11.0.333

sipcapture/homer11.0.333Aug 26, 2026by adubovikov

AI Summary

Addresses credential expiration issues on cold storage volumes and applies a security patch for a vulnerability in the echo/v4 library.

Key Highlights

Refresh DuckDB S3 secrets to prevent ExpiredToken errors on EC2 instances and cold volumes.
Bump `echo/v4` to 4.15.4 to fix a static file bypass vulnerability.

Full Release Notes

## What's Changed
* fix(storage): refresh DuckDB `credential_chain` S3 secrets so cold-volume ops do not fail with `ExpiredToken` ~6h after start on EC2 instance profile / IRSA / Pod Identity. `CREATE SECRET` now uses `REFRESH auto`, and Homer recreates the secret each tiering cycle, before moves/maintenance, and after native PUT (`BeforeRegister`). Static keys and custom endpoints (MinIO/R2) are unchanged. Fixes [#980](https://github.com/sipcapture/homer/issues/980) via https://github.com/sipcapture/homer/pull/981
* fix(security): bump `echo/v4` from 4.15.3 to 4.15.4 for [CVE-2026-55677](https://github.com/advisories/GHSA-vfp3-v2gw-7wfq) (encoded-slash static file bypass). https://github.com/sipcapture/homer/pull/979

**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.331...11.0.333