diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f5c2c25..4b415b87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-## [Unreleased]
+## [0.21.0] - 2026-09-22
### Changed
diff --git a/Cargo.lock b/Cargo.lock
index 69d4b5eb..379d2df3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4112,7 +4112,7 @@ dependencies = [
[[package]]
name = "libsecretspec"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"secretspec",
"serde_json",
@@ -5988,7 +5988,7 @@ dependencies = [
[[package]]
name = "secretspec"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"age",
"async-trait",
@@ -6055,7 +6055,7 @@ dependencies = [
[[package]]
name = "secretspec-derive"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"http 1.4.0",
"insta",
@@ -6071,7 +6071,7 @@ dependencies = [
[[package]]
name = "secretspec-ipc"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"async-trait",
"jsonschema",
@@ -6087,7 +6087,7 @@ dependencies = [
[[package]]
name = "secretspec-ipc-conformance"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"async-trait",
"cc",
@@ -6104,7 +6104,7 @@ dependencies = [
[[package]]
name = "secretspec-node-native"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"napi",
"napi-build",
@@ -6114,7 +6114,7 @@ dependencies = [
[[package]]
name = "secretspec-php-native"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"ext-php-rs",
"secretspec",
@@ -6122,7 +6122,7 @@ dependencies = [
[[package]]
name = "secretspec-py-native"
-version = "0.20.0"
+version = "0.21.0"
dependencies = [
"pyo3",
"secretspec",
diff --git a/Cargo.toml b/Cargo.toml
index e32d77a1..94892478 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,7 +12,7 @@ members = [
resolver = "2"
[workspace.package]
-version = "0.20.0"
+version = "0.21.0"
edition = "2024"
[workspace.dependencies]
@@ -66,9 +66,9 @@ azure_identity = "1.0.0"
azure_security_keyvault_secrets = "1.0.0"
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }
tokio = { version = "1", features = ["rt", "rt-multi-thread"] }
-secretspec-derive = { version = "0.20.0", path = "./secretspec-derive" }
-secretspec = { version = "0.20.0", path = "./secretspec" }
-secretspec-core = { package = "secretspec", version = "0.20.0", path = "./secretspec" }
+secretspec-derive = { version = "0.21.0", path = "./secretspec-derive" }
+secretspec = { version = "0.21.0", path = "./secretspec" }
+secretspec-core = { package = "secretspec", version = "0.21.0", path = "./secretspec" }
rand = "0.10"
# rPGP 0.20's public generation API uses Rand 0.8's traits. Keep the older
# version under an explicit alias until rPGP moves to the current Rand API.
@@ -88,7 +88,7 @@ json-patch = "4.2.0"
async-trait = "0.1"
tokio-util = { version = "0.7", features = ["rt"] }
zeroize = { version = "1.8", features = ["derive"] }
-secretspec-ipc = { version = "0.20.0", path = "./secretspec-ipc" }
+secretspec-ipc = { version = "0.21.0", path = "./secretspec-ipc" }
# The profile that 'dist' will build with
[profile.dist]
diff --git a/Package.swift b/Package.swift
index f300415f..7b90631a 100644
--- a/Package.swift
+++ b/Package.swift
@@ -6,8 +6,8 @@ import PackageDescription
// Keep this in sync with the Cargo workspace version via
// scripts/sync-sdk-versions.sh. Release preparation replaces the checksum
// after building the versioned XCFramework; see RELEASE.md.
-let secretSpecBinaryVersion = "0.20.0"
-let secretSpecBinaryChecksum = "7a72710f735ebc69ac34a6a3eda09a2a04663d00a2e7d2e23a73c3011f7e3fea"
+let secretSpecBinaryVersion = "0.21.0"
+let secretSpecBinaryChecksum = "61749ecce0f1544ccb72d3506b479d81eaad8d085baf9dc7e846c3056b6ada17"
let localBinaryPath = "secretspec-swift/Artifacts/CSecretSpec.xcframework"
let packageRoot = URL(fileURLWithPath: #filePath).deletingLastPathComponent()
diff --git a/secretspec-derive/Cargo.toml b/secretspec-derive/Cargo.toml
index 7307cd3c..b78933e9 100644
--- a/secretspec-derive/Cargo.toml
+++ b/secretspec-derive/Cargo.toml
@@ -14,7 +14,7 @@ syn.workspace = true
quote.workspace = true
proc-macro2.workspace = true
toml.workspace = true
-secretspec = { version = "0.20.0", path = "../secretspec", default-features = false }
+secretspec = { version = "0.21.0", path = "../secretspec", default-features = false }
[dev-dependencies]
trybuild.workspace = true
diff --git a/secretspec-dotnet/src/SecretSpec/SecretSpec.csproj b/secretspec-dotnet/src/SecretSpec/SecretSpec.csproj
index 45acb853..57a6c07b 100644
--- a/secretspec-dotnet/src/SecretSpec/SecretSpec.csproj
+++ b/secretspec-dotnet/src/SecretSpec/SecretSpec.csproj
@@ -10,7 +10,7 @@
$(NoWarn);CS1591
Cachix.SecretSpec
- 0.20.0
+ 0.21.0
Cachix
C# SDK for SecretSpec, the declarative secrets manager.
secrets;configuration;security;dotnet
diff --git a/secretspec-dotnet/tests/SecretSpec.PackageSmoke/SecretSpec.PackageSmoke.csproj b/secretspec-dotnet/tests/SecretSpec.PackageSmoke/SecretSpec.PackageSmoke.csproj
index 1a9eb3f6..6e3702a8 100644
--- a/secretspec-dotnet/tests/SecretSpec.PackageSmoke/SecretSpec.PackageSmoke.csproj
+++ b/secretspec-dotnet/tests/SecretSpec.PackageSmoke/SecretSpec.PackageSmoke.csproj
@@ -5,7 +5,7 @@
enable
enable
true
- 0.20.0
+ 0.21.0
diff --git a/secretspec-hs/secretspec.cabal b/secretspec-hs/secretspec.cabal
index 139436c8..e8bd8d5e 100644
--- a/secretspec-hs/secretspec.cabal
+++ b/secretspec-hs/secretspec.cabal
@@ -1,6 +1,6 @@
cabal-version: 2.4
name: secretspec
-version: 0.20.0
+version: 0.21.0
synopsis: Haskell SDK for SecretSpec, a declarative secrets manager
description:
A thin client over the @libsecretspec@ C ABI (linked at build time).
diff --git a/secretspec-jvm/gradle.properties b/secretspec-jvm/gradle.properties
index 1d31548a..e2e81f48 100644
--- a/secretspec-jvm/gradle.properties
+++ b/secretspec-jvm/gradle.properties
@@ -1,4 +1,4 @@
org.gradle.java.installations.auto-detect=true
org.gradle.java.installations.auto-download=false
org.gradle.java.installations.fromEnv=SECRETSPEC_JVM_TARGET_JDK,JAVA_HOME_11_X64,JAVA_HOME_11_ARM64,JAVA_HOME_11_AARCH64
-secretspec.version=0.20.0-SNAPSHOT
+secretspec.version=0.21.0-SNAPSHOT
diff --git a/secretspec-node/package.json b/secretspec-node/package.json
index 97002efe..5f092174 100644
--- a/secretspec-node/package.json
+++ b/secretspec-node/package.json
@@ -1,6 +1,6 @@
{
"name": "secretspec",
- "version": "0.20.0",
+ "version": "0.21.0",
"description": "A declarative interface for every secret provider. Node.js SDK.",
"license": "Apache-2.0",
"homepage": "https://secretspec.dev/",
diff --git a/secretspec-py/pyproject.toml b/secretspec-py/pyproject.toml
index 6f2c5864..6fc7e323 100644
--- a/secretspec-py/pyproject.toml
+++ b/secretspec-py/pyproject.toml
@@ -7,7 +7,7 @@ build-backend = "maturin"
[project]
name = "secretspec"
-version = "0.20.0"
+version = "0.21.0"
description = "A declarative interface for every secret provider. Python SDK."
readme = "README.md"
requires-python = ">=3.9"
diff --git a/secretspec-rb/secretspec.gemspec b/secretspec-rb/secretspec.gemspec
index a8c7c18c..9fb8d84c 100644
--- a/secretspec-rb/secretspec.gemspec
+++ b/secretspec-rb/secretspec.gemspec
@@ -2,7 +2,7 @@
Gem::Specification.new do |spec|
spec.name = "secretspec"
- spec.version = "0.20.0"
+ spec.version = "0.21.0"
spec.summary = "A declarative interface for every secret provider. Ruby SDK."
spec.description = "Ruby bindings for SecretSpec: a native extension that " \
"statically links the libsecretspec C ABI."