Merge branch 'fluent:master' into out-syslog-nested-key-support

Author: simbou2000

.github/workflows/staging-release.yaml

@@ -831,9 +831,20 @@ jobs:
           target_commitish: '3.2'
           make_latest: false
 
-      - name: Release 4.0 and latest
+      - name: Release 4.0 - not latest
         uses: softprops/action-gh-release@v2
         if: startsWith(inputs.version, '4.0')
+        with:
+          body: "https://fluentbit.io/announcements/v${{ inputs.version }}/"
+          draft: false
+          generate_release_notes: true
+          name: "Fluent Bit ${{ inputs.version }}"
+          tag_name: v${{ inputs.version }}
+          make_latest: false
+
+      - name: Release 4.1 and latest
+        uses: softprops/action-gh-release@v2
+        if: startsWith(inputs.version, '4.1')
         with:
           body: "https://fluentbit.io/announcements/v${{ inputs.version }}/"
           draft: false
@@ -950,12 +961,20 @@ jobs:
           token: ${{ secrets.GH_PA_TOKEN }}
           ref: 3.2
 
-      - name: Release 4.0 and latest
+      - name: Release 4.0 - not latest
         if: startsWith(inputs.version, '4.0')
         uses: actions/checkout@v5
         with:
           repository: fluent/fluent-bit-docs
           token: ${{ secrets.GH_PA_TOKEN }}
+          ref: '4.0'
+
+      - name: Release 4.1 and latest
+        if: startsWith(inputs.version, '4.1')
+        uses: actions/checkout@v5
+        with:
+          repository: fluent/fluent-bit-docs
+          token: ${{ secrets.GH_PA_TOKEN }}
 
       - name: Ensure we have the script we need
         run: |
@@ -1052,7 +1071,7 @@ jobs:
         if: startsWith(inputs.version, '4.0')
         uses: actions/checkout@v5
         with:
-          ref: 4.0
+          ref: '4.0'
 
       - name: Release 4.1
         if: startsWith(inputs.version, '4.1')

.github/workflows/unit-tests.yaml

@@ -22,6 +22,7 @@ on:
       - 'examples/**'
     branches:
       - master
+      - 4.1
       - 4.0
       - 3.2
       - 3.1

CMakeLists.txt

@@ -7,8 +7,8 @@ set(CMAKE_POLICY_DEFAULT_CMP0069 NEW)
 
 # Fluent Bit Version
 set(FLB_VERSION_MAJOR  4)
-set(FLB_VERSION_MINOR  1)
-set(FLB_VERSION_PATCH  2)
+set(FLB_VERSION_MINOR  2)
+set(FLB_VERSION_PATCH  0)
 set(FLB_VERSION_STR "${FLB_VERSION_MAJOR}.${FLB_VERSION_MINOR}.${FLB_VERSION_PATCH}")
 
 set(CMAKE_POSITION_INDEPENDENT_CODE ON)

SECURITY.md

@@ -1,19 +1,61 @@
-# Security Policy
+# 🔒 Security Policy
+
+Fluent Bit maintains active security support for a limited set of release lines. Security updates are provided for the versions listed below until their End-of-Maintenance (EOM) dates.
 
 ## Supported Versions
 
+| Version   | Status     | Security Updates Until |
+|-----------|------------|------------------------|
+| **4.2.x** | ✅ Active  | **June 30, 2026**      |
+| **4.1.x** | ✅ Active  | **March 31, 2026**     |
+| **4.0.x** | ✅ Active  | **December 31, 2025**  |
+| **3.2.x** | ❌ EOL     | —                      |
+| **< 3.2** | ❌ EOL     | —                      |
+
+> **Note:** 3.2 and earlier are End-of-Life (EOL) and receive no further fixes.
+
+---
+
+## Maintenance & Backport Policy
+
+- We backport **critical** and **high-severity** security fixes to all **Active** branches listed above.
+- Medium/low-severity fixes may be backported at the maintainers’ discretion.
+- After a branch reaches **EOM**, no further patches are published for that line.
+- Users are strongly encouraged to keep current with the latest **4.x** release line.
+
+---
+
+## 📣 Reporting a Vulnerability
+
+Please report suspected vulnerabilities **privately**:
+
+- Email: **fluentbit-security@googlegroups.com**
+- Include: affected versions, environment, clear reproduction steps, logs/traces, and impact assessment if known.
+
+**Please do not** file public GitHub issues for security reports.
+
+**Response targets** (best effort):
+- **Acknowledgement:** within 72 hours
+- **Initial assessment:** within 7 days
+- **Fix/Advisory:** coordinated with reporter; timing depends on severity and scope
+
+---
+
+## 🔐 Coordinated Disclosure
+
+- We work with reporters to validate issues, develop fixes, and publish coordinated advisories.
+- Public disclosure occurs once a fix or acceptable mitigation is available, or by mutual agreement.
+
+---
 
-| Version | Supported          |
-|---------| ------------------ |
-| 4.0.x   | :white_check_mark: |
-| 3.2.x   | :white_check_mark: |
-| < 3.2   | :x:                |
+## 📢 Security Announcements
 
-## Reporting a Vulnerability
+- Security advisories and related notices are shared via:
+  - GitHub **Security Advisories** on the Fluent Bit repo
+  - GitHub **Discussions**: <https://github.com/fluent/fluent-bit/discussions>
 
-Please get in touch with the team at fluentbit-security@googlegroups.com, and we'll take it from there.  
-Thank you in advance for helping to keep Fluent-bit secure.
+For third-party CVEs that may impact Fluent Bit, we will post an assessment and any required guidance through the channels above.
 
-## Announcements
+---
 
-For related CVEs that may or not affect Fluent Bit we'll be doing the corresponding announcement through [discussions](https://github.com/fluent/fluent-bit/discussions).
+_Last updated: October 17, 2025_

fluent-bit-4.1.2.bb renamed to fluent-bit-4.2.0.bb

@@ -16,7 +16,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2ee41112a44fe7014dce33e26468ba93"
 SECTION = "net"
 
 PR = "r0"
-PV = "4.1.2"
+PV = "4.2.0"
 
 SRCREV = "v${PV}"
 SRC_URI = "git://github.com/fluent/fluent-bit.git;nobranch=1"

include/fluent-bit/config_format/flb_cf.h

@@ -174,6 +174,11 @@ struct cfl_variant *flb_cf_section_property_add(struct flb_cf *cf,
                                               char *k_buf, size_t k_len,
                                               char *v_buf, size_t v_len);
 
+struct cfl_variant *flb_cf_section_property_add_variant(struct flb_cf *cf,
+                                                        struct cfl_kvlist *kv_list,
+                                                        char *k_buf, size_t k_len,
+                                                        struct cfl_variant *variant);
+
 struct cfl_array *flb_cf_section_property_add_list(struct flb_cf *cf,
                                                    struct cfl_kvlist *kv_list,
                                                    char *k_buf, size_t k_len);

include/fluent-bit/flb_config.h

@@ -27,6 +27,7 @@
 #include <fluent-bit/flb_log.h>
 #include <fluent-bit/flb_sds.h>
 #include <fluent-bit/flb_task_map.h>
+#include <cfl/cfl.h>
 
 #include <monkey/mk_core.h>
 
@@ -325,6 +326,9 @@ struct flb_config {
     int json_escape_unicode;
 
     int dry_run;
+
+    /* New Router Configuration */
+    struct cfl_list input_routes;
 };
 
 #define FLB_CONFIG_LOG_LEVEL(c) (c->log->level)

include/fluent-bit/flb_mp_chunk.h

@@ -36,6 +36,10 @@ struct flb_mp_chunk_record {
     struct flb_log_event event;
     struct cfl_object *cobj_metadata;
     struct cfl_object *cobj_record;
+    struct cfl_object *cobj_group_metadata;
+    struct cfl_object *cobj_group_attributes;
+    int owns_group_metadata;
+    int owns_group_attributes;
     struct cfl_list _head;
 };
 
@@ -47,6 +51,9 @@ struct flb_mp_chunk_cobj {
     struct flb_mp_chunk_record *record_pos;
     struct cfl_list records;
 
+    struct cfl_object *active_group_metadata;
+    struct cfl_object *active_group_attributes;
+
     /* Condition for filtering records during processing */
     struct flb_condition *condition;
 };

include/fluent-bit/flb_opentelemetry.h

@@ -24,8 +24,9 @@
 #include <msgpack.h>
 #include <stdint.h>
 
-/* Error code values from flb_opentelemetry_logs.c */
+/* Error code values from flb_opentelemetry logs/traces helpers */
 #define FLB_OTEL_LOGS_ERR_GENERIC_ERROR                     -1
+#define FLB_OTEL_TRACES_ERR_GENERIC_ERROR                   -1
 
 enum {
 
@@ -50,7 +51,31 @@ enum {
     FLB_OTEL_LOGS_ERR_ENCODER_FAILURE,
     FLB_OTEL_LOGS_ERR_APPEND_BODY_FAILURE,
     FLB_OTEL_LOGS_ERR_INVALID_TRACE_ID,
-    FLB_OTEL_LOGS_ERR_INVALID_SPAN_ID
+    FLB_OTEL_LOGS_ERR_INVALID_SPAN_ID,
+
+    /* trace specific errors */
+    FLB_OTEL_TRACES_ERR_UNEXPECTED_ROOT_OBJECT_TYPE,
+    FLB_OTEL_TRACES_ERR_INVALID_JSON,
+    FLB_OTEL_TRACES_ERR_RESOURCE_SPANS_MISSING,
+    FLB_OTEL_TRACES_ERR_UNEXPECTED_RESOURCE_SPANS_TYPE,
+    FLB_OTEL_TRACES_ERR_UNEXPECTED_RESOURCE_SPANS_ENTRY_TYPE,
+    FLB_OTEL_TRACES_ERR_SCOPE_SPANS_MISSING,
+    FLB_OTEL_TRACES_ERR_UNEXPECTED_SCOPE_SPANS_TYPE,
+    FLB_OTEL_TRACES_ERR_UNEXPECTED_SCOPE_SPANS_ENTRY_TYPE,
+    FLB_OTEL_TRACES_ERR_SPANS_MISSING,
+    FLB_OTEL_TRACES_ERR_UNEXPECTED_SPANS_TYPE,
+    FLB_OTEL_TRACES_ERR_UNEXPECTED_SPAN_ENTRY_TYPE,
+    FLB_OTEL_TRACES_ERR_SPAN_NAME_MISSING,
+    FLB_OTEL_TRACES_ERR_INVALID_ATTRIBUTES,
+    FLB_OTEL_TRACES_ERR_INVALID_TRACE_ID,
+    FLB_OTEL_TRACES_ERR_INVALID_SPAN_ID,
+    FLB_OTEL_TRACES_ERR_INVALID_PARENT_SPAN_ID,
+    FLB_OTEL_TRACES_ERR_INVALID_EVENT_ENTRY,
+    FLB_OTEL_TRACES_ERR_INVALID_EVENT_TIMESTAMP,
+    FLB_OTEL_TRACES_ERR_INVALID_LINK_ENTRY,
+    FLB_OTEL_TRACES_ERR_INVALID_LINK_TRACE_ID,
+    FLB_OTEL_TRACES_ERR_INVALID_LINK_SPAN_ID,
+    FLB_OTEL_TRACES_ERR_STATUS_FAILURE
 };
 
 
@@ -88,7 +113,31 @@ static struct flb_otel_error_map otel_error_map[] = {
     {"FLB_OTEL_LOGS_ERR_APPEND_BODY_FAILURE",                FLB_OTEL_LOGS_ERR_APPEND_BODY_FAILURE},
     {"FLB_OTEL_LOGS_ERR_INVALID_TRACE_ID",                   FLB_OTEL_LOGS_ERR_INVALID_TRACE_ID},
     {"FLB_OTEL_LOGS_ERR_INVALID_SPAN_ID",                    FLB_OTEL_LOGS_ERR_INVALID_SPAN_ID},
+
+    {"FLB_OTEL_TRACES_ERR_UNEXPECTED_ROOT_OBJECT_TYPE",      FLB_OTEL_TRACES_ERR_UNEXPECTED_ROOT_OBJECT_TYPE},
+    {"FLB_OTEL_TRACES_ERR_INVALID_JSON",                     FLB_OTEL_TRACES_ERR_INVALID_JSON},
+    {"FLB_OTEL_TRACES_ERR_RESOURCE_SPANS_MISSING",           FLB_OTEL_TRACES_ERR_RESOURCE_SPANS_MISSING},
+    {"FLB_OTEL_TRACES_ERR_UNEXPECTED_RESOURCE_SPANS_TYPE",   FLB_OTEL_TRACES_ERR_UNEXPECTED_RESOURCE_SPANS_TYPE},
+    {"FLB_OTEL_TRACES_ERR_UNEXPECTED_RESOURCE_SPANS_ENTRY_TYPE", FLB_OTEL_TRACES_ERR_UNEXPECTED_RESOURCE_SPANS_ENTRY_TYPE},
+    {"FLB_OTEL_TRACES_ERR_SCOPE_SPANS_MISSING",              FLB_OTEL_TRACES_ERR_SCOPE_SPANS_MISSING},
+    {"FLB_OTEL_TRACES_ERR_UNEXPECTED_SCOPE_SPANS_TYPE",      FLB_OTEL_TRACES_ERR_UNEXPECTED_SCOPE_SPANS_TYPE},
+    {"FLB_OTEL_TRACES_ERR_UNEXPECTED_SCOPE_SPANS_ENTRY_TYPE",FLB_OTEL_TRACES_ERR_UNEXPECTED_SCOPE_SPANS_ENTRY_TYPE},
+    {"FLB_OTEL_TRACES_ERR_SPANS_MISSING",                    FLB_OTEL_TRACES_ERR_SPANS_MISSING},
+    {"FLB_OTEL_TRACES_ERR_UNEXPECTED_SPANS_TYPE",            FLB_OTEL_TRACES_ERR_UNEXPECTED_SPANS_TYPE},
+    {"FLB_OTEL_TRACES_ERR_UNEXPECTED_SPAN_ENTRY_TYPE",       FLB_OTEL_TRACES_ERR_UNEXPECTED_SPAN_ENTRY_TYPE},
+    {"FLB_OTEL_TRACES_ERR_SPAN_NAME_MISSING",                FLB_OTEL_TRACES_ERR_SPAN_NAME_MISSING},
+    {"FLB_OTEL_TRACES_ERR_INVALID_ATTRIBUTES",               FLB_OTEL_TRACES_ERR_INVALID_ATTRIBUTES},
+    {"FLB_OTEL_TRACES_ERR_INVALID_TRACE_ID",                 FLB_OTEL_TRACES_ERR_INVALID_TRACE_ID},
+    {"FLB_OTEL_TRACES_ERR_INVALID_SPAN_ID",                  FLB_OTEL_TRACES_ERR_INVALID_SPAN_ID},
+    {"FLB_OTEL_TRACES_ERR_INVALID_PARENT_SPAN_ID",           FLB_OTEL_TRACES_ERR_INVALID_PARENT_SPAN_ID},
+    {"FLB_OTEL_TRACES_ERR_INVALID_EVENT_ENTRY",              FLB_OTEL_TRACES_ERR_INVALID_EVENT_ENTRY},
+    {"FLB_OTEL_TRACES_ERR_INVALID_EVENT_TIMESTAMP",          FLB_OTEL_TRACES_ERR_INVALID_EVENT_TIMESTAMP},
+    {"FLB_OTEL_TRACES_ERR_INVALID_LINK_ENTRY",               FLB_OTEL_TRACES_ERR_INVALID_LINK_ENTRY},
+    {"FLB_OTEL_TRACES_ERR_INVALID_LINK_TRACE_ID",            FLB_OTEL_TRACES_ERR_INVALID_LINK_TRACE_ID},
+    {"FLB_OTEL_TRACES_ERR_INVALID_LINK_SPAN_ID",             FLB_OTEL_TRACES_ERR_INVALID_LINK_SPAN_ID},
+    {"FLB_OTEL_TRACES_ERR_STATUS_FAILURE",                   FLB_OTEL_TRACES_ERR_STATUS_FAILURE},
     {"GENERIC_ERROR",                                        FLB_OTEL_LOGS_ERR_GENERIC_ERROR},
+    {"FLB_OTEL_TRACES_ERR_GENERIC_ERROR",                    FLB_OTEL_TRACES_ERR_GENERIC_ERROR},
 
     /* ---- */
     {"FLB_OTEL_LOGS_ERR_EMPTY_PAYLOAD",                      FLB_OTEL_LOGS_ERR_EMPTY_PAYLOAD},
@@ -124,6 +173,9 @@ int flb_opentelemetry_logs_json_to_msgpack(struct flb_log_event_encoder *encoder
                                            const char *logs_body_key,
                                            int *error_status);
 
+struct ctrace *flb_opentelemetry_json_traces_to_ctrace(const char *body, size_t len,
+                                                       int *error_status);
+
 /* OpenTelemetry utils */
 int flb_otel_utils_find_map_entry_by_key(msgpack_object_map *map,
                                          char *key,