Merge branch '9.0' into backport/9.0/pr-123689

Author: ldematte

build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/JarApiComparisonTask.java

@@ -111,7 +111,11 @@ private String getPath() {
         List<String> classNames() throws IOException {
             Pattern classEnding = Pattern.compile(".*\\.class$");
             try (JarFile jf = new JarFile(this.path)) {
-                return jf.stream().map(ZipEntry::getName).filter(classEnding.asMatchPredicate()).collect(Collectors.toList());
+                return jf.stream()
+                    .map(ZipEntry::getName)
+                    .filter(classEnding.asMatchPredicate())
+                    .filter(c -> c.startsWith("org/elasticsearch/logging/internal/") == false)
+                    .collect(Collectors.toList());
             }
         }
 

build-tools-internal/version.properties

@@ -29,7 +29,7 @@ opensaml = 4.3.0
 
 # client dependencies
 httpclient        = 4.5.14
-httpcore          = 4.4.13
+httpcore          = 4.4.16
 httpasyncclient   = 4.1.5
 commonslogging    = 1.2
 commonscodec      = 1.15

gradle/build.versions.toml

@@ -19,7 +19,7 @@ docker-compose = "com.avast.gradle:gradle-docker-compose-plugin:0.17.5"
 forbiddenApis = "de.thetaphi:forbiddenapis:3.8"
 gradle-enterprise = "com.gradle:develocity-gradle-plugin:3.18.1"
 hamcrest = "org.hamcrest:hamcrest:2.1"
-httpcore = "org.apache.httpcomponents:httpcore:4.4.12"
+httpcore = "org.apache.httpcomponents:httpcore:4.4.16"
 httpclient = "org.apache.httpcomponents:httpclient:4.5.14"
 idea-ext = "gradle.plugin.org.jetbrains.gradle.plugin.idea-ext:gradle-idea-ext:1.1.4"
 javaparser = "com.github.javaparser:javaparser-core:3.18.0"

gradle/verification-metadata.xml

@@ -2598,11 +2598,6 @@
             <sha256 value="5324d2cbc2d311c9f91b82bcbc746ec2a29f1f5b744395a50ff3afb873db1cee" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.httpcomponents" name="httpcore" version="4.4.12">
-         <artifact name="httpcore-4.4.12.jar">
-            <sha256 value="ab765334beabf0ea024484a5e90a7c40e8160b145f22d199e11e27f68d57da08" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="org.apache.httpcomponents" name="httpcore" version="4.4.13">
          <artifact name="httpcore-4.4.13.jar">
             <sha256 value="e06e89d40943245fcfa39ec537cdbfce3762aecde8f9c597780d2b00c2b43424" origin="Generated by Gradle"/>
@@ -2618,9 +2613,9 @@
             <sha256 value="f7bc09dc8a7003822d109634ffd3845d579d12e725ae54673e323a7ce7f5e325" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.httpcomponents" name="httpcore-nio" version="4.4.13">
-         <artifact name="httpcore-nio-4.4.13.jar">
-            <sha256 value="71fcfbe869002c48563cc5979fc734571c8d0d167ccce42970c932f337981f19" origin="Generated by Gradle"/>
+      <component group="org.apache.httpcomponents" name="httpcore-nio" version="4.4.16">
+         <artifact name="httpcore-nio-4.4.16.jar">
+            <sha256 value="4018736ede2d321034e8517ea90baefb31831a8608afccc446d8a699fb1d00d4" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.apache.james" name="apache-mime4j-core" version="0.8.11">

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java

@@ -138,8 +138,10 @@ private FileAccessTree(
             });
         }
 
-        // everything has access to the temp dir and the jdk
+        // everything has access to the temp dir, config dir and the jdk
         addPathAndMaybeLink.accept(pathLookup.tempDir(), Mode.READ_WRITE);
+        // TODO: this grants read access to the config dir for all modules until explicit read entitlements can be added
+        addPathAndMaybeLink.accept(pathLookup.configDir(), Mode.READ);
 
         // TODO: watcher uses javax.activation which looks for known mime types configuration, should this be global or explicit in watcher?
         Path jdk = Paths.get(System.getProperty("java.home"));

libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTreeTests.java

@@ -136,7 +136,7 @@ public void testPathAndFileWithSamePrefix() {
     }
 
     public void testReadWithRelativePath() {
-        for (var dir : List.of("config", "home")) {
+        for (var dir : List.of("home")) {
             var tree = accessTree(entitlement(Map.of("relative_path", "foo", "mode", "read", "relative_to", dir)), List.of());
             assertThat(tree.canRead(path("foo")), is(false));
 
@@ -153,7 +153,7 @@ public void testReadWithRelativePath() {
     }
 
     public void testWriteWithRelativePath() {
-        for (var dir : List.of("config", "home")) {
+        for (var dir : List.of("home")) {
             var tree = accessTree(entitlement(Map.of("relative_path", "foo", "mode", "read_write", "relative_to", dir)), List.of());
             assertThat(tree.canWrite(path("/" + dir + "/foo")), is(true));
             assertThat(tree.canWrite(path("/" + dir + "/foo/subdir")), is(true));
@@ -289,6 +289,12 @@ public void testTempDirAccess() {
         assertThat(tree.canWrite(TEST_PATH_LOOKUP.tempDir()), is(true));
     }
 
+    public void testConfigDirAccess() {
+        var tree = FileAccessTree.of("test-component", "test-module", FilesEntitlement.EMPTY, TEST_PATH_LOOKUP, List.of());
+        assertThat(tree.canRead(TEST_PATH_LOOKUP.configDir()), is(true));
+        assertThat(tree.canWrite(TEST_PATH_LOOKUP.configDir()), is(false));
+    }
+
     public void testBasicExclusiveAccess() {
         var tree = accessTree(entitlement("foo", "read"), exclusivePaths("test-component", "test-module", "foo"));
         assertThat(tree.canRead(path("foo")), is(true));

server/src/main/java/org/elasticsearch/search/fetch/StoredFieldsSpec.java

@@ -42,8 +42,17 @@ public StoredFieldsSpec merge(StoredFieldsSpec other) {
         if (this == other) {
             return this;
         }
-        Set<String> mergedFields = new HashSet<>(this.requiredStoredFields);
-        mergedFields.addAll(other.requiredStoredFields);
+        Set<String> mergedFields;
+        if (other.requiredStoredFields.isEmpty()) {
+            /*
+             * In the very very common case that we don't need new stored fields
+             * let's not clone the existing array.
+             */
+            mergedFields = this.requiredStoredFields;
+        } else {
+            mergedFields = new HashSet<>(this.requiredStoredFields);
+            mergedFields.addAll(other.requiredStoredFields);
+        }
         return new StoredFieldsSpec(
             this.requiresSource || other.requiresSource,
             this.requiresMetadata || other.requiresMetadata,

server/src/test/java/org/elasticsearch/common/logging/HeaderWarningTests.java

@@ -315,9 +315,9 @@ public void testAddComplexWarning() {
                 + "profiling-symbols,synthetics] with patterns (.deprecation-indexing-template => [.logs-deprecation.*],"
                 + ".fleet-file-data => [.fleet-file-data-*-*],.fleet-files => [.fleet-files-*-*],.ml-anomalies- => [.ml-anomalies-*],"
                 + ".ml-notifications-000002 => [.ml-notifications-000002],.ml-state => [.ml-state*],.ml-stats => [.ml-stats-*],"
-                + ".monitoring-beats-mb => [.monitoring-beats-8-*],.monitoring-ent-search-mb => [.monitoring-ent-search-8-*],"
-                + ".monitoring-es-mb => [.monitoring-es-8-*],.monitoring-kibana-mb => [.monitoring-kibana-8-*],"
-                + ".monitoring-logstash-mb => [.monitoring-logstash-8-*],.profiling-ilm-lock => [.profiling-ilm-lock*],"
+                + ".monitoring-beats-mb => [.monitoring-beats-9-*],.monitoring-ent-search-mb => [.monitoring-ent-search-8-*],"
+                + ".monitoring-es-mb => [.monitoring-es-9-*],.monitoring-kibana-mb => [.monitoring-kibana-9-*],"
+                + ".monitoring-logstash-mb => [.monitoring-logstash-9-*],.profiling-ilm-lock => [.profiling-ilm-lock*],"
                 + ".slm-history => [.slm-history-7*],.watch-history-16 => [.watcher-history-16*],"
                 + "behavioral_analytics-events-default => [behavioral_analytics-events-*],ilm-history => [ilm-history-7*],"
                 + "logs => [logs-*-*],metrics => [metrics-*-*],profiling-events => [profiling-events*],profiling-executables => "

server/src/test/java/org/elasticsearch/search/fetch/StoredFieldsSpecTests.java

@@ -18,7 +18,10 @@
 import org.elasticsearch.search.internal.SearchContext;
 import org.elasticsearch.test.ESTestCase;
 
+import java.util.Set;
+
 import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.sameInstance;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -67,6 +70,17 @@ public void testScriptFieldsEnableMetadata() {
         assertTrue(spec.requiresMetadata());
     }
 
+    public void testNoCloneOnMerge() {
+        StoredFieldsSpec spec = StoredFieldsSpec.NO_REQUIREMENTS;
+        spec = spec.merge(StoredFieldsSpec.NEEDS_SOURCE);
+        assertThat(spec.requiredStoredFields(), sameInstance(StoredFieldsSpec.NO_REQUIREMENTS.requiredStoredFields()));
+
+        StoredFieldsSpec needsCat = new StoredFieldsSpec(false, false, Set.of("cat"));
+        StoredFieldsSpec withCat = spec.merge(needsCat);
+        spec = withCat.merge(StoredFieldsSpec.NO_REQUIREMENTS);
+        assertThat(spec.requiredStoredFields(), sameInstance(withCat.requiredStoredFields()));
+    }
+
     private static SearchContext searchContext(SearchSourceBuilder sourceBuilder) {
         SearchContext sc = mock(SearchContext.class);
         when(sc.fetchSourceContext()).thenReturn(sourceBuilder.fetchSource());

x-pack/plugin/core/template-resources/src/main/resources/monitoring-ent-search-mb.json

@@ -1,5 +1,5 @@
 {
-  "index_patterns": [".monitoring-ent-search-${xpack.stack.monitoring.template.version}-*"],
+  "index_patterns": [".monitoring-ent-search-8-*"],
   "version": ${xpack.stack.monitoring.template.release.version},
   "_meta": {
     "description": "Template used by Enterprise Search Metricbeat module monitoring information for Stack Monitoring",