Merge branch 'main' of https://github.com/prwhelan/elasticsearch into deepseek

Author: prwhelan

docs/changelog/123396.yaml

@@ -0,0 +1,5 @@
+pr: 123396
+summary: Add initial grammar and planning for RRF (snapshot)
+area: ES|QL
+type: feature
+issues: []

docs/changelog/124424.yaml

@@ -0,0 +1,5 @@
+pr: 124424
+summary: Lazy collection copying during node transform
+area: ES|QL
+type: bug
+issues: []

docs/changelog/124527.yaml

@@ -0,0 +1,5 @@
+pr: 124527
+summary: Avoid potentially throwing calls to Task#getDescription in model download
+area: Machine Learning
+type: bug
+issues: []

docs/changelog/124544.yaml

@@ -0,0 +1,5 @@
+pr: 124544
+summary: Bump nimbus-jose-jwt to 10.0.2
+area: Security
+type: upgrade
+issues: []

docs/reference/query-languages/sql-limitations.md

@@ -116,13 +116,13 @@ SELECT age, MAX(salary) - MIN(salary) AS diff FROM test GROUP BY age ORDER BY di
 Using sub-selects (`SELECT X FROM (SELECT Y)`) is **supported to a small degree**: any sub-select that can be "flattened" into a single
 `SELECT` is possible with {es-sql}. For example:
 
-```sql subs=attributes,macros
+```sql 
 include-tagged::{sql-specs}/docs/docs.csv-spec[limitationSubSelect]
 ```
 
 The query above is possible because it is equivalent with:
 
-```sql subs="attributes,macros
+```sql
 include-tagged::{sql-specs}/docs/docs.csv-spec[limitationSubSelectRewritten]
 ```
 

gradle/verification-metadata.xml

@@ -984,9 +984,9 @@
             <sha256 value="e8c1c594e2425bdbea2d860de55c69b69fc5d59454452449a0f0913c2a5b8a31" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.nimbusds" name="nimbus-jose-jwt" version="10.0.1">
-         <artifact name="nimbus-jose-jwt-10.0.1.jar">
-            <sha256 value="f28dbd9ab128324f05050d76b78469d3a9cd83e0319aabc68d1c276e3923e13a" origin="Generated by Gradle"/>
+      <component group="com.nimbusds" name="nimbus-jose-jwt" version="10.0.2">
+         <artifact name="nimbus-jose-jwt-10.0.2.jar">
+            <sha256 value="960b978a6cd6cbc3319648adc73959789f6742a2bf1e8dd0c843dbc91624218a" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="com.nimbusds" name="nimbus-jose-jwt" version="4.41.1">

libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java

@@ -64,6 +64,7 @@
 import java.nio.file.FileVisitOption;
 import java.nio.file.FileVisitor;
 import java.nio.file.LinkOption;
+import java.nio.file.NoSuchFileException;
 import java.nio.file.OpenOption;
 import java.nio.file.Path;
 import java.nio.file.WatchEvent;
@@ -1203,7 +1204,7 @@ void checkNewByteChannel(
     void checkType(Class<?> callerClass, FileStore that);
 
     // path
-    void checkPathToRealPath(Class<?> callerClass, Path that, LinkOption... options);
+    void checkPathToRealPath(Class<?> callerClass, Path that, LinkOption... options) throws NoSuchFileException;
 
     void checkPathRegister(Class<?> callerClass, Path that, WatchService watcher, WatchEvent.Kind<?>... events);
 

libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledActions.java

@@ -63,7 +63,15 @@ public static Path createTempDirectoryForWrite() throws IOException {
     }
 
     public static Path createTempSymbolicLink() throws IOException {
-        return Files.createSymbolicLink(readDir().resolve("entitlements-link-" + random.nextLong()), readWriteDir());
+        return createTempSymbolicLink(readWriteDir());
+    }
+
+    public static Path createTempSymbolicLink(Path target) throws IOException {
+        return Files.createSymbolicLink(readDir().resolve("entitlements-link-" + random.nextLong()), target);
+    }
+
+    public static Path pathToRealPath(Path path) throws IOException {
+        return path.toRealPath();
     }
 
     public static Path createK8sLikeMount() throws IOException {

libs/entitlement/qa/entitlement-test-plugin/build.gradle

@@ -24,6 +24,7 @@ dependencies {
   compileOnly project(':server')
   compileOnly project(':libs:logging')
   compileOnly project(":libs:entitlement:qa:entitled-plugin")
+  implementation project(":libs:entitlement")
 }
 
 tasks.named("javadoc").configure {

libs/entitlement/qa/entitlement-test-plugin/src/main/java/module-info.java

@@ -11,6 +11,7 @@
     requires org.elasticsearch.server;
     requires org.elasticsearch.base;
     requires org.elasticsearch.logging;
+    requires org.elasticsearch.entitlement;
     requires org.elasticsearch.entitlement.qa.entitled;
 
     // Modules we'll attempt to use in order to exercise entitlements