docs(changelog): add 2.4.1 entry

The synced sources are a superset of Node.js v26.8.1, so the README
compatibility line moves from v26.7.0.

Author: mceachen

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.4.1](https://github.com/PhotoStructure/node-sqlite/releases/tag/v2.4.1) (2026-09-08)
+
+API compatible with `node:sqlite` from Node.js v26.8.1, plus four fixes landed on `v26.x-staging` but not yet in a Node.js release. SQLite is unchanged at 3.53.4.
+
+### Fixed
+
+- **Options getters that close the database**: a property getter on an options bag runs arbitrary JavaScript in the middle of the call, so `prepare()`, `function()`, `aggregate()`, `deserialize()`, `createSession()`, `applyChangeset()`, and `backup()` now re-check that the database is still open after reading their options (and, for `function()` and `aggregate()`, the callback's `length`) and throw `ERR_INVALID_STATE` if a getter closed it. Previously `applyChangeset()` segfaulted, `createSession()` returned a session on a closed connection, and the others surfaced SQLite misuse errors. Ports [Node.js PR #65595](https://github.com/nodejs/node/pull/65595).
+- **`deserialize()` buffer resized from an options getter**: if the getter shrinks or detaches the `buffer` argument's backing store, `deserialize()` throws `ERR_INVALID_STATE` instead of copying past the end of it (previously a segfault). Same upstream PR.
+- **Non-integer callback `length`**: `function()` and `aggregate()` throw `ERR_INVALID_ARG_TYPE` when `fn.length`, `options.step.length`, or `options.inverse.length` has been redefined to a non-integer. Previously a non-number was silently treated as varargs. Same upstream PR.
+- **Changeset detached mid-apply**: when a `filter` or `onConflict` callback is supplied, `applyChangeset()` copies the changeset before applying it, so a callback that detaches or overwrites the input buffer can no longer hand SQLite freed or zeroed memory. Changesets over 2 GiB are rejected with `ERR_OUT_OF_RANGE`. Ports [Node.js PR #65286](https://github.com/nodejs/node/pull/65286).
+- **Closing a session from a callback**: `session.close()` and `session[Symbol.dispose]()` throw `ERR_INVALID_STATE` (`session cannot be closed while in a callback`) when called from any SQLite callback on the same connection: an authorizer, a user-defined function, or a `sqlite.db.query` diagnostics subscriber. SQLite's session module runs `PRAGMA table_xinfo` from inside its pre-update hook while it is still walking the connection's session list, so deleting a session there is a use-after-free. Disposing an already-closed session from a callback remains a no-op. Ports [Node.js PR #65454](https://github.com/nodejs/node/pull/65454).
+- **Double free when `function()` or `aggregate()` registration fails**: when `sqlite3_create_function_v2()` or `sqlite3_create_window_function()` rejects a registration (for example a callback whose `length` exceeds `SQLITE_MAX_FUNCTION_ARG`, 1000 in this build), SQLite invokes the user data's `xDestroy` itself. The port freed it a second time and crashed the process instead of throwing `ERR_SQLITE_ERROR`. Found while porting the fixes above; not present in Node.js.
+- **Portable Linux prebuild**: `scripts/prebuild-linux-glibc.sh` no longer runs `apt-get` inside the `node:22-bullseye` image, which already ships GCC 10.2, make, and Python 3.9. Debian 11's `bullseye-security` Release file expired on 2026-09-07 (Bullseye LTS ended 2026-08-31), so `apt-get update` failed and blocked the glibc 2.31 prebuild locally and in both release workflows. The script now also removes its build container when a step fails. The glibc 2.31 target is unchanged.
+
 ## [2.4.0](https://github.com/PhotoStructure/node-sqlite/releases/tag/v2.4.0) (2026-09-02)
 
 ### Added

README.md

@@ -5,7 +5,7 @@
 [![npm version](https://img.shields.io/npm/v/@photostructure/sqlite.svg)](https://www.npmjs.com/package/@photostructure/sqlite)
 [![CI](https://github.com/photostructure/node-sqlite/actions/workflows/build.yml/badge.svg)](https://github.com/photostructure/node-sqlite/actions/workflows/build.yml)
 
-Native SQLite for Node.js 22+. Drop-in replacement for `node:sqlite`. Synced with Node.js v26.7.0 for the latest features including native `Symbol.dispose` resource management.
+Native SQLite for Node.js 22+. Drop-in replacement for `node:sqlite`. Synced with Node.js v26.8.1 for the latest features including native `Symbol.dispose` resource management.
 
 ## Installation
 
@@ -54,7 +54,7 @@ production.
 
 ## Features
 
-- API-compatible with Node.js v26.7.0 built-in `node:sqlite` module\*
+- API-compatible with Node.js v26.8.1 built-in `node:sqlite` module\*
 - Zero dependencies - native SQLite implementation
 - Stable synchronous API with no async overhead on the root entry point
 - Native SQLite performance ([benchmarks and tradeoffs](./benchmark/README.md))