From e39eabf80f1672646ea6f07f107149db9c27914b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eric=20Meadows-J=C3=B6nsson?=
 <eric.meadows.jonsson@gmail.com>
Date: Mon, 19 Oct 2026 18:42:25 +0200
Subject: [PATCH] Release v0.21.0

---
 CHANGELOG.md         | 2 +-
 README.md            | 4 ++--
 src/hex_core.app.src | 2 +-
 src/hex_core.hrl     | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6029616..70e87ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # CHANGELOG
 
-## Unreleased
+## v0.21.0 (2026-10-21)
 
 * Request the CI job's OIDC token only for the audience in the new `workload_identity_audience` config option, `hexpm` by default, and return `{error, {oidc_audience_not_allowed, Audience}}` when the API advertises a different one, so a configured API can't get a token that another service accepts.
 * Don't send the config's `api_key` with the device authorization, token and OIDC audience requests in `hex_api_oauth`. The server refuses a request carrying a credential it refuses, so renewing a refused API token had its refresh or device authorization refused too, and the refused refresh cleared the stored token.
diff --git a/README.md b/README.md
index a9cdf7c..4419c12 100644
--- a/README.md
+++ b/README.md
@@ -222,7 +222,7 @@ Add to `rebar.config`:
 
 ```erlang
 {deps, [
-  {hex_core, "0.20.1"}
+  {hex_core, "0.21.0"}
 ]}
 ```
 
@@ -233,7 +233,7 @@ Add to `mix.exs`:
 ```elixir
 defp deps do
   [
-    {:hex_core, "~> 0.20.1"}
+    {:hex_core, "~> 0.21.0"}
   ]
 end
 ```
diff --git a/src/hex_core.app.src b/src/hex_core.app.src
index 33acf5c..92b3259 100644
--- a/src/hex_core.app.src
+++ b/src/hex_core.app.src
@@ -1,6 +1,6 @@
 {application, hex_core, [
     {description, "Reference implementation of Hex specifications"},
-    {vsn, "0.20.1"},
+    {vsn, "0.21.0"},
     {registered, []},
     {applications, [kernel, stdlib, inets, ssl, ssh]},
     {licenses, ["Apache-2.0"]},
diff --git a/src/hex_core.hrl b/src/hex_core.hrl
index 3ce5dbd..f5cefd5 100644
--- a/src/hex_core.hrl
+++ b/src/hex_core.hrl
@@ -1 +1 @@
--define(HEX_CORE_VERSION, "0.20.1").
+-define(HEX_CORE_VERSION, "0.21.0").