HOMER vs Telegram

HOMER is releasing at near-daily cadence — twelve tags across 11.0.304 to 11.0.315 in nine days. The work concentrates on the DuckDB/DuckLake storage layer that HOMER 11 is built on: sanitizing bad RTPengine HEP timestamps that were creating future date partitions, stopping false-positive forbidden-keyword matches on Call-IDs, reconnecting DuckDB on catalog refresh. Two security advisories closed in the same window — a self-service admin escalation via PATCH /api/v4/users/:id, and an under-authenticated node /query endpoint that also exposed DuckDB external scanners. Separately, the search UI learned to treat HEP node name as an identity distinct from the numeric capture ID.

Nearly every entry here repairs something the new coordinator-and-storage-node design exposed rather than adding surface — which is the signature of a rearchitecture being shaken out in production rather than a feature push. 11.0.315 is the first release in this window that optimizes instead of repairs: the coordinator now caches each node's {min_ts,max_ts} from a stats endpoint and skips nodes whose range cannot overlap the query window. The security fixes cluster on the same young components, the node /query path and the raw-SQL validator.

Expect smart routing to move from opt-in toward default once the historical pcap and replay-ingest caveat is resolved, and the raw-SQL validator to keep absorbing fixes as more DuckDB surface gets exposed through it.