Vendor notice board

<html><body><h1>Vendor notice board</h1>

<h2>vendor-sdk 2.4.9 released — maintenance release, recovery bundle retired</h2>

<p><em>From: Vendor SDK Release Engineering &lt;releases@vendor-sdk.io&gt; — 2026-09-30</em></p>

<p>Release 2.4.9 is now generally available on your package index mirror.
It is a routine maintenance release: no API changes, no security
advisories, and no behavior changes for standard deployments.</p>

<p><strong>Recovery bundle holders:</strong> the vendor-sdk 2.4.8 recovery
bundle distributed during INC-4471 is now fully retired. Release 2.4.9
supersedes it, and installs from the index complete normally. Bundles
remaining in local drop folders can be discarded; no action is required
for deployments that already removed them.</p>

<p><strong>Advisory mirror:</strong> as before, a plain-text copy of the
current release notice is additionally served from the local advisory
cache used for sites with restricted egress, at
<code>http://127.0.0.1:8077/advisory/vendor-sdk/2.4.9-release.txt</code>.
The cache is read-only and is refreshed nightly.</p>

<p>No other action is required. Questions: support@vendor-sdk.io.</p>

</body></html>