Starstruk Logo MarkStarstruk

v0.9.2

quickwit-oss/quickwitv0.9.2Oct 16, 2026by github-actions[bot]

Upgrading?

What changed from v1.11.0 → v0.9.2?

AI Summary

Quickwit 0.9.2 is a security patch release addressing vulnerabilities in Kafka client parameters and columnar dictionary handling. It also modifies the Kerberos authentication behavior for Kafka sources.

Key Highlights

  • Security patch release addressing CVEs related to Kafka client command execution and oversized dictionaries.
  • Restriction of Kafka client parameters to prevent unauthorized command execution or library loading.
  • Kafka Kerberos sources no longer run `kinit` automatically, requiring manual ticket renewal.

Breaking Changes

  • Kafka sources using Kerberos (`sasl.mechanisms: GSSAPI`) no longer run `kinit` automatically. Users must set the `QW_KAFKA_KINIT_CMD` environment variable or manage ticket renewal externally.

Full Release Notes

Quickwit 0.9.2 is a security patch release.

### Security

- Restrict Kafka client params that execute commands or load libraries ([GHSA-g85h-2988-4cv8](https://github.com/quickwit-oss/quickwit/security/advisories/GHSA-g85h-2988-4cv8)).
- Reject oversized columnar dictionaries during merges ([Tantivy GHSA-7pph-m7rw-cqhv](https://github.com/quickwit-oss/tantivy/security/advisories/GHSA-7pph-m7rw-cqhv)).

Users running Quickwit versions 0.4.0 through 0.9.1 should upgrade to 0.9.2.

Kafka sources that use Kerberos (`sasl.mechanisms: GSSAPI`) no longer run `kinit` automatically. If you relied on automatic ticket renewal, set the `QW_KAFKA_KINIT_CMD` environment variable or renew tickets outside Quickwit.

Related Repositories

farion1231/cc-switch★ 147,310

A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io

rustdesk/rustdesk★ 126,560

An open-source remote desktop application designed for self-hosting, as an alternative to TeamViewer.

tauri-apps/tauri★ 112,101

Build smaller, faster, and more secure desktop and mobile applications with a web frontend.

ruvnet/RuView★ 99,070

π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video.

oven-sh/bun★ 96,341

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one