11.0.333

wavekat/wavekat-turn11.0.333Aug 26, 2026by adubovikov

AI Summary

The update ensures long-running operations on cold storage do not fail due to token expiration and includes a security patch for an encoded-slash static file bypass vulnerability.

Key Highlights

Fixed token expiration issues for S3 secrets on cold storage
Security patch for CVE-2026-55677 (encoded-slash static file bypass)
Implemented automatic secret refresh using REFRESH auto

New Features

Refresh DuckDB credential_chain S3 secrets automatically
Bumped echo/v4 for security fix CVE-2026-55677

Full Release Notes

## What's Changed
* fix(storage): refresh DuckDB `credential_chain` S3 secrets so cold-volume ops do not fail with `ExpiredToken` ~6h after start on EC2 instance profile / IRSA / Pod Identity. `CREATE SECRET` now uses `REFRESH auto`, and Homer recreates the secret each tiering cycle, before moves/maintenance, and after native PUT (`BeforeRegister`). Static keys and custom endpoints (MinIO/R2) are unchanged. Fixes [#980](https://github.com/sipcapture/homer/issues/980) via https://github.com/sipcapture/homer/pull/981
* fix(security): bump `echo/v4` from 4.15.3 to 4.15.4 for [CVE-2026-55677](https://github.com/advisories/GHSA-vfp3-v2gw-7wfq) (encoded-slash static file bypass). https://github.com/sipcapture/homer/pull/979

**Full Changelog**: https://github.com/sipcapture/homer/compare/11.0.331...11.0.333