A version that ships because something is broken, not because something is ready. It has a different shape: the fix is the whole content, the gates are tighter, and the version number has to say what it is, because a consumer comparing numbers will be misled by a number that jumped.
About 1 min of reading
Bump the right number.
The bump
Before you run it, say out loud what it will print. Then open the answer.
The sort check
Before you run it, say out loud what it will print. Then open the answer.
Read the first example one line at a time. A line that prints shows what appears on screen; the rest set things up quietly.
The reproduction from the report, run against the new build. That one test is the gate that matters most here, and it is the test that catches a fix that did not fix.
A hotfix number has to sort after the release it fixes. A 2.4.9 hotfix after a 2.5.0 release is a version that looks older than the one it came from, and consumers sort on it.
A hotfix moves the patch number, never the minor. A hotfix that bumps minor is a release that claims a feature was added, and the consumer then writes code against nothing.
The release contains the fix and nothing that was in progress. Shipping half a feature with a fix is the way a broken thing becomes two broken things.
The changelog line names it as a fix release. A consumer reading the numbers sees 2.4.9 to 2.4.10 and learns nothing; the line is what tells them nothing was added.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.