- SecretSpec 0.17 introduces scopes to limit each service or task to only its declared subset of a profile.
- Secrets caching allows a slow fallback route to be cached locally with bounded freshness and explicit invalidation.
- Cross-secret validation enables declaring alternative or mutually exclusive credentials instead of marking every value independently required or optional.
- New providers include SOPS, age, KeePass KDBX, OpenBao, Scaleway Secret Manager, and systemd credentials, with JWT/OIDC authentication for Vault and OpenBao.
- GitHub and Forgejo Actions can now resolve a profile and expose secrets to subsequent steps, with tokenless authentication via OIDC.