From 8e8af3d63fcb88f7a64976dc40ea95de66df66d9 Mon Sep 17 00:00:00 2001
From: Thomas Flament <thomas.flament@scality.com>
Date: Thu, 16 Jul 2026 17:44:27 +0200
Subject: [PATCH 1/2] Downgrade node-rdkafka to 3.0.1

librdkafka >= 2.5.0 cannot consume messages stored in the legacy
v0/v1 MessageSet format: when the FetchResponse uses a flexible
version (v12+), the legacy reader parses the Key/Value length
prefixes as compact varints instead of fixed int32, so every message
is delivered with NULL key and value and the consumer logs
'Unsupported Message(Set) MagicByte' errors.

S3C federation pins log.message.format.version=0.10.2.2 on the
backbeat-queue brokers, so all messages are stored and served in the
legacy v1 format: backbeat >= 9.4 (node-rdkafka ^3.6.0 / librdkafka
2.12.0) cannot process any kafka entry on S3C, and replication stays
PENDING. This blocks the S3C 10 component bump (Federation PR 6993).

Pin node-rdkafka to exactly 3.0.1, the newest release bundling
librdkafka 2.3.0 (the version backbeat ran until 9.3.x): 3.0.0 is
2.18.0 with only EOL Node versions dropped, and 3.0.1 only adds an
OAuthBearer setToken API. The app-side fixes from the original bump
(bootstrap chained-setTimeout, partition.assignment.strategy pin)
are kept.

The pin must not be raised past 3.0.1 until node-rdkafka bundles a
librdkafka release containing the upstream fix:
https://github.com/confluentinc/librdkafka/pull/5550
Note that Node >= 24 support will require node-rdkafka >= 3.6.1.

Reported upstream: https://github.com/confluentinc/librdkafka/issues/5549

Issue: BB-806
---
 package.json |  2 +-
 yarn.lock    | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/package.json b/package.json
index 691564297..69fb769b8 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "minimatch": "^10.0.1",
     "mongodb": "^6.11.0",
     "node-forge": "^1.3.1",
-    "node-rdkafka": "^3.6.0",
+    "node-rdkafka": "3.0.1",
     "node-rdkafka-prometheus": "^1.0.0",
     "node-schedule": "^2.1.1",
     "node-zookeeper-client": "^1.1.3",
diff --git a/yarn.lock b/yarn.lock
index 513e833cf..56ef6a532 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9147,10 +9147,10 @@ nan@^2.14.0, nan@^2.18.0, nan@^2.3.2:
   resolved "https://registry.yarnpkg.com/nan/-/nan-2.23.1.tgz#6f86a31dd87e3d1eb77512bf4b9e14c8aded3975"
   integrity sha512-r7bBUGKzlqk8oPBDYxt6Z0aEdF1G1rwlMcLk8LCOMbOzf0mG+JUfUzG4fIMWwHWP0iyaLWEQZJmtB7nOHEm/qw==
 
-nan@^2.24.0:
-  version "2.26.2"
-  resolved "https://registry.yarnpkg.com/nan/-/nan-2.26.2.tgz#2e5e25764224c737b9897790b57c3294d4dcee9c"
-  integrity sha512-0tTvBTYkt3tdGw22nrAy50x7gpbGCCFH3AFcyS5WiUu7Eu4vWlri1woE6qHBSfy11vksDqkiwjOnlR7WV8G1Hw==
+nan@^2.19.0:
+  version "2.28.0"
+  resolved "https://registry.yarnpkg.com/nan/-/nan-2.28.0.tgz#126717fd359d5a03d3edf7c44e6ce9b707fb57f5"
+  integrity sha512-fTsDz99OTq2sVePhGdp4qQhggZFtKr64ZNVyVajRKtMOkJxYekplBh577PiJB12v/D3s2E5cGtOI45LWp6rnLQ==
 
 napi-macros@~2.0.0:
   version "2.0.0"
@@ -9285,13 +9285,13 @@ node-rdkafka-prometheus@^1.0.0:
     "@log4js-node/log4js-api" "^1.0.0"
     prom-client "^12.0.0"
 
-node-rdkafka@^3.6.0:
-  version "3.6.1"
-  resolved "https://registry.yarnpkg.com/node-rdkafka/-/node-rdkafka-3.6.1.tgz#164357f08ff23a4722e89bfb3b2b09481c1e8cc1"
-  integrity sha512-sfpTbrT35429cs0RE8Yb9avGX9BiRRvpV7aweQsghKTjtrVZP3jBrKOPItWXAqHb8doyh3SkuGuUVBLgig1SRg==
+node-rdkafka@3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/node-rdkafka/-/node-rdkafka-3.0.1.tgz#c536d7702d971535b41099acc1baf89706a5d1ba"
+  integrity sha512-USTFu7ylRj+fEiGz0hA92GWSqmX/hu/xSTqtgmInPPmh5zKhjauTciRjDEG3yK5m6yChwyHKQTIgmr56DfhiaQ==
   dependencies:
     bindings "^1.3.1"
-    nan "^2.24.0"
+    nan "^2.19.0"
 
 node-releases@^2.0.27:
   version "2.0.27"

From 6ca94e45491faf0428c7a02bf70788a36457bf7a Mon Sep 17 00:00:00 2001
From: Thomas Flament <thomas.flament@scality.com>
Date: Fri, 17 Jul 2026 10:24:51 +0200
Subject: [PATCH 2/2] Bump package.json to 9.4.1

Issue: BB-806
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 69fb769b8..4c94ead46 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "backbeat",
-  "version": "9.4.0",
+  "version": "9.4.1",
   "description": "Asynchronous queue and job manager",
   "main": "index.js",
   "scripts": {