Release v6.0.4

CHANGELOG.md

@@ -2,6 +2,73 @@
 
 About the past changelog entries, see [CHANGELOG v4](CHANGELOG-v4.md) [CHANGELOG v5](CHANGELOG-v5.md) instead.
 
+## Release v6.0.4 - 2026/06/29
+
+### News
+
+* Update bundled Fluentd to v1.19.3
+* Update bundled gems
+  * It contains fixes for `nokogiri` vulnerabilities (fixed in 1.19.3)
+  * Update bundled `rdkafka` to fix segmentation fault
+  * It contains fix for `addressable` vulnerability (CVE-2026-35611) which was fixed in 2.9.0.
+* msi: fixed a bug that bundled ruby version was out-of-date.
+
+### Core component
+
+* ruby v3.4.9
+* jemalloc v3.6.0
+* OpenSSL 3.6.1 Windows
+* OpenSSL 3.0.8 macOS
+* gems
+  * fluentd v1.19.3 (update)
+  * msgpack 1.8.0
+  * oj 3.16.11
+  * webrick 1.9.2
+  * openssl 3.3.0
+
+### Bundled plugins and gems
+
+* aws-partitions v1.1150.0
+* aws-sdk-core v3.234.0
+* aws-sdk-kms v1.110.0
+* aws-sdk-s3 v1.208.0
+* aws-sdk-sqs v1.101.0
+* aws-sigv4 v1.12.1
+* elasticsearch v8.19.2
+* fluent-diagtool v1.0.5
+* fluent-plugin-elasticsearch v6.0.0
+* fluent-plugin-flowcounter-simple 0.1.0
+* fluent-plugin-kafka v0.19.6 (update)
+* fluent-plugin-metrics-cmetrics v0.1.2
+* fluent-plugin-fluent-package-update-notifier 0.2.3
+* fluent-plugin-obsolete-plugins v0.2.2
+* fluent-plugin-opensearch v1.1.5
+* fluent-plugin-opentelemetry 0.5.2
+* fluent-plugin-prometheus v2.2.2 (update)
+* fluent-plugin-prometheus_pushgateway v0.2.1
+* fluent-plugin-record-modifier v2.2.1
+* fluent-plugin-rewrite-tag-filter v2.4.0
+* fluent-plugin-s3 v1.8.4
+* fluent-plugin-sd-dns 0.1.0
+* fluent-plugin-systemd v1.1.1
+* fluent-plugin-td v1.2.0
+* fluent-plugin-utmpx v0.5.0
+* fluent-plugin-webhdfs v1.6.0
+* mini_portile2 v2.8.9
+* prometheus-client v4.2.5
+* rdkafka v0.27.0 (update)
+* ruby-kafka v1.5.0
+* systemd-journal v2.1.1
+* td-client v3.0.0
+* webhdfs v0.11.0
+
+On Windows
+
+* fluent-plugin-parser-winevt_xml v0.2.8
+* fluent-plugin-windows-exporter v1.0.0
+* winevt_c v0.11.3 (update)
+* nokogiri v1.19.3 (update)
+
 ## Release v6.0.3 - 2026/03/27
 
 ### News

fluent-package/Gemfile

@@ -23,7 +23,7 @@ gem "serverengine", "2.4.0"
 gem "msgpack", "1.8.0"
 gem "oj", "3.16.11"
 gem "tzinfo", "2.0.6"
-gem "tzinfo-data", "1.2026.1"
+gem "tzinfo-data", "1.2026.2"
 
 # Fluentd v1.19.0 requires io-event 1.10.x or before.
 # The dependency condition cannot be met with async >= 2.25
@@ -44,12 +44,19 @@ if ENV["INSTALL_GEM_FROM_LOCAL_REPO"]
     # https://github.com/fluent/fluent-package-builder/issues/618
     # NOTE: platforms: does not work in source ... do block
     gem "win32-service" if RUBY_PLATFORM =~ /mswin|mingw/
+    # Bundle forked version of ffi-win32-extensions until
+    # ffi 1.17.1 or later is supported.
+    # This workaround should be applied to fluent-package not to block using
+    # newer rdkafka to fix SEGV issue.
+    # https://github.com/fluent/fluent-package-builder/issues/1051
+    gem "ffi-win32-extensions" if RUBY_PLATFORM =~ /mswin|mingw/
   end
 else
   # Lock to specific revision
   git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
   gem "fluentd", github: "fluent/fluentd", ref: FLUENTD_REVISION
   gem "win32-service", github: "fluent-plugins-nursery/win32-service", branch: "fluent-package", platforms: [:mingw, :x64_mingw]
+  gem "ffi-win32-extensions", github: "fluent-plugins-nursery/ffi-win32-extensions", branch: "fluent-package", platforms: [:mingw, :x64_mingw]
 end
 
 # plugin gems
@@ -60,7 +67,7 @@ gem "ruby-kafka", "1.5.0"
 gem "digest-murmurhash", "1.1.1"
 gem "fluent-plugin-kafka", "0.19.6"
 gem "prometheus-client", "4.2.5"
-gem "fluent-plugin-prometheus", "2.2.1"
+gem "fluent-plugin-prometheus", "2.2.2"
 gem "fluent-plugin-prometheus_pushgateway", "0.2.1"
 gem "jmespath", "1.6.2"
 gem "aws-partitions", "1.1150.0"
@@ -95,16 +102,17 @@ gem "faraday", "2.14.1"
 
 windows_platforms = [:mingw, :x64_mingw] # :mswin
 # ffi-win32-extensions doesn't support ffi 1.17.1 or later
-gem "ffi", "1.17.0", platforms: windows_platforms
-gem "ffi-win32-extensions", "1.1.0", platforms: windows_platforms
+gem "ffi", "1.17.1", platforms: windows_platforms
+# Use officially released version when PR was merged and released.
+#gem "ffi-win32-extensions", "1.1.0", platforms: windows_platforms
 # fiddle gem that isn't default gems as of Ruby 3.5
 gem "fiddle", "1.1.8", platforms: windows_platforms
-gem "nokogiri", "1.19.2", platforms: windows_platforms
+gem "nokogiri", "1.19.3", platforms: windows_platforms
 gem "win32-event", "0.6.3", platforms: windows_platforms
 gem "win32-ipc", "0.7.0", platforms: windows_platforms
 # Use officially released version when PR was merged and released.
 #gem "win32-service", "2.3.2", platforms: windows_platforms
-gem "winevt_c", "0.11.2", platforms: windows_platforms
+gem "winevt_c", "0.11.3", platforms: windows_platforms
 gem "win32-eventlog", "0.6.7", platforms: windows_platforms
 gem "fluent-plugin-parser-winevt_xml", "0.2.8", platforms: windows_platforms
 gem "fluent-plugin-windows-eventlog", "0.9.2", platforms: windows_platforms
@@ -116,7 +124,7 @@ gem "capng_c", "0.2.4", platforms: not_windows_platforms
 # (librdkafka 2.8.0 supports "OpenSSL without the ENGINE component")
 # librdkafka 2.8.0 can't be built on CentOS 7.
 unless platform_centos7?
-  gem "rdkafka", "0.21.0", platforms: not_windows_platforms
+  gem "rdkafka", "0.27.0", platforms: not_windows_platforms
 end
 gem "fluent-plugin-systemd", "1.1.1", platforms: not_windows_platforms
 gem "fluent-plugin-utmpx", "0.5.0", platforms: not_windows_platforms

fluent-package/Gemfile.lock

@@ -1,3 +1,11 @@
+GIT
+  remote: https://github.com/fluent-plugins-nursery/ffi-win32-extensions
+  revision: da0b5539fe35c02a6d17da83ddef7cda688e7628
+  branch: fluent-package
+  specs:
+    ffi-win32-extensions (1.1.1)
+      ffi (~> 1.15)
+
 GIT
   remote: https://github.com/fluent-plugins-nursery/win32-service
   revision: cfcc2007b3843127329d6a7307a62a927a714327
@@ -9,8 +17,8 @@ GIT
 
 GIT
   remote: https://github.com/fluent/fluentd
-  revision: 76841666b4e4aade23f0c100a7e048995f7d52c8
-  ref: 76841666b4e4aade23f0c100a7e048995f7d52c8
+  revision: 00d3a1ed4ef5c3e48ed537c5960efecfe68df69d
+  ref: 00d3a1ed4ef5c3e48ed537c5960efecfe68df69d
   specs:
     fluentd (1.19.2)
       async-http (~> 0.86)
@@ -35,14 +43,15 @@ GIT
       webrick (~> 1.4)
       win32-event (~> 0.6.3)
       win32-ipc (~> 0.7.0)
+      win32-registry (~> 0.1)
       win32-service (~> 2.3.0)
       yajl-ruby (~> 1.0)
       zstd-ruby (~> 1.5)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     async (2.24.0)
       console (~> 1.29)
@@ -60,7 +69,7 @@ GEM
       protocol-http1 (~> 0.30)
       protocol-http2 (~> 0.22)
       traces (~> 0.10)
-    async-pool (0.11.1)
+    async-pool (0.11.2)
       async (>= 2.0)
     aws-eventstream (1.4.0)
     aws-partitions (1.1150.0)
@@ -124,9 +133,7 @@ GEM
     faraday_middleware-aws-sigv4 (1.0.1)
       aws-sigv4 (~> 1.0)
       faraday (>= 2.0, < 3)
-    ffi (1.17.0)
-    ffi-win32-extensions (1.1.0)
-      ffi (>= 1.15.5, <= 1.17.0)
+    ffi (1.17.1)
     fiber-annotation (0.2.0)
     fiber-local (1.1.0)
       fiber-storage
@@ -181,7 +188,7 @@ GEM
       csv (~> 3.2)
       fluentd (>= 0.14.12, < 2)
       nokogiri (>= 1.12.5)
-    fluent-plugin-prometheus (2.2.1)
+    fluent-plugin-prometheus (2.2.2)
       fluentd (>= 1.9.1, < 2)
       prometheus-client (>= 2.1.0)
     fluent-plugin-prometheus_pushgateway (0.2.1)
@@ -250,9 +257,9 @@ GEM
       uri (>= 0.11.1)
     net-scp (4.1.0)
       net-ssh (>= 2.6.5, < 8.0.0)
-    net-ssh (7.3.0)
+    net-ssh (7.3.2)
     net-telnet (0.2.0)
-    nokogiri (1.19.2)
+    nokogiri (1.19.3)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     oj (3.16.11)
@@ -275,8 +282,10 @@ GEM
     public_suffix (6.0.2)
     racc (1.8.1)
     rake (13.3.1)
-    rdkafka (0.21.0)
-      ffi (~> 1.15)
+    rdkafka (0.27.0)
+      ffi (~> 1.17.1)
+      json (> 2.0)
+      logger
       mini_portile2 (~> 2.6)
       rake (> 12)
     rexml (3.4.4)
@@ -290,7 +299,7 @@ GEM
       sigdump (~> 0.2.2)
     sfl (2.3)
     sigdump (0.2.5)
-    specinfra (2.94.1)
+    specinfra (2.94.2)
       base64
       net-scp
       net-ssh (>= 2.7)
@@ -325,7 +334,7 @@ GEM
     traces (0.18.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2026.1)
+    tzinfo-data (1.2026.2)
       tzinfo (>= 1.0.0)
     uri (1.0.4)
     webhdfs (0.11.0)
@@ -337,7 +346,9 @@ GEM
       ffi
     win32-ipc (0.7.0)
       ffi
-    winevt_c (0.11.2)
+    win32-registry (0.1.2)
+      fiddle (~> 1.0)
+    winevt_c (0.11.3)
     yajl-ruby (1.4.3)
     zip-zip (0.3)
       rubyzip (>= 1.0.0)
@@ -364,8 +375,8 @@ DEPENDENCIES
   digest-murmurhash (= 1.1.1)
   elasticsearch (= 8.19.2)
   faraday (= 2.14.1)
-  ffi (= 1.17.0)
-  ffi-win32-extensions (= 1.1.0)
+  ffi (= 1.17.1)
+  ffi-win32-extensions!
   fiddle (= 1.1.8)
   fluent-diagtool (= 1.0.5)
   fluent-plugin-elasticsearch (= 6.0.0)
@@ -377,7 +388,7 @@ DEPENDENCIES
   fluent-plugin-opensearch (= 1.1.5)
   fluent-plugin-opentelemetry (= 0.5.2)
   fluent-plugin-parser-winevt_xml (= 0.2.8)
-  fluent-plugin-prometheus (= 2.2.1)
+  fluent-plugin-prometheus (= 2.2.2)
   fluent-plugin-prometheus_pushgateway (= 0.2.1)
   fluent-plugin-record-modifier (= 2.2.1)
   fluent-plugin-rewrite-tag-filter (= 2.4.0)
@@ -395,26 +406,26 @@ DEPENDENCIES
   jmespath (= 1.6.2)
   mini_portile2 (= 2.8.9)
   msgpack (= 1.8.0)
-  nokogiri (= 1.19.2)
+  nokogiri (= 1.19.3)
   oj (= 3.16.11)
   opensearch-ruby (= 3.4.0)
   prometheus-client (= 4.2.5)
   rake
-  rdkafka (= 0.21.0)
+  rdkafka (= 0.27.0)
   ruby-kafka (= 1.5.0)
   serverengine (= 2.4.0)
   sigdump (= 0.2.5)
   td (= 0.19.1)
   td-client (= 3.0.0)
   tzinfo (= 2.0.6)
-  tzinfo-data (= 1.2026.1)
+  tzinfo-data (= 1.2026.2)
   webhdfs (= 0.11.0)
   webrick (= 1.9.2)
   win32-event (= 0.6.3)
   win32-eventlog (= 0.6.7)
   win32-ipc (= 0.7.0)
   win32-service!
-  winevt_c (= 0.11.2)
+  winevt_c (= 0.11.3)
   yajl-ruby (= 1.4.3)
 
 BUNDLED WITH

fluent-package/Rakefile

@@ -178,6 +178,7 @@ class DownloadTask
   attr_reader :file_ruby_source, :file_ruby_installer_x64
   attr_reader :file_fluentd_archive
   attr_reader :file_win32_service_archive
+  attr_reader :file_ffi_win32_extensions_archive
   attr_reader :files_ruby_gems
   attr_reader :file_openssl_source
 
@@ -201,6 +202,7 @@ class DownloadTask
     define_ruby_files
     define_fluentd_archive
     define_win32_service_archive if windows?
+    define_ffi_win32_extensions_archive if windows?
     define_gem_files
     define_openssl_file
 
@@ -217,6 +219,9 @@ class DownloadTask
       desc "Clone win32-service repository and create a tarball"
       task :win32_service => [@file_win32_service_archive]
 
+      desc "Clone ffi-win32-extensions repository and create a tarball"
+      task :ffi_win32_extensions => [@file_ffi_win32_extensions_archive]
+
       desc "Download ruby gems"
       task :ruby_gems => @files_ruby_gems
 
@@ -340,6 +345,21 @@ class DownloadTask
     end
   end
 
+  def define_ffi_win32_extensions_archive
+    @file_ffi_win32_extensions_archive = File.join(DOWNLOADS_DIR, "ffi-win32-extensions.tar.gz")
+    file @file_ffi_win32_extensions_archive do
+      ensure_directory(DOWNLOADS_DIR) do
+        dirname = "ffi-win32-extensions"
+        rm_rf(dirname) if File.exist?(dirname)
+        sh("git", "clone", "https://github.com/fluent-plugins-nursery/ffi-win32-extensions.git")
+        cd("ffi-win32-extensions") do
+          sh("git", "checkout", "fluent-package")
+        end
+        sh(*tar_command, "cvfz", "#{dirname}.tar.gz", dirname)
+      end
+    end
+  end
+
   def define_gem_files
     paths = []
     Dir.glob("#{DOWNLOADS_DIR}/*.gem") do |path|
@@ -445,7 +465,7 @@ class BuildTask
       end
 
       desc "Install ruby gems"
-      task :ruby_gems => windows? ? [:"download:ruby_gems", :fluentd, :win32_service] : [:"download:ruby_gems", :fluentd] do
+      task :ruby_gems => windows? ? [:"download:ruby_gems", :fluentd, :win32_service, :ffi_win32_extensions] : [:"download:ruby_gems", :fluentd] do
         puts "::group::Install ruby gems" if ENV["CI"]
         gem_install("bundler", BUNDLER_VERSION)
 
@@ -496,6 +516,19 @@ class BuildTask
         end
       end
 
+      desc "Install ffi-win32-extensions"
+      task :ffi_win32_extensions => [:"download:ffi_win32_extensions"] do
+        cd(DOWNLOADS_DIR) do
+          tar_options = ["--no-same-owner", "--force-local"]
+          archive_path = @download_task.file_ffi_win32_extensions_archive
+          sh(*tar_command, "xvf", archive_path, *tar_options) unless File.exist?("ffi-win32-extensions")
+          cd("win32-extensions") do
+            sh("rake", "build")
+            setup_local_gem_repo
+          end
+        end
+      end
+
       desc "Install all gems"
       task :gems => [:ruby_gems]