From 7a037d0913a571f390021cc8cbdce9e9a1800ee3 Mon Sep 17 00:00:00 2001 From: Thomas Devoogdt Date: Sun, 7 Dec 2025 21:17:05 +0100 Subject: [PATCH] package/fluent-bit: security bump to 4.2.0 This is a major release that introduces new features, including one highlighted in the release notes: "The v4.2 release introduces a powerful new Direct Routing capability that allows inputs to specify routes directly to outputs, bypassing the traditional routing mechanism." But it also brings some security fixes. Not all of them are relevant, but some piece of lecture can be found here [1]. It fixes the following CVEs: CVE-2025-12977 CVE-2025-12978 CVE-2025-12972 CVE-2025-12970 CVE-2025-12969 News: - https://fluentbit.io/announcements/v4.1.0/ - https://fluentbit.io/announcements/v4.1.1/ - https://fluentbit.io/announcements/v4.2.0/ The patch 0001-plugins-kafka-fix-cmake-cross-compile-error.patch can be dropped as it has been merged upstream [2]. [1] https://www.theregister.com/2025/11/24/fluent_bit_cves/ [2] https://github.com/fluent/fluent-bit/pull/9600 Signed-off-by: Thomas Devoogdt Signed-off-by: Thomas Petazzoni --- ...ibrdkafka-only-require-a-C-compiler.patch} | 2 +- ...-kafka-fix-cmake-cross-compile-error.patch | 47 ------------------- package/fluent-bit/fluent-bit.hash | 2 +- package/fluent-bit/fluent-bit.mk | 2 +- 4 files changed, 3 insertions(+), 50 deletions(-) rename package/fluent-bit/{0002-lib-librdkafka-only-require-a-C-compiler.patch => 0001-lib-librdkafka-only-require-a-C-compiler.patch} (98%) delete mode 100644 package/fluent-bit/0001-plugins-kafka-fix-cmake-cross-compile-error.patch diff --git a/package/fluent-bit/0002-lib-librdkafka-only-require-a-C-compiler.patch b/package/fluent-bit/0001-lib-librdkafka-only-require-a-C-compiler.patch similarity index 98% rename from package/fluent-bit/0002-lib-librdkafka-only-require-a-C-compiler.patch rename to package/fluent-bit/0001-lib-librdkafka-only-require-a-C-compiler.patch index 83c77ff70c..660ed7bed4 100644 --- a/package/fluent-bit/0002-lib-librdkafka-only-require-a-C-compiler.patch +++ b/package/fluent-bit/0001-lib-librdkafka-only-require-a-C-compiler.patch @@ -1,4 +1,4 @@ -From c33d6bd392c5c8bbd231b2a9d00d4959cc553c44 Mon Sep 17 00:00:00 2001 +From 7329316bdcc72aceb6bbbdf8711f5bf8894c2a15 Mon Sep 17 00:00:00 2001 From: Thomas Devoogdt Date: Tue, 25 Jul 2023 09:10:41 +0200 Subject: [PATCH] lib: librdkafka: only require a C compiler diff --git a/package/fluent-bit/0001-plugins-kafka-fix-cmake-cross-compile-error.patch b/package/fluent-bit/0001-plugins-kafka-fix-cmake-cross-compile-error.patch deleted file mode 100644 index 8b74d5911d..0000000000 --- a/package/fluent-bit/0001-plugins-kafka-fix-cmake-cross-compile-error.patch +++ /dev/null @@ -1,47 +0,0 @@ -From a21de9cb95f2199270a6ac6922ffa4ca8d453f26 Mon Sep 17 00:00:00 2001 -From: Thomas Devoogdt -Date: Sat, 16 Nov 2024 19:46:28 +0100 -Subject: [PATCH] plugins: kafka: fix cmake cross compile error - -KAFKA_INCLUDEDIR is not set if FLB_PREFER_SYSTEM_LIB_KAFKA is not used, -when cross-compiling, it just translates to -I/librdkafka, which is not allowed. -Fix this by only including KAFKA_INCLUDEDIR if really set. - -x86_64-linux-gcc: ERROR: unsafe header/library path used in cross-compilation: '-I/librdkafka' - -Upstream: https://github.com/fluent/fluent-bit/pull/9600 -Signed-off-by: Thomas Devoogdt ---- - plugins/in_kafka/CMakeLists.txt | 4 +++- - plugins/out_kafka/CMakeLists.txt | 4 +++- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/plugins/in_kafka/CMakeLists.txt b/plugins/in_kafka/CMakeLists.txt -index 928266b57..dc251276e 100644 ---- a/plugins/in_kafka/CMakeLists.txt -+++ b/plugins/in_kafka/CMakeLists.txt -@@ -3,5 +3,7 @@ set(src - ) - - FLB_PLUGIN(in_kafka "${src}" ${KAFKA_LIBRARIES} flb-aws) --target_include_directories(flb-plugin-in_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka) -+if(DEFINED KAFKA_INCLUDEDIR) -+ target_include_directories(flb-plugin-in_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka) -+endif() - target_link_libraries(flb-plugin-in_kafka -lpthread) -diff --git a/plugins/out_kafka/CMakeLists.txt b/plugins/out_kafka/CMakeLists.txt -index 9d8b34642..1c967329f 100644 ---- a/plugins/out_kafka/CMakeLists.txt -+++ b/plugins/out_kafka/CMakeLists.txt -@@ -5,5 +5,7 @@ set(src - kafka.c) - - FLB_PLUGIN(out_kafka "${src}" ${KAFKA_LIBRARIES} flb-aws) --target_include_directories(flb-plugin-out_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka) -+if(DEFINED KAFKA_INCLUDEDIR) -+ target_include_directories(flb-plugin-out_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka) -+endif() - target_link_libraries(flb-plugin-out_kafka -lpthread) --- -2.43.0 - diff --git a/package/fluent-bit/fluent-bit.hash b/package/fluent-bit/fluent-bit.hash index 3a4e637d88..be02761ed5 100644 --- a/package/fluent-bit/fluent-bit.hash +++ b/package/fluent-bit/fluent-bit.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 0031f74b616b4669064a59902559da2f87174aa8007e749b5df19ed79c534f5b fluent-bit-4.0.9.tar.gz +sha256 44fe0f52e89a63b213695748f99691d0a6247a4bd05065f1b517c798d9f89bcc fluent-bit-4.2.0.tar.gz sha256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594 LICENSE diff --git a/package/fluent-bit/fluent-bit.mk b/package/fluent-bit/fluent-bit.mk index 73bd686b27..f571896797 100644 --- a/package/fluent-bit/fluent-bit.mk +++ b/package/fluent-bit/fluent-bit.mk @@ -4,7 +4,7 @@ # ################################################################################ -FLUENT_BIT_VERSION = 4.0.9 +FLUENT_BIT_VERSION = 4.2.0 FLUENT_BIT_SITE = $(call github,fluent,fluent-bit,v$(FLUENT_BIT_VERSION)) FLUENT_BIT_LICENSE = Apache-2.0 FLUENT_BIT_LICENSE_FILES = LICENSE