Release v6.0.4

CHANGELOG.md

@@ -2,6 +2,74 @@
 
 About the past changelog entries, see [CHANGELOG v4](CHANGELOG-v4.md) [CHANGELOG v5](CHANGELOG-v5.md) instead.
 
+## Release v6.0.4 - 2026/06/26
+
+### News
+
+* Update bundled Fluentd to v1.19.3
+* Update bundled gems
+  * It contains fixes for `nokogiri` vulnerabilities (fixed in 1.19.3)
+  * Update bundled `rdkafka` to fix segmentation fault
+  * It contains fix for `addressable` vulnerability (CVE-2026-35611) which was fixed in 2.9.0. It might be affected if you use `webhdfs`.
+  * It contains fix for `faraday` vulnerability (CVE-2026-33637) which was fixed in 2.14.2. It might be affected if you use `opensearch`/`elasticsearch`.
+* msi: fixed a bug that bundled ruby version was out-of-date.
+
+### Core component
+
+* ruby v3.4.9
+* jemalloc v3.6.0
+* OpenSSL 3.6.1 Windows
+* OpenSSL 3.0.8 macOS
+* gems
+  * fluentd v1.19.3 (update)
+  * msgpack 1.8.1 (update)
+  * oj 3.16.11
+  * webrick 1.9.2
+  * openssl 3.3.0
+
+### Bundled plugins and gems
+
+* aws-partitions v1.1150.0
+* aws-sdk-core v3.234.0
+* aws-sdk-kms v1.110.0
+* aws-sdk-s3 v1.208.0
+* aws-sdk-sqs v1.101.0
+* aws-sigv4 v1.12.1
+* elasticsearch v8.19.2
+* fluent-diagtool v1.0.5
+* fluent-plugin-elasticsearch v6.0.0
+* fluent-plugin-flowcounter-simple 0.1.0
+* fluent-plugin-kafka v0.19.7 (update)
+* fluent-plugin-metrics-cmetrics v0.1.2
+* fluent-plugin-fluent-package-update-notifier 0.2.3
+* fluent-plugin-obsolete-plugins v0.2.2
+* fluent-plugin-opensearch v1.1.6 (update)
+* fluent-plugin-opentelemetry 0.5.2
+* fluent-plugin-prometheus v2.2.2 (update)
+* fluent-plugin-prometheus_pushgateway v0.2.1
+* fluent-plugin-record-modifier v2.2.1
+* fluent-plugin-rewrite-tag-filter v2.4.0
+* fluent-plugin-s3 v1.8.4
+* fluent-plugin-sd-dns 0.1.0
+* fluent-plugin-systemd v1.1.1
+* fluent-plugin-td v1.2.0
+* fluent-plugin-utmpx v0.5.0
+* fluent-plugin-webhdfs v1.6.0
+* mini_portile2 v2.8.9
+* prometheus-client v4.2.5
+* rdkafka v0.27.0 (update)
+* ruby-kafka v1.5.0
+* systemd-journal v2.1.1
+* td-client v3.0.0
+* webhdfs v0.11.0
+
+On Windows
+
+* fluent-plugin-parser-winevt_xml v0.2.8
+* fluent-plugin-windows-exporter v1.0.0
+* winevt_c v0.11.3 (update)
+* nokogiri v1.19.3 (update)
+
 ## Release v6.0.3 - 2026/03/27
 
 ### News

fluent-package/Gemfile

@@ -20,10 +20,10 @@ gem "sigdump", "0.2.5"
 gem "http_parser.rb", "0.8.1"
 gem "yajl-ruby", "1.4.3"
 gem "serverengine", "2.4.0"
-gem "msgpack", "1.8.0"
+gem "msgpack", "1.8.1"
 gem "oj", "3.16.11"
 gem "tzinfo", "2.0.6"
-gem "tzinfo-data", "1.2026.1"
+gem "tzinfo-data", "1.2026.2"
 
 # Fluentd v1.19.0 requires io-event 1.10.x or before.
 # The dependency condition cannot be met with async >= 2.25
@@ -44,12 +44,19 @@ if ENV["INSTALL_GEM_FROM_LOCAL_REPO"]
     # https://github.com/fluent/fluent-package-builder/issues/618
     # NOTE: platforms: does not work in source ... do block
     gem "win32-service" if RUBY_PLATFORM =~ /mswin|mingw/
+    # Bundle forked version of ffi-win32-extensions until
+    # ffi 1.17.1 or later is supported.
+    # This workaround should be applied to fluent-package not to block using
+    # newer rdkafka to fix SEGV issue.
+    # https://github.com/fluent/fluent-package-builder/issues/1051
+    gem "ffi-win32-extensions" if RUBY_PLATFORM =~ /mswin|mingw/
   end
 else
   # Lock to specific revision
   git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
   gem "fluentd", github: "fluent/fluentd", ref: FLUENTD_REVISION
   gem "win32-service", github: "fluent-plugins-nursery/win32-service", branch: "fluent-package", platforms: [:mingw, :x64_mingw]
+  gem "ffi-win32-extensions", github: "fluent-plugins-nursery/ffi-win32-extensions", branch: "fluent-package", platforms: [:mingw, :x64_mingw]
 end
 
 # plugin gems
@@ -58,9 +65,9 @@ gem "elasticsearch", "8.19.2"
 gem "fluent-plugin-elasticsearch", "6.0.0"
 gem "ruby-kafka", "1.5.0"
 gem "digest-murmurhash", "1.1.1"
-gem "fluent-plugin-kafka", "0.19.6"
+gem "fluent-plugin-kafka", "0.19.7"
 gem "prometheus-client", "4.2.5"
-gem "fluent-plugin-prometheus", "2.2.1"
+gem "fluent-plugin-prometheus", "2.2.2"
 gem "fluent-plugin-prometheus_pushgateway", "0.2.1"
 gem "jmespath", "1.6.2"
 gem "aws-partitions", "1.1150.0"
@@ -85,26 +92,27 @@ gem "mini_portile2", "2.8.9"
 gem "cmetrics", "0.3.3"
 gem "fluent-plugin-metrics-cmetrics", "0.1.2"
 gem "opensearch-ruby", "3.4.0"
-gem "fluent-plugin-opensearch", "1.1.5"
+gem "fluent-plugin-opensearch", "1.1.6"
 gem "fluent-plugin-fluent-package-update-notifier", "0.2.3"
 gem "fluent-plugin-obsolete-plugins", "0.2.2"
 gem "fluent-plugin-opentelemetry", "0.5.2"
 
-# fix CVE-2026-25765 for elasticseach and opensearch
-gem "faraday", "2.14.1"
+# fix CVE-2026-25765,CVE-2026-33637 for elasticseach and opensearch
+gem "faraday", "2.14.2"
 
 windows_platforms = [:mingw, :x64_mingw] # :mswin
 # ffi-win32-extensions doesn't support ffi 1.17.1 or later
-gem "ffi", "1.17.0", platforms: windows_platforms
-gem "ffi-win32-extensions", "1.1.0", platforms: windows_platforms
+gem "ffi", "1.17.4", platforms: windows_platforms
+# Use officially released version when PR was merged and released.
+#gem "ffi-win32-extensions", "1.1.0", platforms: windows_platforms
 # fiddle gem that isn't default gems as of Ruby 3.5
 gem "fiddle", "1.1.8", platforms: windows_platforms
-gem "nokogiri", "1.19.2", platforms: windows_platforms
+gem "nokogiri", "1.19.3", platforms: windows_platforms
 gem "win32-event", "0.6.3", platforms: windows_platforms
 gem "win32-ipc", "0.7.0", platforms: windows_platforms
 # Use officially released version when PR was merged and released.
 #gem "win32-service", "2.3.2", platforms: windows_platforms
-gem "winevt_c", "0.11.2", platforms: windows_platforms
+gem "winevt_c", "0.11.3", platforms: windows_platforms
 gem "win32-eventlog", "0.6.7", platforms: windows_platforms
 gem "fluent-plugin-parser-winevt_xml", "0.2.8", platforms: windows_platforms
 gem "fluent-plugin-windows-eventlog", "0.9.2", platforms: windows_platforms
@@ -116,7 +124,7 @@ gem "capng_c", "0.2.4", platforms: not_windows_platforms
 # (librdkafka 2.8.0 supports "OpenSSL without the ENGINE component")
 # librdkafka 2.8.0 can't be built on CentOS 7.
 unless platform_centos7?
-  gem "rdkafka", "0.21.0", platforms: not_windows_platforms
+  gem "rdkafka", "0.27.0", platforms: not_windows_platforms
 end
 gem "fluent-plugin-systemd", "1.1.1", platforms: not_windows_platforms
 gem "fluent-plugin-utmpx", "0.5.0", platforms: not_windows_platforms

fluent-package/Gemfile.lock

@@ -1,3 +1,11 @@
+GIT
+  remote: https://github.com/fluent-plugins-nursery/ffi-win32-extensions
+  revision: a549365f60c06635bd9b14dd961db118721a2aec
+  branch: fluent-package
+  specs:
+    ffi-win32-extensions (1.1.1)
+      ffi (~> 1.15)
+
 GIT
   remote: https://github.com/fluent-plugins-nursery/win32-service
   revision: cfcc2007b3843127329d6a7307a62a927a714327
@@ -9,8 +17,8 @@ GIT
 
 GIT
   remote: https://github.com/fluent/fluentd
-  revision: 76841666b4e4aade23f0c100a7e048995f7d52c8
-  ref: 76841666b4e4aade23f0c100a7e048995f7d52c8
+  revision: c16dd7ed11b9c158d30c189481b80099bcf9c5f8
+  ref: c16dd7ed11b9c158d30c189481b80099bcf9c5f8
   specs:
     fluentd (1.19.2)
       async-http (~> 0.86)
@@ -35,14 +43,15 @@ GIT
       webrick (~> 1.4)
       win32-event (~> 0.6.3)
       win32-ipc (~> 0.7.0)
+      win32-registry (~> 0.1)
       win32-service (~> 2.3.0)
       yajl-ruby (~> 1.0)
       zstd-ruby (~> 1.5)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     async (2.24.0)
       console (~> 1.29)
@@ -60,7 +69,7 @@ GEM
       protocol-http1 (~> 0.30)
       protocol-http2 (~> 0.22)
       traces (~> 0.10)
-    async-pool (0.11.1)
+    async-pool (0.11.2)
       async (>= 2.0)
     aws-eventstream (1.4.0)
     aws-partitions (1.1150.0)
@@ -112,21 +121,19 @@ GEM
       multi_json
     excon (1.3.2)
       logger
-    faraday (2.14.1)
+    faraday (2.14.2)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
     faraday-excon (2.3.0)
       excon (>= 1.0.0)
       faraday (>= 2.11.0, < 3)
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.3)
       net-http (~> 0.5)
     faraday_middleware-aws-sigv4 (1.0.1)
       aws-sigv4 (~> 1.0)
       faraday (>= 2.0, < 3)
-    ffi (1.17.0)
-    ffi-win32-extensions (1.1.0)
-      ffi (>= 1.15.5, <= 1.17.0)
+    ffi (1.17.4)
     fiber-annotation (0.2.0)
     fiber-local (1.1.0)
       fiber-storage
@@ -151,7 +158,7 @@ GEM
     fluent-plugin-fluent-package-update-notifier (0.2.3)
       fluentd (>= 0.14.10, < 2)
       specinfra (~> 2.94.1)
-    fluent-plugin-kafka (0.19.6)
+    fluent-plugin-kafka (0.19.7)
       bigdecimal (~> 3.1)
       fluentd (>= 0.10.58, < 2)
       ltsv
@@ -161,7 +168,7 @@ GEM
       fluentd (>= 0.14.0, < 2)
     fluent-plugin-obsolete-plugins (0.2.2)
       fluentd (>= 0.14.10, < 2)
-    fluent-plugin-opensearch (1.1.5)
+    fluent-plugin-opensearch (1.1.6)
       aws-sdk-core (~> 3)
       excon
       faraday (>= 2.0.0)
@@ -181,7 +188,7 @@ GEM
       csv (~> 3.2)
       fluentd (>= 0.14.12, < 2)
       nokogiri (>= 1.12.5)
-    fluent-plugin-prometheus (2.2.1)
+    fluent-plugin-prometheus (2.2.2)
       fluentd (>= 1.9.1, < 2)
       prometheus-client (>= 2.1.0)
     fluent-plugin-prometheus_pushgateway (0.2.1)
@@ -243,16 +250,16 @@ GEM
     ltsv (0.1.2)
     metrics (0.14.1)
     mini_portile2 (2.8.9)
-    msgpack (1.8.0)
+    msgpack (1.8.1)
     multi_json (1.17.0)
     mutex_m (0.3.0)
     net-http (0.8.0)
       uri (>= 0.11.1)
     net-scp (4.1.0)
       net-ssh (>= 2.6.5, < 8.0.0)
-    net-ssh (7.3.0)
+    net-ssh (7.3.2)
     net-telnet (0.2.0)
-    nokogiri (1.19.2)
+    nokogiri (1.19.3)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     oj (3.16.11)
@@ -275,8 +282,10 @@ GEM
     public_suffix (6.0.2)
     racc (1.8.1)
     rake (13.3.1)
-    rdkafka (0.21.0)
-      ffi (~> 1.15)
+    rdkafka (0.27.0)
+      ffi (~> 1.17.1)
+      json (> 2.0)
+      logger
       mini_portile2 (~> 2.6)
       rake (> 12)
     rexml (3.4.4)
@@ -290,7 +299,7 @@ GEM
       sigdump (~> 0.2.2)
     sfl (2.3)
     sigdump (0.2.5)
-    specinfra (2.94.1)
+    specinfra (2.94.2)
       base64
       net-scp
       net-ssh (>= 2.7)
@@ -325,7 +334,7 @@ GEM
     traces (0.18.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2026.1)
+    tzinfo-data (1.2026.2)
       tzinfo (>= 1.0.0)
     uri (1.0.4)
     webhdfs (0.11.0)
@@ -337,7 +346,9 @@ GEM
       ffi
     win32-ipc (0.7.0)
       ffi
-    winevt_c (0.11.2)
+    win32-registry (0.1.2)
+      fiddle (~> 1.0)
+    winevt_c (0.11.3)
     yajl-ruby (1.4.3)
     zip-zip (0.3)
       rubyzip (>= 1.0.0)
@@ -363,21 +374,21 @@ DEPENDENCIES
   cool.io (= 1.9.4)
   digest-murmurhash (= 1.1.1)
   elasticsearch (= 8.19.2)
-  faraday (= 2.14.1)
-  ffi (= 1.17.0)
-  ffi-win32-extensions (= 1.1.0)
+  faraday (= 2.14.2)
+  ffi (= 1.17.4)
+  ffi-win32-extensions!
   fiddle (= 1.1.8)
   fluent-diagtool (= 1.0.5)
   fluent-plugin-elasticsearch (= 6.0.0)
   fluent-plugin-flowcounter-simple (= 0.1.0)
   fluent-plugin-fluent-package-update-notifier (= 0.2.3)
-  fluent-plugin-kafka (= 0.19.6)
+  fluent-plugin-kafka (= 0.19.7)
   fluent-plugin-metrics-cmetrics (= 0.1.2)
   fluent-plugin-obsolete-plugins (= 0.2.2)
-  fluent-plugin-opensearch (= 1.1.5)
+  fluent-plugin-opensearch (= 1.1.6)
   fluent-plugin-opentelemetry (= 0.5.2)
   fluent-plugin-parser-winevt_xml (= 0.2.8)
-  fluent-plugin-prometheus (= 2.2.1)
+  fluent-plugin-prometheus (= 2.2.2)
   fluent-plugin-prometheus_pushgateway (= 0.2.1)
   fluent-plugin-record-modifier (= 2.2.1)
   fluent-plugin-rewrite-tag-filter (= 2.4.0)
@@ -394,27 +405,27 @@ DEPENDENCIES
   httpclient (= 2.9.0)
   jmespath (= 1.6.2)
   mini_portile2 (= 2.8.9)
-  msgpack (= 1.8.0)
-  nokogiri (= 1.19.2)
+  msgpack (= 1.8.1)
+  nokogiri (= 1.19.3)
   oj (= 3.16.11)
   opensearch-ruby (= 3.4.0)
   prometheus-client (= 4.2.5)
   rake
-  rdkafka (= 0.21.0)
+  rdkafka (= 0.27.0)
   ruby-kafka (= 1.5.0)
   serverengine (= 2.4.0)
   sigdump (= 0.2.5)
   td (= 0.19.1)
   td-client (= 3.0.0)
   tzinfo (= 2.0.6)
-  tzinfo-data (= 1.2026.1)
+  tzinfo-data (= 1.2026.2)
   webhdfs (= 0.11.0)
   webrick (= 1.9.2)
   win32-event (= 0.6.3)
   win32-eventlog (= 0.6.7)
   win32-ipc (= 0.7.0)
   win32-service!
-  winevt_c (= 0.11.2)
+  winevt_c (= 0.11.3)
   yajl-ruby (= 1.4.3)
 
 BUNDLED WITH