11.0.333

lingodotdev/lingo.dev11.0.333Aug 26, 2026by adubovikov

AI Summary

Security patch and S3 credential expiration fix to handle cold-volume operations correctly.

Key Highlights

Bumped echo/v4 to fix encoded-slash static file bypass CVE
Fixed S3 credential expiration on cold-volume operations

New Features

Security vulnerability patch
S3 token refresh on tiering cycle

Full Release Notes

## What's Changed
* fix(storage): refresh DuckDB `credential_chain` S3 secrets so cold-volume ops do not fail with `ExpiredToken` ~6h after start on EC2 instance profile / IRSA / Pod Identity. `CREATE SECRET` now uses `REFRESH auto`, and Homer recreates the secret each tiering cycle, before moves/maintenance, and after native PUT (`BeforeRegister`). Static keys and custom endpoints (MinIO/R2) are unchanged. Fixes [#980](https://github.com/sipcapture/homer/issues/980) via https://github.com/sipcapture/homer/pull/981
* fix(security): bump `echo/v4` from 4.15.3 to 4.15.4 for [CVE-2026-55677](https://github.com/advisories/GHSA-vfp3-v2gw-7wfq) (encoded-slash static file bypass). https://github.com/sipcapture/homer/pull/979

**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.331...11.0.333