Skip to content

fix(Security): Apply patch update 0.9.2 to main - #6907

Open
dayaffe wants to merge 5 commits into
mainfrom
david.yaffe/apply-0.9.2-to-main
Open

dayaffe wants to merge 5 commits into
mainfrom
david.yaffe/apply-0.9.2-to-main

Conversation

@dayaffe

@dayaffe dayaffe commented Oct 16, 2026 •

Copy link
Copy Markdown
Contributor

Description

Applies the 0.9.2 security patch to main:

  • Restrict Kafka client params that execute commands or load libraries (GHSA-g85h-2988-4cv8).
  • Bump tantivy to the latest commit on its main branch (e1acb3e).
  • Bump the version to 0.9.2 and add the changelog entry.
  • Add a security note to the REST API docs: Quickwit does not authenticate clients unless mutual TLS is enabled, so it should not be exposed to untrusted networks.

How was this PR tested?

  • Kafka unit tests, cargo check (including the release feature set), clippy, rustfmt, and the license checks.

Kafka source configs can be submitted through the REST API, so they should not be able to make librdkafka run shell commands or load native libraries. Kerberos ticket refresh is now opt-in through the operator-set `QW_KAFKA_KINIT_CMD` environment variable.
@dayaffe
dayaffe requested a review from a team as a code owner October 16, 2026 18:54
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-16T20:48:29.320278Z fdd7998 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@dayaffe
dayaffe enabled auto-merge October 16, 2026 19:08
An empty or whitespace-only value now behaves like an unset variable and keeps Kerberos ticket refresh disabled.
@dayaffe
dayaffe force-pushed the david.yaffe/apply-0.9.2-to-main branch from 288868d to fdd7998 Compare October 16, 2026 20:45

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants