Allowed patterns required but empty

Are you sure you are using 2.0.x-dev? Could not replicate the issue on a fresh install:

altagrade@d10-web:/var/www/html/web$ composer require 'drupal/protected_forms:2.0.x-dev@dev'
No composer.json in current directory, do you want to use the one at /var/www/html? [Y,n]? Y
Always want to use the parent dir? Use "composer config --global use-parent-dir true" to change the default.
./composer.json has been updated
Running composer update drupal/protected_forms
Loading composer repositories with package information
Updating dependencies
Lock file operations: 1 install, 0 updates, 0 removals
  - Locking drupal/protected_forms (dev-2.0.x 2280653)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
  - Syncing drupal/protected_forms (dev-2.0.x 2280653) into cache
  - Installing drupal/protected_forms (dev-2.0.x 2280653): Cloning 2280653733 from cache
Generating autoload files
45 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
altagrade@d10-web:/var/www/html/web$ drush en protected_forms
 [success] Successfully enabled: protected_forms
altagrade@d10-web:/var/www/html/web$ 

Then saving via UI went through also successfully:

Changing the status. Feel free to provide the exact steps on how to replicate the issue. Make sure you are using the right version.

Thanks @AltaGrade no I was using the stable version, not the dev. I'll try the latest stable now.

Alright, in the latest dev version it's no more required. Could you please tag a new stable release? :)

I'm seeing the same issue in the stable release. Does adding a wildcard under "Allowed Patterns" then override or disable the Reject Patterns?

@droddis we simply need a new stable release.