Changelog for week of Oct. 20, 2025 (elastic#3632)

Fixes elastic#3587 by creating this week's serverless changelog. The release
was delayed due to the AWS outage earlier this week.

Thanks in advance for your review!

---------

Co-authored-by: Nastasha Solomon <[email protected]>
Co-authored-by: wajihaparvez <[email protected]>

Author: 3 people

release-notes/elastic-cloud-serverless/index.md

@@ -9,9 +9,66 @@ products:
 # {{serverless-full}} changelog [elastic-cloud-serverless-changelog]
 Review the changes, fixes, and more to {{serverless-full}}.
 
+## October 20, 2025 [serverless-changelog-10202025]
+
+### Features and enhancements [serverless-changelog-10202025-features-enhancements]
+
+* Lets you remove root privileges from {{fleet}} managed agents [#237790]({{kib-pull}}237790)
+* Adds the `xpack.fleet.experimentalFeatures` setting [#238840]({{kib-pull}}238840)
+* Supports expression suggestions within function parameters [#236343]({{kib-pull}}236343)
+* Updates the Observability Serverless navigation menu [#235984]({{kib-pull}}235984)
+* Allows the Observability AI Assistant to retrieve information from the  `.integration_knowledge*` system index [#237085]({{kib-pull}}237085)
+* Adds file download relative URI to response actions that provide file output [#237713]({{kib-pull}}237713)
+* Updates the UI and API for process descendants in trusted applications [#236318]({{kib-pull}}236318)
+* Adds usage statistics collection for CSPM cloud connectors [#236992]({{kib-pull}}236992)
+* Enhances the error message for malformed roles [#239098]({{kib-pull}}239098)
+* Enables editing feature condition in the feature identification flyout and adds the **Open in Discover** button [#238646]({{kib-pull}}238646)
+* Improves processing warnings for Streams [#239188]({{kib-pull}}239188)
+* Enables AI-powered significant event identification for Streams [#239070]({{kib-pull}}239070)
+* Enables numerical ID service for Cases [#238555]({{kib-pull}}238555)
+* Adds agent ID as a default observables type [#238533]({{kib-pull}}238533)
+
+
+### Fixes [serverless-changelog-10202025-fixes]
+
+* Updates `nodemailer` [#238816]({{kib-pull}}238816)
+* Improves error handling on the **Visualize Listing** page [#238355]({{kib-pull}}238355)
+* Prevents adhoc dataviews in {{esql}} charts from being filtered out in the KQL search bar [#238731]({{kib-pull}}238731)
+* Fixes a bug in Lens that broke **Click to filter** on table rows when any column was used as a formula [#239222]({{kib-pull}}239222)
+* Fixes metric color assignment when breakdown and a max dimension are defined in Lens [#238901]({{kib-pull}}238901)
+* Fixes "package not found" error when skipping cloud onboarding for a prerelease package [#238629]({{kib-pull}}238629)
+* Fixes an issue with integration policy upgrades [#238542]({{kib-pull}}238542)
+* Fixes `ignore_above` mapping for `flattened` fields [#238890]({{kib-pull}}238890)
+* Fixes missing fields when using combined filters with the `ignoreFilterIfFieldNotInIndex` UI setting [#238945]({{kib-pull}}238945)
+* Displays the available options when editing an existing variable control [#239315]({{kib-pull}}239315)
+* Fixes `KEEP` behavior in {{esql}} when a query initially returns no results [#239063]({{kib-pull}}239063)
+* Adds a 10 second request timeout to {{esql}} query execution [#238200]({{kib-pull}}238200)
+* Uses `runWithCache` for bulk {{fleet}} operations [#238326]({{kib-pull}}238326)
+* Fixes error when Observability AI Assistant was disabled [#238811]({{kib-pull}}238811)
+* Removes unecessary `_source` field from queries [#239205]({{kib-pull}}239205)
+* Makes the rule condition chart parser replace metric names inside filter values (e.g., A in "Accounts") [#238849]({{kib-pull}}238849)
+* Fixes recover alert while monitor is down [#237479]({{kib-pull}}237479)
+* Fixes layout of SLO management page combo box filter [#239418]({{kib-pull}}239418)
+* Adds missing aria-label to BetaBadge component [#239400]({{kib-pull}}239400)
+* Fixes the "missing authentication credentials" issue in `TelemetryConfigWatcher` and `PolicyWatcher` [#237796]({{kib-pull}}237796)
+* Fixes an issue with Automatic Migration that prevented you from switching between migrations while translating rules [#238679]({{kib-pull}}238679)
+* Fixes artifacts spaces migration (`v9.1`) to ensure all artifacts are processed [#238740]({{kib-pull}}238740)
+* Checks for integrations permissions before loading component [#239122]({{kib-pull}}239122)
+* Prioritizes connector `defaultModel` over stored conversation model [#237947]({{kib-pull}}237947)
+* Deselects current selection after index pattern update [#239245]({{kib-pull}}239245)
+* Fixes graph not rendering when switching tabs or refreshing the page [#238038]({{kib-pull}}238038)
+* Adds unique accessible labels for **Show top field values** buttons [#237972]({{kib-pull}}237972)
+* Fixes tool calling unavailable tools [#237174]({{kib-pull}}237174)
+* Adds Jira's `otherFields` JSON editor to case creation flow [#238435]({{kib-pull}}238435)
+* Updates connector API [#236863]({{kib-pull}}236863)
+* Separates sync alert and auto-extract updates in activity log [#236519]({{kib-pull}}236519)
+* Fixes auto extraction of observables in EASE [#239000]({{kib-pull}}239000)
+* Removes `autoFocus` to preserve proper focus upon modal close [#239366]({{kib-pull}}239366)
+* Adds manual focus to the Cases action button's actions [#239504]({{kib-pull}}239504)
+* Fixes the behavior of Security serverless projects' Tier 1 and Tier 2 analyst roles by revoking their Endpoint exceptions read access
 
 ## October 15, 2025 [serverless-changelog-10152025]
-* {{serverless-full}} is now available in two new Amazon Web Services [regions](/deploy-manage/deploy/elastic-cloud/regions.md): `ap-northeast-1` (Tokyo) and `eu-west-2` (London).
+* {{serverless-full}} is now available in two new Amazon Web Services [regions](/deploy-manage/deploy/elastic-cloud/regions.md): `ap-northeast-1` (Tokyo) and `eu-west-2` (London)
 
 
 ## October 13, 2025 [serverless-changelog-10132025]

release-notes/elastic-cloud-serverless/known-issues.md

@@ -16,6 +16,18 @@ Known issues are significant defects or limitations that may impact your impleme
 
 ## Active
 
+::::{dropdown} Alerts aren't generated for rules with alert flapping off and an alert delay higher than 1
+
+**Details**
+
+On October 22, 2025, it was discovered that alerts aren't generated for rules that have **Alert flapping detection** turned off and the alert delay set to a value higher than 1.
+
+**Workaround**
+
+Set the alert delay value to 1 or turn on **Alert flapping detection**.
+
+::::
+
 :::{dropdown} In {{sec-serverless}}, the entity risk score feature may stop persisting risk score documents
 
 On May 30, 2025, it was discovered that the entity risk score feature may stop persisting risk score documents if risk scoring was previously turned on. This is due to a bug that prevents the `entity_analytics_create_eventIngest_from_timestamp-pipeline-<space_name>` ingest pipeline (which is set as a default pipeline for the risk scoring index in an earlier {{serverless-short}} release) from being created when {{kib}} starts up.