fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.8 by tinfoild[bot] · Pull Request #5968 · JJGadgets/Biohazard

tinfoild · 2026-06-03T05:48:45Z

This PR contains the following updates:

Package	Update	Change	OpenSSF
cr.fluentbit.io/fluent/fluent-bit	patch	`4.2.4` → `4.2.8`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

fluent/fluent-bit (cr.fluentbit.io/fluent/fluent-bit)

`v4.2.8`: Fluent Bit 4.2.8

Compare Source

https://fluentbit.io/announcements/v4.2.8/

What's Changed

release: update to 4.2.8 by @github-actions[bot] in #12075
in_winevtlog: Enrich EventData key-value map if enabled [Backport to 4.2] by @cosmo0920 in #12161
out_stackdriver: fix payload parsing over-reads and null safety [Backport to 4.2] by @baizhenyu in #12170
avro: out_kakfa: handle empty map even if avro schema defines map type [Backport to 4.2] by @cosmo0920 in #12209

Full Changelog: fluent/fluent-bit@v4.2.7...v4.2.8

`v4.2.7`: Fluent Bit 4.2.7

Compare Source

https://fluentbit.io/announcements/v4.2.7/

What's Changed

release: update to 4.2.7 by @github-actions[bot] in #12005
releasse: Update version to v4.2.7 [4.2 branch] by @cosmo0920 in #12015
github: workflows: Use semver and timestamp suffixes to distinguish branches [Backport to 4.2] by @cosmo0920 in #12017
lib: librdkafka: Upgrade to v2.15.0 [Backport to 4.2] by @cosmo0920 in #12050
in_forward: validate PING is a msgpack array in check_ping [Backport to 4.2] by @cosmo0920 in #12051
out_forward: align secure forward handshake and chunk ack with protocol spec [Backport to 4.2] by @cosmo0920 in #12052
gzip: read magic number endian-safely in streaming decompressor [Backport to 4.2] by @cosmo0920 in #12056
in_forward: fix 100% CPU hang and connection teardown use-after-free [Backport to 4.2] by @cosmo0920 in #12053
in_splunk: return Splunk HEC auth status codes [Backport to 4.2] by @cosmo0920 in #12071

Full Changelog: fluent/fluent-bit@v4.2.6...v4.2.7

`v4.2.6`: Fluent Bit 4.2.6

Compare Source

https://fluentbit.io/announcements/v4.2.6/

What's Changed

release: update to 4.2.6 by @github-actions[bot] in #11907
workflows: Windows docker insufficient disk space fix [Backport to 4.2] by @cosmo0920 in #11906
time: time_tz: Handle conversion rules of windows and IANA tzinfo [Back port to 4.2] by @cosmo0920 in #11911
out_stackdriver: fix multiple memory leaks and potential corruption [Backport to 4.2] by @baizhenyu in #11916
parser: Add IANA time_zone support for native timestamps [Backport to 4.2] by @cosmo0920 in #11919
oauth2: harden token refresh parsing [Backport to 4.2] by @baizhenyu in #11923
dockerfiles: windows: fixed VS Build Tools installation [Backport to 4.2] by @cosmo0920 in #11920
workflows: Windows Docker insufficient disk space fix (2nd attempt) [Backport to 4.2] by @cosmo0920 in #11927
out_stackdriver: backport codeowners change by @braydonk in #11921
github: workflows: Process unit tests on 4.2 branch [Backport to 4.2] by @cosmo0920 in #11932
github: workflows: Specify OS configs explicitly [Backport to 4.2] by @cosmo0920 in #11935
regex: Plug a regex literal crash [Backport to 4.2] by @cosmo0920 in #11946
in_windows_exporter_metrics: Plug bitwise glitches on 32bit oses [Backport to 4.2] by @cosmo0920 in #11947
unicode: Use the correct maximum size of Cyrillic [Backport to 4.2] by @cosmo0920 in #11929
out_forward: process type and length of pong strictly [Backport to 4.2] by @cosmo0920 in #11949
node_exporter_metrics: Add file path to error messages [Backport to 4.2] by @cosmo0920 in #11992
out_es/out_opensearch: sanitize bulk action metadata [Backport to 4.2] by @cosmo0920 in #11993
tests: runtime: Try to eliminate flakyness on CI load [Backport to 4.2] by @cosmo0920 in #11994
scheduler: Plug FD leaks on destroy [Backport to 4.2] by @cosmo0920 in #12001

Full Changelog: fluent/fluent-bit@v4.2.5...v4.2.6

`v4.2.5`: Fluent Bit 4.2.5

Compare Source

https://fluentbit.io/announcements/v4.2.5/

What's Changed

release: update to 4.2.5 by @github-actions[bot] in #11697
packaging: add support for Ubuntu 26.04 (backport to 4.2) by @patrick-stephens in #11803
backport: env: add bash-style default value operator :- by @benjaminmueggenburg-serato in #11806
out_chronicle: Support label and namespace mapping [Backport to 4.2] by @cosmo0920 in #11837
input_thread: replace raw read() with pipe abstraction to fix crash [Backport to 4.2] by @cosmo0920 in #11860
aws: compression: arrow: Set up proper block size [Backport to 4.2] by @cosmo0920 in #11861
network: Handle braketed ipv6 addresses [backport to 4.2] by @cosmo0920 in #11862
parser: Address wrong assignments of timezone at midnight [Backport to 4.2] by @cosmo0920 in #11863
routing: fix issue with missing input alias [Backport to 4.2] by @cosmo0920 in #11864
out_influxdb: plug tag keys failure on out influxdb [Backport to 4.2] by @cosmo0920 in #11865
utils: fix integer divide-by-zero on Windows x64 in bytes_to_human_readable_size [Backport to 4.2] by @cosmo0920 in #11866
filter_kubernetes: don't recycle connections in fetch_pod_service_map [Backport to 4.2] by @cosmo0920 in #11867
in_tail: fix file append cleanup on failure [Backport to 4.2] by @cosmo0920 in #11871
filter_kubernetes: destroy TLS session to prevent SSL object leak [Backport to 4.2] by @cosmo0920 in #11868
filter_kubernetes: destroy upstream and TLS context on happy path exit [Backport to 4.2] by @cosmo0920 in #11869
engine: ignore duplicate STOP to prevent shutdown spin [Backport to 4.2] by @cosmo0920 in #11870
in_dummy: Use pre_run callback to fix crash path [Backport to 4.2] by @cosmo0920 in #11872
out_logdna: remove promoted known keys [Backport to 4.2] by @cosmo0920 in #11873
crypto: fix build with OPENSSL_NO_ENGINE [Backport to 4.2] by @cosmo0920 in #11874
out_azure_logs_ingestion: Plug SEGV on termination [Backport to 4.2] by @cosmo0920 in #11875
in_forward: handle unpacker allocation failure [Backport to 4.2] by @cosmo0920 in #11881
tests: runtime: wait for tail truncate output [Backport to 4.2] by @cosmo0920 in #11882
avro: Handle int64 values correctly [Backport to 4.2] by @cosmo0920 in #11892
mp: fixed count when empty data by @edsiper in #11894
in_collectd: reject parts with length < 4 and fix null-terminator OOB [Backport to 4.2] by @cosmo0920 in #11896
in_forward: validate array size before accessing message mode fields [Backport to 4.2] by @cosmo0920 in #11897
in_syslog: fix integer overflow in octet-counting length parser [Backport to 4.2] by @cosmo0920 in #11898
in_mqtt: fix OOB read from hardcoded remaining length overhead [Backport to 4.2] by @cosmo0920 in #11899
zstd: cap buffer at max instead of aborting on overshoot [Backport to 4.2] by @cosmo0920 in #11900
snappy: read frame length as 3 bytes to avoid OOB at boundary [Backport to 4.2] by @cosmo0920 in #11901
in_elasticsearch: check map size before accessing first entry [Backport to 4.2] by @cosmo0920 in #11902

Full Changelog: fluent/fluent-bit@v4.2.4...v4.2.5

Configuration

📅 Schedule: (in timezone Asia/Singapore)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

cloudflare-workers-and-pages · 2026-06-03T05:49:33Z

Deploying jjgadgets-biohazard with Cloudflare Pages

Latest commit:	`1f165a7`
Status:	🚫 Build failed.

View logs

tinfoild · 2026-06-03T05:50:24Z

kube/kustomization/out00

--- kube/deploy/core/monitoring/fluentbit/app Kustomization: flux-system/fluentbit-app HelmRelease: fluentbit/fluentbit

+++ kube/deploy/core/monitoring/fluentbit/app Kustomization: flux-system/fluentbit-app HelmRelease: fluentbit/fluentbit

@@ -57,13 +57,13 @@

                 valueFrom:
                   fieldRef:
                     fieldPath: spec.nodeName
               TZ: null
             image:
               repository: cr.fluentbit.io/fluent/fluent-bit
-              tag: 4.2.4@sha256:f0d24db349929c1b9fd655384278c687993070c3ba325490f130fae12aa9d60c
+              tag: 4.2.5@sha256:76d5a62479523c2ad54142ee2d93b1fd44fa06b96eae483fbf2e5f1f67a870fc
             ports:
             - containerPort: 8080
               name: metrics
             resources:
               limits:
                 cpu: '1'
@@ -87,13 +87,13 @@

                 valueFrom:
                   fieldRef:
                     fieldPath: spec.nodeName
               TZ: null
             image:
               repository: cr.fluentbit.io/fluent/fluent-bit
-              tag: 4.2.4@sha256:f0d24db349929c1b9fd655384278c687993070c3ba325490f130fae12aa9d60c
+              tag: 4.2.5@sha256:76d5a62479523c2ad54142ee2d93b1fd44fa06b96eae483fbf2e5f1f67a870fc
             ports:
             - containerPort: 8080
               name: metrics
             resources:
               limits:
                 cpu: '1'
@@ -128,13 +128,13 @@

                 valueFrom:
                   fieldRef:
                     fieldPath: spec.nodeName
               TZ: null
             image:
               repository: cr.fluentbit.io/fluent/fluent-bit
-              tag: 4.2.4@sha256:f0d24db349929c1b9fd655384278c687993070c3ba325490f130fae12aa9d60c
+              tag: 4.2.5@sha256:76d5a62479523c2ad54142ee2d93b1fd44fa06b96eae483fbf2e5f1f67a870fc
             ports:
             - containerPort: 8080
               name: metrics
             resources:
               limits:
                 cpu: '1'

tinfoild · 2026-06-26T05:34:10Z

kube/helmrelease/out00

--- HelmRelease: fluentbit/fluentbit DaemonSet: fluentbit/fluentbit-dmesg

+++ HelmRelease: fluentbit/fluentbit DaemonSet: fluentbit/fluentbit-dmesg

@@ -56,13 +56,13 @@

         - name: KUBE_NODE_NAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: TZ
           value: null
-        image: cr.fluentbit.io/fluent/fluent-bit:4.2.4@sha256:f0d24db349929c1b9fd655384278c687993070c3ba325490f130fae12aa9d60c
+        image: cr.fluentbit.io/fluent/fluent-bit:4.2.8@sha256:6806769c10acf11b41d14083b3101a24433b4ca113a1ab7a6b1a1b7cad86a7e8
         name: app
         ports:
         - containerPort: 8080
           name: metrics
         resources:
           limits:
--- HelmRelease: fluentbit/fluentbit DaemonSet: fluentbit/fluentbit-kubernetes

+++ HelmRelease: fluentbit/fluentbit DaemonSet: fluentbit/fluentbit-kubernetes

@@ -56,13 +56,13 @@

         - name: KUBE_NODE_NAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: TZ
           value: null
-        image: cr.fluentbit.io/fluent/fluent-bit:4.2.4@sha256:f0d24db349929c1b9fd655384278c687993070c3ba325490f130fae12aa9d60c
+        image: cr.fluentbit.io/fluent/fluent-bit:4.2.8@sha256:6806769c10acf11b41d14083b3101a24433b4ca113a1ab7a6b1a1b7cad86a7e8
         name: app
         ports:
         - containerPort: 8080
           name: metrics
         resources:
           limits:
--- HelmRelease: fluentbit/fluentbit Deployment: fluentbit/fluentbit-fortigate

+++ HelmRelease: fluentbit/fluentbit Deployment: fluentbit/fluentbit-fortigate

@@ -56,13 +56,13 @@

         - name: KUBE_NODE_NAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: TZ
           value: null
-        image: cr.fluentbit.io/fluent/fluent-bit:4.2.4@sha256:f0d24db349929c1b9fd655384278c687993070c3ba325490f130fae12aa9d60c
+        image: cr.fluentbit.io/fluent/fluent-bit:4.2.8@sha256:6806769c10acf11b41d14083b3101a24433b4ca113a1ab7a6b1a1b7cad86a7e8
         name: app
         ports:
         - containerPort: 8080
           name: metrics
         resources:
           limits:

ciel-shieru · 2026-07-23T21:29:50Z

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-23 21:27 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5968 — fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.7
📦 Package: fluent-bit
🔍 Sources: NVD, OSV.dev, GHSA, CISA KEV

Results

Package: fluent-bit

Old version: 4.2.4

Old version: 4.2.4 — VULNERABLE (7 findings)

Vulnerabilities in version 4.2.4

CVE-2021-36088 — Severity: CRITICAL (9.8) - Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_pa - Source: NVD
CVE-2021-36088 — Severity: CRITICAL (9.8) - Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_pa - Source: NVD
CVE-2021-36088 — Severity: CRITICAL (9.8) - Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_pa - Source: NVD
CVE-2021-36088 — Severity: CRITICAL (9.8) - Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_pa - Source: NVD
CVE-2024-26455 — Severity: HIGH (7.5) - fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c. - Source: NVD
CVE-2025-29477 — Severity: MEDIUM (5.5) - An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event. - Source: NVD
CVE-2025-29478 — Severity: MEDIUM (5.5) - An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h: - Source: NVD

New version: 4.2.7

New version: 4.2.7 — No known vulnerabilities found

Severity Summary

Severity	Count
Total findings	7

Recommendations

Review the findings above and take appropriate action.
Merge this PR to apply version updates which may include security fixes.

⚠️ This comment was posted by an automated security scanner (Ciel).

ciel-shieru · 2026-07-24T01:09:42Z

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 01:09 UTC
🤖 Scanner: Ciel Security Scanner (fast mode: OSV.dev + NVD + GHSA)
🔗 PR: #5968 — fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.7
📦 Package: cr.fluentbit.io-fluent-fluent-bit (ecosystem: container)
📊 Versions: old=? → new=4.2.7

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	0
LOW	1
UNKNOWN / NEEDS VERIFICATION	0
Total	1

Results

Package: `cr.fluentbit.io-fluent-fluent-bit`

Old version: unknown
New version: 4.2.7
Ecosystem: container

Raw findings (truncated)

=== NEW: 4.2.7 ===
=== OSV.dev query for cr.fluentbit.io-fluent-fluent-bit@4.2.7 (ecosystem: container) ===
No vulnerabilities found on OSV.dev for cr.fluentbit.io-fluent-fluent-bit@4.2.7

=== NVD query for 'cr.fluentbit.io-fluent-fluent-bit' (version filter: 4.2.7) ===
No CVEs found on NVD for keyword: cr.fluentbit.io-fluent-fluent-bit

=== GHSA query for cr.fluentbit.io-fluent-fluent-bit (ecosystem: container) ===
{"message":"Invalid request.\n\nInvalid input: `container` is not a possible value. Must be one of the following: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift.","documentation_url":"https://docs.github.com/rest/security-advisories/global-advisories#list-global-security-advisories","status":"422"}No GHSA advisories found

Recommendations

Review the findings above before merging.
Verify version-range applicability of each CVE before treating as actionable.

⚠️ This comment was posted by an automated security scanner (Ciel, fast mode).
To re-scan, trigger the renovate-security-scanner skill.

tinfoild Bot added kube/deploy/core renovate/datasource/docker renovate/type/patch labels Jun 3, 2026

tinfoild Bot force-pushed the renovate/cr.fluentbit.io-fluent-fluent-bit-4.2.x branch from 2eea6ce to 17733f1 Compare June 8, 2026 20:58

tinfoild Bot force-pushed the renovate/cr.fluentbit.io-fluent-fluent-bit-4.2.x branch 2 times, most recently from 1609cae to 1323af9 Compare June 26, 2026 05:32

tinfoild Bot changed the title ~~fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.5~~ fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.6 Jun 26, 2026

tinfoild Bot force-pushed the renovate/cr.fluentbit.io-fluent-fluent-bit-4.2.x branch from 1323af9 to d2f396c Compare July 9, 2026 08:28

tinfoild Bot changed the title ~~fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.6~~ fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.7 Jul 9, 2026

tinfoild Bot force-pushed the renovate/cr.fluentbit.io-fluent-fluent-bit-4.2.x branch from d2f396c to 30ba9d3 Compare July 20, 2026 10:10

fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.8

1f165a7

tinfoild Bot force-pushed the renovate/cr.fluentbit.io-fluent-fluent-bit-4.2.x branch from 30ba9d3 to 1f165a7 Compare August 4, 2026 07:46

tinfoild Bot changed the title ~~fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.7~~ fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.8 Aug 4, 2026

Navigation Menu

Repository navigation

fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.8 - #5968

fix(oci/fluent-bit): update 4.2.4 ➼ 4.2.8#5968
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/cr.fluentbit.io-fluent-fluent-bit-4.2.x

tinfoild Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

tinfoild Bot commented Jun 3, 2026

Uh oh!

tinfoild Bot commented Jun 26, 2026 •

edited

Loading

Uh oh!

ciel-shieru commented Jul 23, 2026

Uh oh!

ciel-shieru commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

tinfoild Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.2.8: Fluent Bit 4.2.8

What's Changed

v4.2.7: Fluent Bit 4.2.7

What's Changed

v4.2.6: Fluent Bit 4.2.6

What's Changed

v4.2.5: Fluent Bit 4.2.5

What's Changed

Configuration

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying jjgadgets-biohazard with Cloudflare Pages

Uh oh!

tinfoild Bot commented Jun 3, 2026

kube/kustomization/out00

Uh oh!

tinfoild Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

kube/helmrelease/out00

Uh oh!

ciel-shieru commented Jul 23, 2026

Results

Package: fluent-bit

Vulnerabilities in version 4.2.4

Severity Summary

Recommendations

Uh oh!

ciel-shieru commented Jul 24, 2026

Severity Summary

Results

Package: cr.fluentbit.io-fluent-fluent-bit

Raw findings (truncated)

Recommendations

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

tinfoild Bot commented Jun 3, 2026 •

edited

Loading

`v4.2.8`: Fluent Bit 4.2.8

`v4.2.7`: Fluent Bit 4.2.7

`v4.2.6`: Fluent Bit 4.2.6

`v4.2.5`: Fluent Bit 4.2.5

cloudflare-workers-and-pages Bot commented Jun 3, 2026 •

edited

Loading

tinfoild Bot commented Jun 26, 2026 •

edited

Loading

Package: `cr.fluentbit.io-fluent-fluent-bit`