Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Errno::EACCES which occurs while testing on Ruby 3.2 #3883

Merged
merged 8 commits into from
Sep 2, 2022
Merged

Fix Errno::EACCES which occurs while testing on Ruby 3.2 #3883

merged 8 commits into from
Sep 2, 2022

Conversation

ashie
Copy link
Member

@ashie ashie commented Sep 1, 2022 •
edited
Loading

Which issue(s) this PR fixes:
ref #3869

What this PR does / why we need it:
FileUtils.rm_rf of Ruby 3.2 no longer ignore Errno::EACCES:
ruby/ruby@983115c

But it will occur on Windows test because of delete pending state.
Most of them can be fixed by adding File::Constants::SHARE_DELETE on calling File.open.
Fluent::FileWrapper.open will do it, so I replace File.open in failed test with it.

But tests including LogDevice can't use it easily.
For such tests, simply ignore Errno::EACCES as ever.
(To avoid using a same temp file between different tests, create random temp directory instead.)

Please note that remaining 1 test on Ruby 3.2 Windows still fails because there is another issue: #3869 (comment)
I'll investigate it later.

Docs Changes:
None

Release Note:
Same with the title

ashie added 2 commits September 1, 2022 14:54
@ashie
Move lib/fluent/plugin/file_wrapper.rb to lib/fluent
531824a 
It doesn't use the name space `Fluent::Plugin`, and seems useful for
global usage rather than only for plugin.

Signed-off-by: Takuro Ashie <[email protected]>
@ashie
Define Fluent::FileWrapper at file_wrapper.rb even on non-Windows
77472a9 
Signed-off-by: Takuro Ashie <[email protected]>
@ashie ashie force-pushed the fix-rm-rf-on-windows branch from 2679a9e to 918e478 Compare September 1, 2022 07:31
ashie added 4 commits September 1, 2022 17:23
@ashie
Use Fluent::FileWrapper.open instead of File.open to create test files
2e4f3db 
Try to fix Errno::EACESS on deleting test files, because
`FileUtils.rm_rf` of Ruby 3.2 doesn't ignore it.

Signed-off-by: Takuro Ashie <[email protected]>
@ashie
FileWrapper::WindowsFile: Support encoding parameter
af7972a 
Signed-off-by: Takuro Ashie <[email protected]>
@ashie
test_log: Suppress Errno::EACCES error on Ruby 3.2
4ddf423 
Signed-off-by: Takuro Ashie <[email protected]>
@ashie
test_supervisor: Suppress Errno::EACCES error on Ruby 3.2
c068a32 
Signed-off-by: Takuro Ashie <[email protected]>
@ashie ashie force-pushed the fix-rm-rf-on-windows branch from 918e478 to 0bc1db5 Compare September 1, 2022 08:44
@ashie ashie force-pushed the fix-rm-rf-on-windows branch from 0bc1db5 to f70cb60 Compare September 1, 2022 09:04
@ashie ashie changed the title Try to fix Errno::EACCES which occurs while testing on Ruby 3.2 Fix Errno::EACCES which occurs while testing on Ruby 3.2 Sep 1, 2022
@ashie ashie force-pushed the fix-rm-rf-on-windows branch from f0c66d9 to f70cb60 Compare September 1, 2022 09:59
@ashie
test_in_tail: Don't remove pos file before shutdown
9e34c1b 
It can't removed on Windows and `Errno::EACCES` isn't ignored as of Ruby
3.2.

Signed-off-by: Takuro Ashie <[email protected]>
@ashie ashie marked this pull request as ready for review September 1, 2022 13:30
@ashie ashie requested a review from cosmo0920 September 1, 2022 13:34
cosmo0920
cosmo0920 approved these changes Sep 2, 2022
View reviewed changes
Copy link
Contributor

@cosmo0920 cosmo0920 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. And I didn't notice that Ruby 3.2 won't ignore Errno::EACCES anymore.

test/command/test_fluentd.rb
Comment on lines +27 to +35
teardown do
begin
FileUtils.rm_rf(@tmp_dir)
rescue Errno::EACCES
# It may occur on Windows because of delete pending state due to delayed GC.
# Ruby 3.2 or later doesn't ignore Errno::EACCES:
# https://github.com/ruby/ruby/commit/983115cf3c8f75b1afbe3274f02c1529e1ce3a81
end
end
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

test/test_log.rb
Comment on lines +27 to +33
begin
FileUtils.rm_rf(@tmp_dir)
rescue Errno::EACCES
# It may occur on Windows because of delete pending state due to delayed GC.
# Ruby 3.2 or later doesn't ignore Errno::EACCES:
# https://github.com/ruby/ruby/commit/983115cf3c8f75b1afbe3274f02c1529e1ce3a81
end
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

test/test_supervisor.rb
Comment on lines +37 to +44
def teardown
begin
FileUtils.rm_rf(@tmp_dir)
rescue Errno::EACCES
# It may occur on Windows because of delete pending state due to delayed GC.
# Ruby 3.2 or later doesn't ignore Errno::EACCES:
# https://github.com/ruby/ruby/commit/983115cf3c8f75b1afbe3274f02c1529e1ce3a81
end
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@ashie
Copy link
Member Author

ashie commented Sep 2, 2022

Thanks!

@ashie ashie merged commit c0f1db9 into master Sep 2, 2022
@ashie ashie deleted the fix-rm-rf-on-windows branch September 2, 2022 02:06
@sastorsl sastorsl mentioned this pull request Nov 10, 2022
Merged
kavirajk referenced this pull request in grafana/loki Oct 10, 2023
@renovate
chore(deps): update dependency fluentd to v1.15.3 [security] (main) (#…
b2c4511 
…10839)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [fluentd](https://www.fluentd.org/)
([source](https://togithub.com/fluent/fluentd)) | `'1.14.2'` ->
`'1.15.3'` |
[![age](https://developer.mend.io/api/mc/badges/age/rubygems/fluentd/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/rubygems/fluentd/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/rubygems/fluentd/'1.14.2'/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/fluentd/'1.14.2'/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2022-39379](https://togithub.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2)

### Impact
A remote code execution (RCE) vulnerability in non-default
configurations of Fluentd allows unauthenticated attackers to execute
arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable
`FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd
version 1.13.2. Earlier versions of Fluentd are not affected by this
vulnerability.

### Patches
v1.15.3

### Workarounds
Do not use `FLUENT_OJ_OPTION_MODE=object`.

### References

* GHSL-2022-067

---

### Release Notes

<details>
<summary>fluent/fluentd (fluentd)</summary>

###
[`v1.15.3`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1153---20221102)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.15.2...v1.15.3)

##### Bug Fix

-   Support glob for `!include` directive in YAML config format

[https://github.com/fluent/fluentd/pull/3917](https://togithub.com/fluent/fluentd/pull/3917)3917
-   Remove meaningless oj options

[https://github.com/fluent/fluentd/pull/3929](https://togithub.com/fluent/fluentd/pull/3929)3929
-   Fix log initializer to correctly create per-process files on Windows

[https://github.com/fluent/fluentd/pull/3939](https://togithub.com/fluent/fluentd/pull/3939)3939
-   out_file: Fix the multi-worker check with `<worker 0-N>` directive

[https://github.com/fluent/fluentd/pull/3942](https://togithub.com/fluent/fluentd/pull/3942)3942

##### Misc

-   Fix broken tests on Ruby 3.2

[https://github.com/fluent/fluentd/pull/3883](https://togithub.com/fluent/fluentd/pull/3883)3[https://github.com/fluent/fluentd/pull/3922](https://togithub.com/fluent/fluentd/pull/3922)ull/3922

###
[`v1.15.2`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1152---20220822)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.15.1...v1.15.2)

##### Enhancement

-   Add a new system configuration `enable_jit`

[https://github.com/fluent/fluentd/pull/3857](https://togithub.com/fluent/fluentd/pull/3857)3857

##### Bug Fix

-   out_file: Fix append mode with `--daemon` flag

[https://github.com/fluent/fluentd/pull/3864](https://togithub.com/fluent/fluentd/pull/3864)3864
-   child_process: Plug file descriptor leak

[https://github.com/fluent/fluentd/pull/3844](https://togithub.com/fluent/fluentd/pull/3844)3844

##### Misc

-   Drop win32-api gem to support Ruby 3.2

[https://github.com/fluent/fluentd/pull/3849](https://togithub.com/fluent/fluentd/pull/3849)3[https://github.com/fluent/fluentd/pull/3866](https://togithub.com/fluent/fluentd/pull/3866)ull/3866

###
[`v1.15.1`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1151---20220727)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.15.0...v1.15.1)

##### Bug Fix

-   Add support for concurrent append in out_file

[https://github.com/fluent/fluentd/pull/3808](https://togithub.com/fluent/fluentd/pull/3808)3808

##### Misc

-   in_tail: Show more information on skipping update_watcher

[https://github.com/fluent/fluentd/pull/3829](https://togithub.com/fluent/fluentd/pull/3829)3829

###
[`v1.15.0`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1150---20220629)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.6...v1.15.0)

##### Enhancement

-   in_tail: Add log throttling in files based on group rules

[https://github.com/fluent/fluentd/pull/3535](https://togithub.com/fluent/fluentd/pull/3535)3[https://github.com/fluent/fluentd/pull/3771](https://togithub.com/fluent/fluentd/pull/3771)ull/3771
-   Add `dump` command to fluent-ctl

[https://github.com/fluent/fluentd/pull/3680](https://togithub.com/fluent/fluentd/pull/3680)3680
-   Handle YAML configuration format on configuration file

[https://github.com/fluent/fluentd/pull/3712](https://togithub.com/fluent/fluentd/pull/3712)3712
- Add `restart_worker_interval` parameter in `<system>` directive to set
interval to restart workers that has stopped for some
reas[https://github.com/fluent/fluentd/pull/3768](https://togithub.com/fluent/fluentd/pull/3768)ull/3768

##### Bug fixes

-   out_forward: Fix to update timeout of cached sockets

[https://github.com/fluent/fluentd/pull/3711](https://togithub.com/fluent/fluentd/pull/3711)3711
- in_tail: Fix a possible crash on file rotation when `follow_inodes
true`

[https://github.com/fluent/fluentd/pull/3754](https://togithub.com/fluent/fluentd/pull/3754)3754
-   output: Fix a possible crash of flush thread

[https://github.com/fluent/fluentd/pull/3755](https://togithub.com/fluent/fluentd/pull/3755)3755
-   in_tail: Fix crash bugs on Ruby 3.1 on Windows

[https://github.com/fluent/fluentd/pull/3766](https://togithub.com/fluent/fluentd/pull/3766)3766
- in_tail: Fix a bug that in_tail cannot open non-ascii path on Windows

[https://github.com/fluent/fluentd/pull/3774](https://togithub.com/fluent/fluentd/pull/3774)3774
- Fix a bug that fluentd doesn't release its own log file even after
rotated by
external
to[https://github.com/fluent/fluentd/pull/3782](https://togithub.com/fluent/fluentd/pull/3782)ull/3782

##### Misc

-   in_tail: Simplify TargetInfo related code

[https://github.com/fluent/fluentd/pull/3489](https://togithub.com/fluent/fluentd/pull/3489)3489
-   Fix a wrong issue number in CHANGELOG

[https://github.com/fluent/fluentd/pull/3700](https://togithub.com/fluent/fluentd/pull/3700)3700
-   server helper: Add comments to linger_timeout behavior about Windows

[https://github.com/fluent/fluentd/pull/3701](https://togithub.com/fluent/fluentd/pull/3701)3701
-   service_discovery: Fix typo

[https://github.com/fluent/fluentd/pull/3724](https://togithub.com/fluent/fluentd/pull/3724)3724
-   test: Fix unstable tests and warnings

[https://github.com/fluent/fluentd/pull/3745](https://togithub.com/fluent/fluentd/pull/3745)3[https://github.com/fluent/fluentd/pull/3753](https://togithub.com/fluent/fluentd/pull/3753)u[https://github.com/fluent/fluentd/pull/3767](https://togithub.com/fluent/fluentd/pull/3767)t[https://github.com/fluent/fluentd/pull/3783](https://togithub.com/fluent/fluentd/pull/3783)l[https://github.com/fluent/fluentd/pull/3784](https://togithub.com/fluent/fluentd/pull/3784)n[https://github.com/fluent/fluentd/pull/3785](https://togithub.com/fluent/fluentd/pull/3785)f[https://github.com/fluent/fluentd/pull/3787](https://togithub.com/fluent/fluentd/pull/3787)com/fluent/fluentd/pull/3787

###
[`v1.14.6`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1146---20220331)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.5...v1.14.6)

##### Enhancement

-   Enable server plugins to specify socket-option `SO_LINGER`

[https://github.com/fluent/fluentd/pull/3644](https://togithub.com/fluent/fluentd/pull/3644)3644
-   Add `--umask` command line parameter

[https://github.com/fluent/fluentd/pull/3671](https://togithub.com/fluent/fluentd/pull/3671)3[https://github.com/fluent/fluentd/pull/3679](https://togithub.com/fluent/fluentd/pull/3679)ull/3679

##### Bug fixes

-   Fix metric name typo

[https://github.com/fluent/fluentd/pull/3630](https://togithub.com/fluent/fluentd/pull/3630)3[https://github.com/fluent/fluentd/pull/3673](https://togithub.com/fluent/fluentd/pull/3673)ull/3673
- Apply modifications in pipeline to the records being passed to
`@ERROR` label

[https://github.com/fluent/fluentd/pull/3631](https://togithub.com/fluent/fluentd/pull/3631)3631
-   Fix wrong calculation of retry interval

[https://github.com/fluent/fluentd/pull/3640](https://togithub.com/fluent/fluentd/pull/3640)3[https://github.com/fluent/fluentd/pull/3649](https://togithub.com/fluent/fluentd/pull/3649)u[https://github.com/fluent/fluentd/pull/3685](https://togithub.com/fluent/fluentd/pull/3685)t[https://github.com/fluent/fluentd/pull/3686](https://togithub.com/fluent/fluentd/pull/3686)luentd/pull/3686
-   Support IPv6 address for `rpc_endpoint` in `system` config

[https://github.com/fluent/fluentd/pull/3641](https://togithub.com/fluent/fluentd/pull/3641)3641

##### Misc

-   CI: Support Ruby 3.1 except Windows

[https://github.com/fluent/fluentd/pull/3619](https://togithub.com/fluent/fluentd/pull/3619)3619
-   Switch to GitHub Discussions

[https://github.com/fluent/fluentd/pull/3654](https://togithub.com/fluent/fluentd/pull/3654)3654
-   Fix CHANGELOG.md heading styles

[https://github.com/fluent/fluentd/pull/3648](https://togithub.com/fluent/fluentd/pull/3648)3648
-   Declare `null_value_pattern` as `regexp`

[https://github.com/fluent/fluentd/pull/3650](https://togithub.com/fluent/fluentd/pull/3650)3650

###
[`v1.14.5`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1145---20220209)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.4...v1.14.5)

##### Enhancement

-   Add support for "application/x-ndjson" to `in_http`

[https://github.com/fluent/fluentd/pull/3616](https://togithub.com/fluent/fluentd/pull/3616)3616
-   Add support for ucrt binary for Windows

[https://github.com/fluent/fluentd/pull/3613](https://togithub.com/fluent/fluentd/pull/3613)3613

##### Bug fixes

-   Don't retry when `retry_max_times == 0`

[https://github.com/fluent/fluentd/pull/3608](https://togithub.com/fluent/fluentd/pull/3608)3608
-   Fix hang-up issue during TLS handshake in `out_forward`

[https://github.com/fluent/fluentd/pull/3601](https://togithub.com/fluent/fluentd/pull/3601)3601
-   Bump up required ServerEngine to v2.2.5

[https://github.com/fluent/fluentd/pull/3599](https://togithub.com/fluent/fluentd/pull/3599)3599
-   Fix "invalid byte sequence is replaced" warning on Kubernetes

[https://github.com/fluent/fluentd/pull/3596](https://togithub.com/fluent/fluentd/pull/3596)3596
- Fix "ArgumentError: unknown keyword: :logger" on Windows with Ruby 3.1

[https://github.com/fluent/fluentd/pull/3592](https://togithub.com/fluent/fluentd/pull/3592)3592

###
[`v1.14.4`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1144---20220106)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.3...v1.14.4)

##### Enhancement

-   `in_tail`: Add option to skip long lines (`max_line_size`)

[https://github.com/fluent/fluentd/pull/3565](https://togithub.com/fluent/fluentd/pull/3565)3565

##### Bug fix

- Incorrect BufferChunkOverflowError when each event size is <
`chunk_limit_size`

[https://github.com/fluent/fluentd/pull/3560](https://togithub.com/fluent/fluentd/pull/3560)3560
- On macOS with Ruby 2.7/3.0, `out_file` fails to write events if
`append` is true.

[https://github.com/fluent/fluentd/pull/3579](https://togithub.com/fluent/fluentd/pull/3579)3579
-   test: Fix unstable test cases

[https://github.com/fluent/fluentd/pull/3574](https://togithub.com/fluent/fluentd/pull/3574)3[https://github.com/fluent/fluentd/pull/3577](https://togithub.com/fluent/fluentd/pull/3577)ull/3577

###
[`v1.14.3`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1143---20211126)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.2...v1.14.3)

##### Enhancement

-   Changed to accept `http_parser.rb` 0.8.0.
    `http_parser.rb` 0.8.0 is ready for Ractor.

[https://github.com/fluent/fluentd/pull/3544](https://togithub.com/fluent/fluentd/pull/3544)3544

##### Bug fix

-   in_tail: Fixed a bug that no new logs are read when
    `enable_stat_watcher true` and `enable_watch_timer false` is set.

[https://github.com/fluent/fluentd/pull/3541](https://togithub.com/fluent/fluentd/pull/3541)3541
-   in_tail: Fixed a bug that the beginning and initial lines are lost
after startup when `read_from_head false` and path includes wildcard
'\*'.[https://github.com/fluent/fluentd/pull/3542](https://togithub.com/fluent/fluentd/pull/3542)/3542
-   Fixed a bug that processing messages were lost when
    BufferChunkOverflowError was thrown even though only a specific
message size exceeds
chunk_limi[https://github.com/fluent/fluentd/pull/3553](https://togithub.com/fluent/fluentd/pull/3553)t[https://github.com/fluent/fluentd/pull/3562](https://togithub.com/fluent/fluentd/pull/3562)luentd/pull/3562

##### Misc

-   Bump up required version of `win32-service` gem.
newer version is required to implement additional `fluent-ctl` commands.

[https://github.com/fluent/fluentd/pull/3556](https://togithub.com/fluent/fluentd/pull/3556)3556

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/grafana/loki).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy44LjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
rhnasc referenced this pull request in inloco/loki Apr 12, 2024
@renovate @rhnasc
chore(deps): update dependency fluentd to v1.15.3 [security] (main) (g…
3f1a762 
…rafana#10839)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [fluentd](https://www.fluentd.org/)
([source](https://togithub.com/fluent/fluentd)) | `'1.14.2'` ->
`'1.15.3'` |
[![age](https://developer.mend.io/api/mc/badges/age/rubygems/fluentd/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/rubygems/fluentd/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/rubygems/fluentd/'1.14.2'/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/fluentd/'1.14.2'/1.15.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2022-39379](https://togithub.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2)

### Impact
A remote code execution (RCE) vulnerability in non-default
configurations of Fluentd allows unauthenticated attackers to execute
arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable
`FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd
version 1.13.2. Earlier versions of Fluentd are not affected by this
vulnerability.

### Patches
v1.15.3

### Workarounds
Do not use `FLUENT_OJ_OPTION_MODE=object`.

### References

* GHSL-2022-067

---

### Release Notes

<details>
<summary>fluent/fluentd (fluentd)</summary>

###
[`v1.15.3`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1153---20221102)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.15.2...v1.15.3)

##### Bug Fix

-   Support glob for `!include` directive in YAML config format

[https://github.com/fluent/fluentd/pull/3917](https://togithub.com/fluent/fluentd/pull/3917)3917
-   Remove meaningless oj options

[https://github.com/fluent/fluentd/pull/3929](https://togithub.com/fluent/fluentd/pull/3929)3929
-   Fix log initializer to correctly create per-process files on Windows

[https://github.com/fluent/fluentd/pull/3939](https://togithub.com/fluent/fluentd/pull/3939)3939
-   out_file: Fix the multi-worker check with `<worker 0-N>` directive

[https://github.com/fluent/fluentd/pull/3942](https://togithub.com/fluent/fluentd/pull/3942)3942

##### Misc

-   Fix broken tests on Ruby 3.2

[https://github.com/fluent/fluentd/pull/3883](https://togithub.com/fluent/fluentd/pull/3883)3[https://github.com/fluent/fluentd/pull/3922](https://togithub.com/fluent/fluentd/pull/3922)ull/3922

###
[`v1.15.2`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1152---20220822)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.15.1...v1.15.2)

##### Enhancement

-   Add a new system configuration `enable_jit`

[https://github.com/fluent/fluentd/pull/3857](https://togithub.com/fluent/fluentd/pull/3857)3857

##### Bug Fix

-   out_file: Fix append mode with `--daemon` flag

[https://github.com/fluent/fluentd/pull/3864](https://togithub.com/fluent/fluentd/pull/3864)3864
-   child_process: Plug file descriptor leak

[https://github.com/fluent/fluentd/pull/3844](https://togithub.com/fluent/fluentd/pull/3844)3844

##### Misc

-   Drop win32-api gem to support Ruby 3.2

[https://github.com/fluent/fluentd/pull/3849](https://togithub.com/fluent/fluentd/pull/3849)3[https://github.com/fluent/fluentd/pull/3866](https://togithub.com/fluent/fluentd/pull/3866)ull/3866

###
[`v1.15.1`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1151---20220727)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.15.0...v1.15.1)

##### Bug Fix

-   Add support for concurrent append in out_file

[https://github.com/fluent/fluentd/pull/3808](https://togithub.com/fluent/fluentd/pull/3808)3808

##### Misc

-   in_tail: Show more information on skipping update_watcher

[https://github.com/fluent/fluentd/pull/3829](https://togithub.com/fluent/fluentd/pull/3829)3829

###
[`v1.15.0`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1150---20220629)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.6...v1.15.0)

##### Enhancement

-   in_tail: Add log throttling in files based on group rules

[https://github.com/fluent/fluentd/pull/3535](https://togithub.com/fluent/fluentd/pull/3535)3[https://github.com/fluent/fluentd/pull/3771](https://togithub.com/fluent/fluentd/pull/3771)ull/3771
-   Add `dump` command to fluent-ctl

[https://github.com/fluent/fluentd/pull/3680](https://togithub.com/fluent/fluentd/pull/3680)3680
-   Handle YAML configuration format on configuration file

[https://github.com/fluent/fluentd/pull/3712](https://togithub.com/fluent/fluentd/pull/3712)3712
- Add `restart_worker_interval` parameter in `<system>` directive to set
interval to restart workers that has stopped for some
reas[https://github.com/fluent/fluentd/pull/3768](https://togithub.com/fluent/fluentd/pull/3768)ull/3768

##### Bug fixes

-   out_forward: Fix to update timeout of cached sockets

[https://github.com/fluent/fluentd/pull/3711](https://togithub.com/fluent/fluentd/pull/3711)3711
- in_tail: Fix a possible crash on file rotation when `follow_inodes
true`

[https://github.com/fluent/fluentd/pull/3754](https://togithub.com/fluent/fluentd/pull/3754)3754
-   output: Fix a possible crash of flush thread

[https://github.com/fluent/fluentd/pull/3755](https://togithub.com/fluent/fluentd/pull/3755)3755
-   in_tail: Fix crash bugs on Ruby 3.1 on Windows

[https://github.com/fluent/fluentd/pull/3766](https://togithub.com/fluent/fluentd/pull/3766)3766
- in_tail: Fix a bug that in_tail cannot open non-ascii path on Windows

[https://github.com/fluent/fluentd/pull/3774](https://togithub.com/fluent/fluentd/pull/3774)3774
- Fix a bug that fluentd doesn't release its own log file even after
rotated by
external
to[https://github.com/fluent/fluentd/pull/3782](https://togithub.com/fluent/fluentd/pull/3782)ull/3782

##### Misc

-   in_tail: Simplify TargetInfo related code

[https://github.com/fluent/fluentd/pull/3489](https://togithub.com/fluent/fluentd/pull/3489)3489
-   Fix a wrong issue number in CHANGELOG

[https://github.com/fluent/fluentd/pull/3700](https://togithub.com/fluent/fluentd/pull/3700)3700
-   server helper: Add comments to linger_timeout behavior about Windows

[https://github.com/fluent/fluentd/pull/3701](https://togithub.com/fluent/fluentd/pull/3701)3701
-   service_discovery: Fix typo

[https://github.com/fluent/fluentd/pull/3724](https://togithub.com/fluent/fluentd/pull/3724)3724
-   test: Fix unstable tests and warnings

[https://github.com/fluent/fluentd/pull/3745](https://togithub.com/fluent/fluentd/pull/3745)3[https://github.com/fluent/fluentd/pull/3753](https://togithub.com/fluent/fluentd/pull/3753)u[https://github.com/fluent/fluentd/pull/3767](https://togithub.com/fluent/fluentd/pull/3767)t[https://github.com/fluent/fluentd/pull/3783](https://togithub.com/fluent/fluentd/pull/3783)l[https://github.com/fluent/fluentd/pull/3784](https://togithub.com/fluent/fluentd/pull/3784)n[https://github.com/fluent/fluentd/pull/3785](https://togithub.com/fluent/fluentd/pull/3785)f[https://github.com/fluent/fluentd/pull/3787](https://togithub.com/fluent/fluentd/pull/3787)com/fluent/fluentd/pull/3787

###
[`v1.14.6`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1146---20220331)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.5...v1.14.6)

##### Enhancement

-   Enable server plugins to specify socket-option `SO_LINGER`

[https://github.com/fluent/fluentd/pull/3644](https://togithub.com/fluent/fluentd/pull/3644)3644
-   Add `--umask` command line parameter

[https://github.com/fluent/fluentd/pull/3671](https://togithub.com/fluent/fluentd/pull/3671)3[https://github.com/fluent/fluentd/pull/3679](https://togithub.com/fluent/fluentd/pull/3679)ull/3679

##### Bug fixes

-   Fix metric name typo

[https://github.com/fluent/fluentd/pull/3630](https://togithub.com/fluent/fluentd/pull/3630)3[https://github.com/fluent/fluentd/pull/3673](https://togithub.com/fluent/fluentd/pull/3673)ull/3673
- Apply modifications in pipeline to the records being passed to
`@ERROR` label

[https://github.com/fluent/fluentd/pull/3631](https://togithub.com/fluent/fluentd/pull/3631)3631
-   Fix wrong calculation of retry interval

[https://github.com/fluent/fluentd/pull/3640](https://togithub.com/fluent/fluentd/pull/3640)3[https://github.com/fluent/fluentd/pull/3649](https://togithub.com/fluent/fluentd/pull/3649)u[https://github.com/fluent/fluentd/pull/3685](https://togithub.com/fluent/fluentd/pull/3685)t[https://github.com/fluent/fluentd/pull/3686](https://togithub.com/fluent/fluentd/pull/3686)luentd/pull/3686
-   Support IPv6 address for `rpc_endpoint` in `system` config

[https://github.com/fluent/fluentd/pull/3641](https://togithub.com/fluent/fluentd/pull/3641)3641

##### Misc

-   CI: Support Ruby 3.1 except Windows

[https://github.com/fluent/fluentd/pull/3619](https://togithub.com/fluent/fluentd/pull/3619)3619
-   Switch to GitHub Discussions

[https://github.com/fluent/fluentd/pull/3654](https://togithub.com/fluent/fluentd/pull/3654)3654
-   Fix CHANGELOG.md heading styles

[https://github.com/fluent/fluentd/pull/3648](https://togithub.com/fluent/fluentd/pull/3648)3648
-   Declare `null_value_pattern` as `regexp`

[https://github.com/fluent/fluentd/pull/3650](https://togithub.com/fluent/fluentd/pull/3650)3650

###
[`v1.14.5`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1145---20220209)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.4...v1.14.5)

##### Enhancement

-   Add support for "application/x-ndjson" to `in_http`

[https://github.com/fluent/fluentd/pull/3616](https://togithub.com/fluent/fluentd/pull/3616)3616
-   Add support for ucrt binary for Windows

[https://github.com/fluent/fluentd/pull/3613](https://togithub.com/fluent/fluentd/pull/3613)3613

##### Bug fixes

-   Don't retry when `retry_max_times == 0`

[https://github.com/fluent/fluentd/pull/3608](https://togithub.com/fluent/fluentd/pull/3608)3608
-   Fix hang-up issue during TLS handshake in `out_forward`

[https://github.com/fluent/fluentd/pull/3601](https://togithub.com/fluent/fluentd/pull/3601)3601
-   Bump up required ServerEngine to v2.2.5

[https://github.com/fluent/fluentd/pull/3599](https://togithub.com/fluent/fluentd/pull/3599)3599
-   Fix "invalid byte sequence is replaced" warning on Kubernetes

[https://github.com/fluent/fluentd/pull/3596](https://togithub.com/fluent/fluentd/pull/3596)3596
- Fix "ArgumentError: unknown keyword: :logger" on Windows with Ruby 3.1

[https://github.com/fluent/fluentd/pull/3592](https://togithub.com/fluent/fluentd/pull/3592)3592

###
[`v1.14.4`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1144---20220106)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.3...v1.14.4)

##### Enhancement

-   `in_tail`: Add option to skip long lines (`max_line_size`)

[https://github.com/fluent/fluentd/pull/3565](https://togithub.com/fluent/fluentd/pull/3565)3565

##### Bug fix

- Incorrect BufferChunkOverflowError when each event size is <
`chunk_limit_size`

[https://github.com/fluent/fluentd/pull/3560](https://togithub.com/fluent/fluentd/pull/3560)3560
- On macOS with Ruby 2.7/3.0, `out_file` fails to write events if
`append` is true.

[https://github.com/fluent/fluentd/pull/3579](https://togithub.com/fluent/fluentd/pull/3579)3579
-   test: Fix unstable test cases

[https://github.com/fluent/fluentd/pull/3574](https://togithub.com/fluent/fluentd/pull/3574)3[https://github.com/fluent/fluentd/pull/3577](https://togithub.com/fluent/fluentd/pull/3577)ull/3577

###
[`v1.14.3`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1143---20211126)

[Compare
Source](https://togithub.com/fluent/fluentd/compare/v1.14.2...v1.14.3)

##### Enhancement

-   Changed to accept `http_parser.rb` 0.8.0.
    `http_parser.rb` 0.8.0 is ready for Ractor.

[https://github.com/fluent/fluentd/pull/3544](https://togithub.com/fluent/fluentd/pull/3544)3544

##### Bug fix

-   in_tail: Fixed a bug that no new logs are read when
    `enable_stat_watcher true` and `enable_watch_timer false` is set.

[https://github.com/fluent/fluentd/pull/3541](https://togithub.com/fluent/fluentd/pull/3541)3541
-   in_tail: Fixed a bug that the beginning and initial lines are lost
after startup when `read_from_head false` and path includes wildcard
'\*'.[https://github.com/fluent/fluentd/pull/3542](https://togithub.com/fluent/fluentd/pull/3542)/3542
-   Fixed a bug that processing messages were lost when
    BufferChunkOverflowError was thrown even though only a specific
message size exceeds
chunk_limi[https://github.com/fluent/fluentd/pull/3553](https://togithub.com/fluent/fluentd/pull/3553)t[https://github.com/fluent/fluentd/pull/3562](https://togithub.com/fluent/fluentd/pull/3562)luentd/pull/3562

##### Misc

-   Bump up required version of `win32-service` gem.
newer version is required to implement additional `fluent-ctl` commands.

[https://github.com/fluent/fluentd/pull/3556](https://togithub.com/fluent/fluentd/pull/3556)3556

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/grafana/loki).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy44LjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cosmo0920 cosmo0920 cosmo0920 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ashie @cosmo0920