From 1f6106cea6f2dec86ce8122ce150f2b5605c7bd7 Mon Sep 17 00:00:00 2001
From: Chris Arcand <chris@chrisarcand.com>
Date: Tue, 31 Mar 2026 09:31:28 -0500
Subject: [PATCH] Release v0.20.1

---
 CHANGELOG.md         | 3 +++
 lib/vault/version.rb | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69126ca..b742be7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,9 +2,12 @@
 
 ## Unreleased
 
+## v0.20.1 (March 31, 2026)
+
 BUG FIXES
 
 - Removed explicit `connection_pool` runtime dependency to allow use of connection_pool 3.x for compatibility with sidekiq 8.1+. The gem is already managed as a transitive dependency by `net-http-persistent`, which supports connection_pool 2.2.4+ through 3.x. [GH-393]
+- Hardened STS endpoint parsing in AWS auth by replacing permissive matching with strict HTTPS URI and host validation, preserving supported global, regional, GovCloud, and China endpoints while rejecting malformed inputs. [GH-402]
 
 ## v0.20.0 (February 4, 2026)
 
diff --git a/lib/vault/version.rb b/lib/vault/version.rb
index c89a97c..839ff5d 100644
--- a/lib/vault/version.rb
+++ b/lib/vault/version.rb
@@ -2,5 +2,5 @@
 # SPDX-License-Identifier: MPL-2.0
 
 module Vault
-  VERSION = "0.20.0"
+  VERSION = "0.20.1"
 end