurl protocols are pinned to HTTP(S), so those fetches cannot bypass the proxy (#36).
+- Reject CR, LF, and NUL in origin header names and values, and require the HTTP method to be a single token, so caller-controlled input cannot inject extra request lines (#36).
+
+### Dependencies and CI
+
+- Group weekly Dependabot updates for pip and GitHub Actions, pin `dependabot/fetch-metadata` to a commit SHA, and auto-merge Dependabot version updates (including majors) after checks pass (#29, #31).
+- Pin GitHub Actions jobs to `ubuntu-24.04` (#33).
+- Bump `actions/upload-artifact` to 7.0.2 and `actions/download-artifact` to 8.0.2 (#32).
+- Bump `actions/setup-python` to 7.1.0 and `pypa/gh-action-pypi-publish` to 1.14.3 (#35).
diff --git a/docs/conf.py b/docs/conf.py
index 319cc15..a6e74fb 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -9,7 +9,7 @@
 project = 'Python Proxy Headers'
 copyright = '2025, ProxyMesh'
 author = 'ProxyMesh'
-release = '0.1.0'
+release = '0.2.4'
 
 # -- General configuration ---------------------------------------------------
 # https://www.sphinx-doc.org/en/master/usage/configuration.html#general-configuration
diff --git a/pyproject.toml b/pyproject.toml
index a1d2869..29b4f43 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-proxy-headers"
-version = "0.2.3"
+version = "0.2.4"
 authors = [
   { name="ProxyMesh", email="support@proxymesh.com" },
 ]