Release v0.21.0

CHANGELOG.md

@@ -1,6 +1,6 @@
 # CHANGELOG
 
-## Unreleased
+## v0.21.0 (2026-10-21)
 
 * Request the CI job's OIDC token only for the audience in the new `workload_identity_audience` config option, `hexpm` by default, and return `{error, {oidc_audience_not_allowed, Audience}}` when the API advertises a different one, so a configured API can't get a token that another service accepts.
 * Don't send the config's `api_key` with the device authorization, token and OIDC audience requests in `hex_api_oauth`. The server refuses a request carrying a credential it refuses, so renewing a refused API token had its refresh or device authorization refused too, and the refused refresh cleared the stored token.

README.md

@@ -222,7 +222,7 @@ Add to `rebar.config`:
 
 ```erlang
 {deps, [
-  {hex_core, "0.20.1"}
+  {hex_core, "0.21.0"}
 ]}
 ```
 
@@ -233,7 +233,7 @@ Add to `mix.exs`:
 ```elixir
 defp deps do
   [
-    {:hex_core, "~> 0.20.1"}
+    {:hex_core, "~> 0.21.0"}
   ]
 end
 ```

src/hex_core.app.src

@@ -1,6 +1,6 @@
 {application, hex_core, [
     {description, "Reference implementation of Hex specifications"},
-    {vsn, "0.20.1"},
+    {vsn, "0.21.0"},
     {registered, []},
     {applications, [kernel, stdlib, inets, ssl, ssh]},
     {licenses, ["Apache-2.0"]},

src/hex_core.hrl

@@ -1 +1 @@
--define(HEX_CORE_VERSION, "0.20.1").
+-define(HEX_CORE_VERSION, "0.21.0").