11.0.333

spider-rs/spider11.0.333Aug 26, 2026by adubovikov

AI Summary

Fixes S3 secret expiration issues and bumps a dependency to address a security vulnerability.

Key Highlights

Refresh S3 secrets to prevent ExpiredToken errors on cold-volume ops
Security fix: bump echo/v4 for CVE-2026-55677

Full Release Notes

## What's Changed
* fix(storage): refresh DuckDB `credential_chain` S3 secrets so cold-volume ops do not fail with `ExpiredToken` ~6h after start on EC2 instance profile / IRSA / Pod Identity. `CREATE SECRET` now uses `REFRESH auto`, and Homer recreates the secret each tiering cycle, before moves/maintenance, and after native PUT (`BeforeRegister`). Static keys and custom endpoints (MinIO/R2) are unchanged. Fixes [#980](https://github.com/sipcapture/homer/issues/980) via https://github.com/sipcapture/homer/pull/981
* fix(security): bump `echo/v4` from 4.15.3 to 4.15.4 for [CVE-2026-55677](https://github.com/advisories/GHSA-vfp3-v2gw-7wfq) (encoded-slash static file bypass). https://github.com/sipcapture/homer/pull/979

**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.331...11.0.333