diff --git a/.gitignore b/.gitignore
index a611a91..ba0589f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -173,3 +173,4 @@
 /389-ds-base-1.4.0.18.tar.bz2
 /389-ds-base-1.4.0.19.tar.bz2
 /389-ds-base-1.4.0.20.tar.bz2
+/389-ds-base-1.4.0.21.tar.bz2
diff --git a/389-ds-base.spec b/389-ds-base.spec
index 303d64a..61aecb9 100644
--- a/389-ds-base.spec
+++ b/389-ds-base.spec
@@ -44,7 +44,7 @@ ExcludeArch: i686
 
 Summary:          389 Directory Server (base)
 Name:             389-ds-base
-Version:          1.4.0.20
+Version:          1.4.0.21
 Release:          %{?relprefix}1%{?prerel}%{?dist}
 License:          GPLv3+
 URL:              https://www.port389.org
@@ -771,6 +771,56 @@ exit 0
 %doc README.md
 
 %changelog
+* Thu Jan 31 2019 Mark Reynolds <mreynolds@redhat.com> - 1.4.0.21-1
+- Bump version to 1.4.0.21
+- Ticket 50041 - CLI and WebUI - Add memberOf plugin functionality
+- Ticket 50079 `Fix for ticket 50059: If an object is nsds5replica, it must be cn=replica`
+- Ticket 50125 - perl fix ups for tmpfiles
+- Ticket 50164 - Add test for dscreate
+- Ticket 50059: If an object is nsds5replica, it must be cn=replica
+- Ticket 50169 - lib389 changed hardcoded systemctl path
+- Ticket 50165 - Fix dscreate issues
+- Ticket 50152 - Replace os.getenv('HOME') with os.path.expanduser
+- Fix compiler warning in snmp main()
+- Fix compiler warning in init.c
+- Ticket 49540 - FIx compiler warning in ldif2ldbm
+- Ticket 50077 - Fix compiler warnings in automember rebuild task
+- Ticket 49972 - use-after-free in case of several parallel krb authentication
+- Ticket 50161 - Fixed some descriptions in "dsconf backend --help"
+- Ticket 50153 - Increase default max logs
+- Ticket 50123 - with_tmpfiles_d is associated to systemd
+- Ticket 49984 - python installer add option to create suffix entry
+- Ticket 50077 - RFE - improve automember plugin to work with modify ops
+- Ticket 50136 - Allow resetting passwords on the CLI
+- Ticket 49994 - Adjust dsconf backend usage
+- Ticket 50138 - db2bak.pl -P LDAPS does not work when nsslapd-securePort is missing
+- Ticket 50122 - Fix incorrect path spec
+- Ticket 50145 - Add a verbose option to the backup tools
+- Ticket 50056 - dsctl db2ldif throws an exception
+- Ticket 50078 - cannot add cenotaph in read only consumer
+- Ticket 50126 - Incorrect usage of sudo in test
+- Ticket 50130 - Building RPMs on RHEL8 fails
+- Ticket 50134 - fixup-memberof.pl does not respect protocol requested
+- Ticket 50122 - Selinux test for presence
+- Ticket 50101 -  Port fourwaymmr Test TET suit to python3
+- Ticket 50091 - shadowWarning is not generated if passwordWarning is lower than 86400 seconds (1 day).
+- Ticket 50128 - NS Stress fails without ipv6
+- Ticket 49618 - Set nsslapd-cachememsize to custom value
+- Ticket 50117 - after certain failed import operation, impossible to replay an import operation
+- Ticket 49999 - rpm.mk dist-bz2 should clean cockpit_dist first
+- Ticket 48064 - Fix various issues in disk monitoring test suite
+- Ticket 49938 - lib389 - Clean up CLI logging
+- Ticket 49761 - Fix CI test suite issues
+- Ticket 50056 - Fix UI bugs (part 2)
+- Ticket 48064 - CI test - disk_monitoring
+- Ticket 50099 - extend error messages
+- Ticket 50099 - In FIPS mode, the server can select an unsupported password storage scheme
+- Ticket 50041 - Add basic plugin UI/CLI wrappers
+- Ticket 50082 - Port state test suite
+- Ticket 49574 - remove index subsystem
+- Ticket 49588 - Add py3 support for tickets : part-5
+- Ticket 50095 - cleanup deprecated key.h includes
+
 * Fri Dec 14 2018 Mark Reynolds <mreynolds@redhat.com> - 1.4.0.20-1
 - Bump version to 1.4.0.20
 - Ticket 49994 - Add test for backend/suffix CLI functions
diff --git a/sources b/sources
index ac4fd4b..c325906 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (389-ds-base-1.4.0.20.tar.bz2) = bcd22f64b7e29a0d58dc19c428eaabb3674b5f2a6029f62eeadf4e21346bcb79e689d91e2689d01b625d731cac8b49150343975961a52c1552d2454038598c20
+SHA512 (389-ds-base-1.4.0.21.tar.bz2) = 83bc1dec7b11b05f0ed0a917c1ef8aac268ef9178f1f87aebddbdc0201c5c014ad07143a34b6de06e0fcd9c3642aa306110b29502c03522f89796268beeca686
 SHA512 (jemalloc-5.1.0.tar.bz2) = d9abebe54d303ca931b8c31c1033f23ff5fb060f2377ec8386f4d79c352e65c78ed34f680c352dac14f7d7115d10245782d553d988bc13df2eb34a2f0942ef6f