fix(Security): Apply patch update 0.9.2 to main

CHANGELOG.md

@@ -23,6 +23,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 --->
 
+# [0.9.2]
+
+### Security
+
+- Restrict Kafka client params that execute commands or load libraries (GHSA-g85h-2988-4cv8).
+- Reject oversized columnar dictionaries during merges (Tantivy GHSA-7pph-m7rw-cqhv).
+
 # [0.9.1]
 
 ### Security

docs/configuration/source-config.md

@@ -103,6 +103,8 @@ A tutorial is available [here](/docs/ingest-data/kafka.md).
 
 The Kafka source consumes a `topic` using the client library [librdkafka](https://github.com/edenhill/librdkafka) and forwards the key-value pairs carried by the parameter `client_params` to the underlying librdkafka consumer. Common `client_params` options are bootstrap servers (`bootstrap.servers`), or security protocol (`security.protocol`). Please, refer to [Kafka](https://kafka.apache.org/documentation/#consumerconfigs) and [librdkafka](https://github.com/edenhill/librdkafka/blob/master/CONFIGURATION.md) documentation pages for more advanced options.
 
+For security reasons, `client_params` cannot set `sasl.kerberos.kinit.cmd`, `sasl.kerberos.min.time.before.relogin`, `plugin.library.paths`, `ssl.engine.location`, or `ssl.providers`. By default, librdkafka does not run `kinit` to acquire or refresh Kerberos tickets. To enable it, set the `QW_KAFKA_KINIT_CMD` environment variable to the `kinit` command on every node that creates or runs Kafka sources. The command cannot contain `%{...}` placeholders, so `sasl.kerberos.keytab` and `sasl.kerberos.principal` must be written into the command directly.
+
 | Property | Description | Default value |
 | --- | --- | --- |
 | `topic` | Name of the topic to consume. | required |

docs/ingest-data/kafka.md

@@ -224,6 +224,8 @@ params:
     sasl.password: your_sasl_password
 ```
 
+For Kerberos (`sasl.mechanisms: GSSAPI`), `client_params` cannot set the `kinit` command. Either refresh tickets outside Quickwit, or set the `QW_KAFKA_KINIT_CMD` environment variable on every node that creates or runs Kafka sources, for example `QW_KAFKA_KINIT_CMD="kinit -k -t /path/to/quickwit.keytab quickwit@EXAMPLE.COM"`. See the [source configuration](../configuration/source-config.md) page for details.
+
 :::note
 
 If you get the following error:

docs/reference/rest-api.md

@@ -3,6 +3,12 @@ title: REST API
 sidebar_position: 10
 ---
 
+## Security
+
+:::warning
+Quickwit does not authenticate clients unless [mutual TLS](../configuration/node-config.md#tls-configuration) is enabled. Anyone who can reach the REST or gRPC API has full access to the cluster. Keep Quickwit on a trusted network or behind an authenticated proxy, and do not expose it directly to the public internet.
+:::
+
 ## API version
 
 All the API endpoints start with the `api/v1/` prefix. `v1` indicates that we are currently using version 1 of the API.