Quickwit 0.9.2 security release

[dayaffe]

Quickwit 0.9.2 is out with two security fixes:

• Kafka source command execution (GHSA-g85h-2988-4cv8): some Kafka client_params could run commands on Quickwit nodes. It affects the Linux release binaries 0.4.0–0.9.1 and the 0.4.0 Docker image, even if you don't use Kafka sources. Docker images 0.5.0 and later are not affected.
• Oversized columnar dictionaries (Tantivy GHSA-7pph-m7rw-cqhv): merges now reject them.

Should I upgrade ASAP? The Kafka advisory is rated Critical because its score assumes the Quickwit API is reachable by an attacker. Exploiting it requires access to the Quickwit API, and Quickwit doesn't authenticate clients unless mutual TLS is enabled, so it should always run on a trusted network or behind an authenticated proxy, never directly on the internet. If your deployment already works that way, the risk is much lower, but you should still upgrade soon. If your API is reachable from an untrusted network, restrict access and upgrade now.

Kerberos users: Kafka sources using sasl.mechanisms: GSSAPI no longer run kinit automatically. Set QW_KAFKA_KINIT_CMD or renew tickets outside Quickwit.

Release: https://github.com/quickwit-oss/quickwit/releases/tag/v0.9.2