# Release Notes – Trinity Platform v4.11.0

**URL:** https://community.neutrinos.com/t/release-notes-trinity-platform-v4-11-0/2891
**Category:** Neutrinos Platform
**Tags:** neutrinos-platform, trinity-release-note, trinity-releases
**Created:** [October 30, 2026, 11:36am UTC](https://community.neutrinos.com/t/release-notes-trinity-platform-v4-11-0/2891 "2026-10-30T11:36:24Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Prethush](https://community.neutrinos.com/user_avatar/community.neutrinos.com/prethush/32/211_2.png) [@Prethush](https://community.neutrinos.com/u/Prethush)
#### Post date: [October 30, 2026, 11:36am UTC](https://community.neutrinos.com/t/release-notes-trinity-platform-v4-11-0/2891/1 "2026-10-30T11:36:24Z")

</div>

# Trinity 4.11.0 Release Notes

## Overview

Trinity 4.11.0 makes secrets easier to manage and your apps safer to run. You can now sync many vault keys in one secret, move secrets between environments with import and export, and take tighter control of the traffic going in and out of your apps. Under the hood, this release also closes the findings from our latest security review.

## New features

### Sync secrets

- **Many keys, one sync secret:** add several secret key and vault key pairs to a single sync secret, instead of creating one secret per key. Works for both project and asset secrets.
- **Pick vault keys from a list:** search your vault’s keys and select one, several or all of them. Works with Azure Key Vault (including managed identity), Google Secret Manager, OCI Vault and AWS Secrets Manager.
- **Sync on demand:** refresh one secret with **Sync now** , or a whole table with **Sync all**. The new **Last synced** column shows when each secret was last updated.
- **Decoding options:** choose **Auto** or **None** for how secret values are decoded.

One sync secret with several secret key and vault key pairs:

 ![Create secret dialog with several secret key and vault key pairs](https://community.neutrinos.com/uploads/default/original/2X/b/baa930f4b7dcb45b7db7f409aae1bd14c5679421.png)

Pick vault keys from a searchable list, or select all:

 ![Vault key picker with search and select all](https://community.neutrinos.com/uploads/default/original/2X/d/d68ed13a158b06b0d6d5eb0ca1d43cb06c79cfda.png)

The sync secret table, with Sync now, Sync all and Last synced:

 ![Sync secret table showing the last sync time](https://community.neutrinos.com/uploads/default/original/2X/7/7567fe5ac3a8b5e8838cbd587ddb21fcee63025e.png)

A sync in progress:

 ![Sync secret row showing Syncing](https://community.neutrinos.com/uploads/default/original/2X/6/6042aabb8dee069a2e855dcd75ade0d67f337ed0.png)

### Secrets import and export

- **Move secrets between environments:** use the new **Import** and **Export** buttons on the project and asset Secrets pages.
- **Export** saves all your secrets (new, mapped and synced) to one JSON file. Secret values aren’t included.
- **Import** checks each secret first, then creates, updates or skips it. You see the result for every secret and can retry any that failed.

Export: pick the secret types to include, then copy or download the JSON:

 ![Export secrets dialog with secret types and a JSON preview](https://community.neutrinos.com/uploads/default/original/2X/a/a1bd3869c8e5ebc55bbc24a815bce53b313dd1e1.png)

Import: paste or upload the JSON, and choose whether to skip or overwrite secrets that already have a value:

 ![Import secrets dialog with the pasted JSON](https://community.neutrinos.com/uploads/default/original/2X/0/0375d48983d35bb79aae23eb4004d01b03717117.png)

### Deployments

- **Better control of ingress and egress:** decide who can reach your API apps and what they are allowed to call. Turn it on under **Configurations** when you deploy.
- **Edit variables as JSON:** switch the variables table to a JSON view to see and edit all your environment variables at once.

Ingress and egress: turn on the policy, then choose which namespaces can call your app, what it can call, and which outgoing ports are open to public addresses:

 ![Network policy settings under Configurations during a deployment](https://community.neutrinos.com/uploads/default/original/2X/d/dda074761e93a1f6e7ad96cbdf3a40d3e1040df4.png)

### Vault configuration

- **Azure managed identity:** AKS vault configurations can now use managed identity, so you no longer need a tenant ID and client secret.

Tenant ID is optional, and leaving the client secret empty uses the managed identity:

 ![Create new vault dialog with optional tenant ID and client secret](https://community.neutrinos.com/uploads/default/original/2X/d/dea17713abe01508adb4042004be86a87b3e51a9.png)

## Improvements

- **Faster asset details page:** it makes fewer requests, and its storage and access sections load on their own.
- **Clearer error messages:** if a mapped variable, storage or secret is missing in the target environment, the deployment tells you exactly what is missing.
- **Complete secret table:** every key of a sync secret is listed, and new rows appear at the top.

## Bug fixes

- Asset sync secrets that use the same vault no longer overwrite each other.
- The vault key dropdown now shows every key in the vault.
- Choosing a private URL no longer stops you from continuing to the next step.

## Security

This release fixes the findings from our latest penetration test. Most of the work happens behind the scenes. These are the changes you may notice:

- **Admin-only access:** managing Trinity now requires the ORG\_ADMIN role.
- **Stricter sign-in checks:** only tokens issued for Trinity are accepted.
- **Audit trail:** changes, pod actions and secret access are recorded in the audit log. Secret values are never logged.
- **Secrets encrypted in your browser:** secrets you enter are encrypted before they leave your browser, and only the server can decrypt them.
- **Less exposure:** certificate keys and other sensitive settings are no longer returned by the APIs, and secret values no longer appear in logs.
- **Patched vulnerabilities:** high and critical CVEs fixed across our images and dependencies.

## Upgrade notes

For administrators upgrading an existing installation:

1. In the trinity-db-operations service, run `backend/trinity-db-operations/SQL_SCRIPTS/console-db/release-4.11.0.sql`. It adds `secret_project_environment.key_value_pairs` and backfills existing sync secrets.
2. Deploy together with the matching console-helm-charts release. It mounts service settings at `/etc/trinity/config` and supplies the credentials removed from the env files.
3. Provide `PAYLOAD_DECRYPTION_KEY` (RSA private key, PEM) to trinity-orchestrator and trinity-assets-orchestrator through trinity-secrets.
4. Make sure Trinity users have the ORG\_ADMIN role; other users lose access.
5. Deploy API apps with the `n-apps-api-with-security-fix` version of the `n-apps-api` chart to get the security fixes and the new ingress and egress controls.
6. Deploy UI apps with the `n-apps-ui-with-security-fix` version of the `n-apps-ui` chart to get its security fixes and ingress and egress controls.

## Docker images

| Service | Image |
| --- | --- |
| Orchestrator | `neutrinos.azurecr.io/trinity/trinity-orchestrator:26.10.4.11.0` |
| Deployments | `neutrinos.azurecr.io/trinity/trinity-deployments:26.10.4.11.0` |
| DB operations | `neutrinos.azurecr.io/trinity/trinity-db-operations:26.10.4.11.0` |
| Frontend API | `neutrinos.azurecr.io/trinity/trinity-frontend/api:26.10.4.11.0` |
| Frontend UI | `neutrinos.azurecr.io/trinity/trinity-frontend/ui:26.10.4.11.0` |
| App logs | `neutrinos.azurecr.io/trinity/trinity-app-logs:26.10.4.11.0` |
| Promscale connector | `neutrinos.azurecr.io/trinity/trinity-promscale-connector:26.10.4.11.0` |