Merge remote-tracking branch 'upstream/main' into lookupWarning

Author: julian-elastic

docs/changelog/143433.yaml

@@ -0,0 +1,6 @@
+area: Codec
+issues: []
+pr: 143433
+summary: Rewrite `*substring*` wildcard queries to contains term queries for binary
+  doc values keywords
+type: enhancement

docs/changelog/143533.yaml

@@ -0,0 +1,6 @@
+area: Mapping
+issues:
+ - 109539
+pr: 143533
+summary: Date fields with ignore malformed do not ignore object and array values
+type: bug

docs/reference/elasticsearch/index-lifecycle-actions/ilm-wait-for-snapshot.md

@@ -7,7 +7,9 @@ mapped_pages:
 
 Phases allowed: delete.
 
-Waits for the specified {{slm-init}} policy to be executed before removing the index. This ensures that a snapshot of the deleted index is available.
+Waits for the specified {{slm-init}} policy to be executed before removing the index.
+This only checks that an SLM policy has had a successful execution at some point after the wait action has started.
+It does not ensure that a snapshot of the index is available before deletion.
 
 ## Options [ilm-wait-for-snapshot-options]
 

docs/reference/enrich-processor/geoip-processor.md

@@ -214,8 +214,7 @@ If you can’t [automatically update](#geoip-automatic-updates) your IP geolocat
 * [Use a custom endpoint](#use-custom-geoip-endpoint)
 * [Manually update your IP geolocation databases](#manually-update-geoip-databases)
 
-$$$use-proxy-geoip-endpoint$$$
-**Use a reverse proxy endpoint**
+### Use a reverse proxy endpoint [use-proxy-geoip-endpoint]
 
 If you can’t connect directly to the Elastic GeoIP endpoint, consider setting up a secure reverse proxy. You can then specify the reverse proxy endpoint URL in the [`ingest.geoip.downloader.endpoint`](#ingest-geoip-downloader-endpoint) setting of each node’s `elasticsearch.yml` file.
 
@@ -228,8 +227,7 @@ In a strict setup the following domains may need to be added to the allowed doma
 * `geoip.elastic.co`
 * `storage.googleapis.com`
 
-$$$use-custom-geoip-endpoint$$$
-**Use a custom endpoint**
+### Use a custom endpoint [use-custom-geoip-endpoint]
 
 You can create a service that mimics the Elastic GeoIP endpoint. You can then get automatic updates from this service.
 
@@ -252,8 +250,7 @@ You can create a service that mimics the Elastic GeoIP endpoint. You can then ge
     By default, {{es}} checks the endpoint for updates every three days. To use another polling interval, use the [cluster update settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings) to set [`ingest.geoip.downloader.poll.interval`](#ingest-geoip-downloader-poll-interval).
 
 
-$$$manually-update-geoip-databases$$$
-**Manually update your IP geolocation databases**
+### Manually update your IP geolocation databases [manually-update-geoip-databases]
 
 1. Use the [cluster update settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings) to set `ingest.geoip.downloader.enabled` to `false`. This disables automatic updates that may overwrite your database changes. This also deletes all downloaded databases.
 2. Download your `.mmdb` database files from the [MaxMind site](http://dev.maxmind.com/geoip/geoip2/geolite2).
@@ -264,7 +261,11 @@ $$$manually-update-geoip-databases$$$
 4. On self-managed deployments copy the database files to `$ES_CONFIG/ingest-geoip`.
 5. In your `geoip` processors, configure the `database_file` parameter to use a custom database file.
 
-### Node Settings [ingest-geoip-settings]
+### Troubleshooting geolocation database updates
+
+{{es}} ensures that only one node in the cluster downloads geolocation database updates at once. The node responsible for each download will record messages in its logs if it encounters any problems during the download. When troubleshooting problems with geolocation database updates, consult the logs from all the nodes in the cluster to gather accurate troubleshooting information.
+
+## Node Settings [ingest-geoip-settings]
 
 The `geoip` processor supports the following setting:
 
@@ -274,7 +275,7 @@ The `geoip` processor supports the following setting:
 Note that these settings are node settings and apply to all `geoip` and `ip_location` processors, i.e. there is a single cache for all such processors.
 
 
-### Cluster settings [geoip-cluster-settings]
+## Cluster settings [geoip-cluster-settings]
 
 $$$ingest-geoip-downloader-enabled$$$
 

libs/entitlement/qa/entitlement-test-plugin/build.gradle

@@ -36,3 +36,8 @@ tasks.withType(CheckForbiddenApisTask).configureEach {
   replaceSignatureFiles 'jdk-signatures'
 }
 
+// ASM bundled with forbidden-apis cannot parse JDK 26+ class files
+tasks.matching { it instanceof CheckForbiddenApisTask && it.name == 'forbiddenApisMain26' }.configureEach {
+  exclude 'org/elasticsearch/entitlement/qa/test/StructuredTaskScopeActions.class'
+}
+

libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java

@@ -56,6 +56,7 @@ record CheckAction(
         JvmActions.class,
         LoadNativeLibrariesCheckActions.class,
         ManageThreadsActions.class,
+        StructuredTaskScopeActions.class,
         NativeActions.class,
         NetworkAccessCheckActions.class,
         NioChannelsActions.class,

libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/StructuredTaskScopeActions.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+package org.elasticsearch.entitlement.qa.test;
+
+import java.util.concurrent.StructuredTaskScope;
+
+import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
+
+@SuppressWarnings({ "unused" /* called via reflection */, "removal" })
+class StructuredTaskScopeActions {
+    private StructuredTaskScopeActions() {}
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$$init() {
+        try (var scope = new StructuredTaskScope<>()) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$$init_String_ThreadFactory() {
+        try (var scope = new StructuredTaskScope<>("test", Thread.ofVirtual().factory())) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+}

libs/entitlement/qa/entitlement-test-plugin/src/main25/java/org/elasticsearch/entitlement/qa/test/StructuredTaskScopeActions.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+package org.elasticsearch.entitlement.qa.test;
+
+import java.util.concurrent.StructuredTaskScope;
+
+import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
+
+@SuppressWarnings({ "unused" /* called via reflection */ })
+class StructuredTaskScopeActions {
+    private StructuredTaskScopeActions() {}
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$open() throws Exception {
+        try (var scope = StructuredTaskScope.open()) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$open_Joiner() throws Exception {
+        try (var scope = StructuredTaskScope.open(StructuredTaskScope.Joiner.awaitAll())) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$open_Joiner_Function() throws Exception {
+        try (var scope = StructuredTaskScope.open(StructuredTaskScope.Joiner.awaitAll(), cf -> cf)) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+}

libs/entitlement/qa/entitlement-test-plugin/src/main26/java/org/elasticsearch/entitlement/qa/test/StructuredTaskScopeActions.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+package org.elasticsearch.entitlement.qa.test;
+
+import java.util.concurrent.StructuredTaskScope;
+
+import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
+
+@SuppressWarnings({ "unused" /* called via reflection */ })
+class StructuredTaskScopeActions {
+    private StructuredTaskScopeActions() {}
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$open() throws Exception {
+        try (var scope = StructuredTaskScope.open()) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$open_Joiner() throws Exception {
+        try (var scope = StructuredTaskScope.open(StructuredTaskScope.Joiner.awaitAll())) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+
+    @EntitlementTest(expectedAccess = PLUGINS)
+    static void java_util_concurrent_StructuredTaskScope$open_Joiner_UnaryOperator() throws Exception {
+        try (var scope = StructuredTaskScope.open(StructuredTaskScope.Joiner.awaitAll(), cf -> cf)) {
+            // opening and closing is enough to test the entitlement check
+        }
+    }
+}

libs/entitlement/src/main/java/org/elasticsearch/entitlement/config/MainInstrumentationProvider.java

@@ -28,7 +28,8 @@ public void init(InternalInstrumentationRegistry registry) {
             new SecurityInstrumentation(),
             new SelectorProviderInstrumentation(),
             new SystemInstrumentation(),
-            new ThreadInstrumentation()
+            new ThreadInstrumentation(),
+            new StructuredTaskScopeInstrumentation()
         ).forEach(config -> config.init(registry));
     }
 }