OpenSearch

Version 3.8.0 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 3.8.0

Features

• Add API to modify a data stream's backing indices (POST /_data_stream/_modify) (#22487)
• Add multivalue_doc_count aggregation that returns the number of documents with two or more values (#20472)
• Add pull-based ingestion from Hive tables via new ingestion-hive plugin (#21700)
• Add support for HTTP/3 on the client side via JDK HttpClient (#21718)
• Add gRPC support for Point-in-Time (PIT) create and delete operations (#22105)
• Add gRPC API support for extra_field_values in bulk requests (#21907)
• Add cross-cluster streaming support to the remote cluster client via Arrow Flight (#22359)
• Add coordinator-side index-level field domain pruning before can_match for faster time-range queries (#21865)
• Add bulkscorer script processing interface in ScriptScore query for bulk scoring optimizations (#22423)
• Add process-wide ObjectInputFilter to reject Java deserialization by default, gated behind bootstrap.serial_filter setting (#22073)
• Add cluster-level default setting for delayed shard allocation timeout (cluster.routing.allocation.unassigned.node_left.delayed_timeout) (#22379)

Enhancements

• Add HTTP request body decompression (gzip/deflate) to reactor-netty4 transport (#22382)
• Add cross-setting validator to prevent cluster-manager crash loop when both balance factors are set to zero (#22391)
• Add support for double, int, and long types in ExtraFieldValue for gRPC bulk indexing (#22058)
• Add timing logs for repository create, update, and delete operations (#22489)
• Add parent action name to ProcessorGenerationContext for conditional system-generated processor logic (#22195)
• Add getter for remote translog transfer tracker to enable plugin access to tracking metrics (#22453)
• Deprecate RestClient in favor of the internal HTTP client (#22116)
• Disable Mustache partial template resolution in search templates (#22438)
• Use binary serialization for resource usage headers to reduce CPU overhead on the search path (#21230)
• Preserve resolved search pipeline id and inline pipeline source through query rewrite (#22501)
• Fork GET _aliases serialization to MANAGEMENT thread pool to avoid blocking transport threads (#21954)
• Strengthen scroll_id validation to prevent OOM from crafted scroll IDs (#22396)
• Add depth tracking to recursive deserialization to prevent StackOverflowError (#22404)
• Validate base_path in FsRepository to prevent path traversal outside path.repo (#22328)
• Add path boundary validation in resolveAnalyzerPath to prevent directory traversal (#22094)
• Register snapshot resilience settings (snapshot.repository.io_timeout, max_outstanding_ops, cleanup_stale_blobs) (#22516)
• Wire request_timeout into S3 sync client to prevent indefinite hangs on degraded stores (#22479)
• Separate internal ignore settings from user ignore settings during snapshot restore (#20494)
• Validate total_primary_shards_per_node on index templates against the cluster instead of index-local flag (#22203)
• Rollover checkBlock now scoped to write index only, skipping non-write alias members (#21838)

Bug Fixes

• Fix OpenSearchTimeoutException to return HTTP 504 instead of 500 (#22064)
• Fix ClassCastException on malformed mappings in create index to return 400 instead of 500 (#22371)
• Fix NPE for search-only indices without primaries in cluster allocation explain and bulk shard selection (#22097)
• Fix NPE in S3 multipart upload when provideStream() throws, and fix shared segment array corruption (#22309)
• Fix ReplicationCheckpoint.compareTo to return 0 for equal checkpoints, preventing TimSort crash during shard allocation (#22376)
• Fix negative os.cpu.percent on cgroup v2 containers by granting read access to /sys/fs/cgroup/cpu.stat (#22408)
• Fix snapshot listing failing on repositories containing legacy Elasticsearch snapshots (#22193)
• Fix default SSE type to send AES256 header, preventing silent snapshot failures on buckets requiring encryption (#22144)
• Fix default replica count resolution from node settings (opensearch.yml) (#22334)
• Fix filter rewrite crash with sub-aggregations in date_histogram when segment contains out-of-range documents (#22390)
• Fix V1 template merge regression that broke dynamic object inheritance for dotted field paths (#22515)
• Fix disable_objects array parsing to preserve dotted field names (#22127)
• Fix field resolution for dotted fields under disable_objects (#21929)
• Fix NestedQueryBuilder.visit() to recursively visit child query tree (#22196)
• Fix InputStream leak when loading hyphenation patterns in analysis-common (#22508)
• Fix _cat/nodes API showing negative values in cpu stats when perf counters are unavailable (#22074)
• Fix global ordinals to properly trip fielddata circuit breaker (#22129)
• Restore default max nesting depth to 1000 and decouple stream depth limit from XContent limit (#22486)
• Fix unbounded recursion in deserialization that can cause StackOverflowError (#22404)

Maintenance

• Bump bc-fips to 2.1.3 to fix CVE-2026-8149 (#22537)
• Upgrade Jackson 2 to 2.22.1 to resolve CVE-2026-54515 (#22476)
• Bump Hadoop from 3.4.2 to 3.5.0 to resolve CVE-2026-2332 (#22362)
• Update Jackson to 3.2.1 (#22497)
• Update Netty to 4.2.16.Final (#22403)
• Update OpenTelemetry to 1.63.0 (#22111)
• Update Project Reactor to 3.8.6 and Reactor Netty to 1.3.6 (#22059)
• Upgrade Lucene to 10.5.0 (#22322)
• Accommodate JDK-26 related changes with respect to HttpClient behavior (#22386)
• Remove OpenSearchYamlFactory / OpenSearchYamlParser after Jackson 3.2.0 update (#22147)

Version 2.19.6 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 2.19.6

Bug Fixes

• Fix hang in bulk request when index is deleted during primary phase (#21305)
• Fix case insensitive and escaped query on wildcard fields (#20870)
• Fix array index out of bounds exception with wildcard fields and aggregations (#20862)
• Harden circuit breaker and failure handling logic to prevent negative estimated limits in query result consumer (#20769)
• Prevent negative fielddata stats by guarding against stale removals after shard reallocation (#22016)

Maintenance

• Update Netty to 4.1.135.Final (#21968)
• Bump org.apache.avro:avro to 1.12.1 (#22350)
• Bump Bouncy Castle (bcprov/bcpkix-jdk18on) to 1.84 (#22296)
• Bump ZooKeeper to 3.9.5 (#22296)
• Bump plexus-utils to 3.6.1 (#22296)
• Bump log4j to 2.25.4 (#22292)
• Bump Jetty to 9.4.58 (#22292)
• Bump maven-model to 3.9.16 (#22292)
• Bump plexus-xml to 3.0.1 (#22292)
• Bump commons-configuration2 to 2.15.0 (#22292)
• Bump jsoup to 1.22.2 (#22292)
• Bump Jackson to 2.18.8 (#22292)
• Bump reactor-netty to 1.2.18 (#22292)
• Bump reactor-core to 3.7.19 (#22292)
• Update bundled JDK to JDK 21.0.11+10 (#21419)

Version 3.7.0 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 3.7.0

Features

• Add dynamic properties support for pattern-based field definitions without cluster state mapping updates (#20816)
• Add pluggable data format engine with DataFormatAwareEngine for multi-format indexing (#21181)
• Add Lucene engine implementation for pluggable data formats (#21299)
• Add merge support for Parquet data format plugin via streaming k-way merge sort (#21079)
• Add directory and IndexInput layers for WritableWarm tiered storage (#21178)
• Add server-side implementation for tiering status APIs (GetTieringStatus and ListTieringStatus) (#21220)
• Add server-side implementation for HotToWarm, WarmToHot, and CancelTiering APIs (#21295)
• Add prefetch settings and stored fields prefetch for WritableWarm tiered storage (#21285)
• Add slow logs, per-query metrics, and migration metrics for WritableWarm tiered storage (#21332)
• Add module wiring and integration tests for WritableWarm tiered storage (#21427)
• Add tiered object storage crate for warm node file routing (#21204)
• Add event-driven scheduler and stage execution for analytics engine (#21242)
• Add coordinator-side DataFusion reduce with streaming Arrow batches (#21356)
• Add distributed aggregation with partial/final mode for analytics engine (#21457)
• Add distributed join planning and execution for analytics engine (#21639)
• Add PPL append command support with multi-child stage runtime for Union (#21474)
• Add PPL dedup command support via ROW_NUMBER window function (#21622)
• Add PPL eventstats and streamstats window function support (#21734)
• Add PPL top and rare command support via window functions (#21593)
• Add PPL parse command with regex mode via Rust UDFs (#21573)
• Add PPL rex command with sed and extract modes (#21550)
• Add PPL spath command with auto-extract mode via json_extract_all UDF (#21664)
• Add 7 PPL JSON scalar functions to analytics engine route (#21513)
• Add 23 PPL datetime scalar functions to analytics engine route (#21556)
• Add 14 additional PPL datetime functions (Wave A) including strftime, date_format, maketime (#21582)
• Add 30+ PPL math scalar functions to analytics engine (#21520)
• Add PPL string scalar functions to analytics engine (18 functions) (#21543)
• Add PPL conditional functions (coalesce, isempty, isblank, case, if, ifnull) to analytics engine (#21643)
• Add PPL conversion scalar functions (num, auto, memk, rmcomma, dur2sec, ctime, mktime) to analytics engine (#21628)
• Add PPL cryptographic functions (md5, sha1, sha2, crc32) to analytics engine (#21611)
• Add PPL array constructor and 8 multivalue functions to analytics engine (#21554)
• Add PPL bucketing scalars (span_bucket, width_bucket, minspan_bucket, range_bucket) (#21621)
• Add PPL TAKE, FIRST, LAST, LIST, VALUES aggregate functions (#21731)
• Add Lucene filter delegation from DataFusion for full-text search predicates (#21555)
• Add performance delegation to Lucene for selective filter predicates (#21701)
• Add native Arrow transport path with zero-copy transfer for stream transport (#21253)
• Stream Arrow batches on data-node fragment execution path (#21418)
• Add support for extra_fields outside _source indexing for improved vector ingestion throughput (#20635)
• Add gRPC support for Min, Max, and Terms aggregations (#21205)
• Add partition strategy setting for flexible shard-to-partition mapping in pull-based ingestion (#21165)
• Add SplitToFieldsProcessor for distributing split values to target fields (#21216)
• Add native memory based admission control for transport request throttling (#21191)
• Add native memory search backpressure for off-heap query cancellation (#21647)
• Add unified native allocator framework for Arrow allocations with elastic rebalancing (#21703)
• Add on-demand jemalloc heap profiling support via JMX CLI tool (#21599)
• Add search.max_buckets to workload group settings for per-tenant bucket limits (#21721)
• Add additional search settings and override_request_values to workload management groups (#21523)
• Add hunspell dictionary hot-reload support via _refresh_search_analyzers API (#21559)

Enhancements

• Add adaptive query budget for DataFusion engine with bounded memory and improved throughput (#21695)
• Add DynamicLimitPool for runtime memory pool limit changes in DataFusion (#21286)
• Add configurable coordinator buffer limit for per-query Arrow allocator (#21726)
• Add CPU task cancellation for DataFusion queries (#21560)
• Add IO task cancellation support for DataFusion queries (#21531)
• Add DataFusion logical and physical plan logging at DEBUG level (#21646)
• Add dynamic settings for indexed query execution path (#21522)
• Add dedicated analytics_scheduler thread pool to prevent coordinator deadlock (#21771)
• Add dedicated analytics_reduce thread pool for coordinator reduce drains (#21800)
• Add native memory stats and task cancellation stats to node stats API (#21637)
• Add current_application_duration_ms to cluster state download stats in node stats API (#20922)
• Add segments and segment stats support for DataFormatAwareEngine (#21696)
• Add DataFormat-aware NRT replication engine and remote-store wiring (#21311)
• Add DataFormat-aware shallow snapshot v2 support (#21742)
• Add DataFormat-aware read-only engine for warm primaries with tiering service improvements (#21720)
• Add dynamic mapping support for pluggable data formats (#21444)
• Add delete execution engine abstraction for DataFormatAwareEngine (#21313)
• Add cluster-scope defaults for pluggable dataformat settings (#21435)
• Add indexing support for metadata fields in pluggable data formats (#21585)
• Add Lucene merge support for pluggable data format composite engine (#21422)
• Add composite merge handler and merge policy for data-format-aware engine (#21128)
• Add sort-on-refresh for composite engine with cross-format row-ID consistency (#21468)
• Add warm+format directory wiring with per-format tiered directory routing (#21361)
• Add block cache SPI and Foyer plugin for warm nodes (#21530)
• Add REST API paths for block cache prune and detailed file cache stats (#21705)
• Add cancellation checkpoints in field data loading and aggregation paths (#21318)
• Add queryTimeout to IndexSearcher for KNN vector search timeout enforcement (#21316)
• Add index-level authorization to analytics engine via ActionFilter dispatch (#21789)
• Add /_analytics/ppl/_explain endpoint with stage profiling (#21660)
• Add relevance function support (match_phrase, multi_match, query_string, etc.) to analytics engine (#21562)
• Add relevance functions optional parameter support and new functions (wildcard_query, query, match_all) (#21661)
• Add filter pushdown rules and Calcite rule metrics for profiling (#21684)
• Add per-column encoding and compression configuration for Parquet data format (#21665)
• Avoid repeated encoding and compression for sort column writes in Parquet (#21464)
• Add pipeline execution metrics to PollingIngestStats for pull-based ingestion (#21024)
• Add batching for persistent task cluster service to reduce cluster manager load (#21245)
• Refactor BitsetFilterCache to node-level cache with configurable size limit (#21179)
• Skip zone awareness when auto_expand_replicas is set to all (#21217)
• Relax field-level meta validation constraints to allow any number of entries with string values (#20578)
• Deprecate boolean constructor of FetchSourceContext in favor of static constants (#21235)
• Add validation and deprecation warnings for ambiguous _source filtering (#21203)
• Speed up Painless Script Engine initialization by ~10% (#21463)
• Fix accumulation of file sizes when multiple files share the same extension in segment stats (#21000)
• Improve native memory admission control precision with auto-derived budget and JVM non-heap subtraction (#21749)
• Tighten DataFusion memory guard with RSS-based hard guard to prevent OOM under concurrent load (#21814)
• Support indices_boost_2 array format for gRPC search (#21300)
• Add configurable Kafka metadata timeout for pull-based ingestion (#21425)
• Expose tokio-metrics as DataFusion plugin stats (#21303)
• Add Lucene FFM callbacks to task resource tracking (#21610)

Bug Fixes

• Fix YAML parser corrupting string values that resemble booleans after Jackson 3.x migration (#21294)
• Fix map_unmapped_fields_as_text lost after dynamic mapping update in PercolatorFieldMapper (#21301)
• Fix O(n²) removeAll in remote translog metadata cleanup causing CPU spikes (#21350)
• Fix Rounding.isUTC() to recognize UTC timezone aliases for date histogram optimization (#21221)
• Fix NPE in QueryPhaseResultConsumer when all shards fail (#21158)
• Fix bulk request hang when index is deleted during primary phase (#21305)
• Fix deadlock between engineMutex and writeLock during index close and engine reset (#21404)
• Fix FlightOutboundHandler clearing caller's ThreadContext (#21167)
• Fix IndicesRequestCacheCleanupIT flakiness by removing too-short assertBusy timeouts (#21494)
• Fix negative fielddata stats by guarding against stale removals after shard reallocation (#21667)
• Fix half_float ingest writing wrong fp16 bit pattern in Parquet (#21783)
• Fix StringView buffer bloat in DataFusion stream_next FFI export causing 435x data amplification (#21753)
• Fix Utf8View/Utf8 schema mismatch panic in indexed parquet path (#21826)
• Fix memory leak in transport-reactor-netty4 plugin with persistent connections (#21788)
• Fix ExitablePostingsEnum to extend FilterPostingsEnum for proper delegation (#21558)
• Fix local recovery from flush for DataFormatAwareEngine (#21553)
• Fix safe-commit info and replication checksum for DFA shards (#21787)
• Fix DFA recovery failures: file-handle leak and reset-path crash (#21759)
• Handle null scripted metric combine results (#21534)
• Demote "No resource usage stats available for node" log from WARN to DEBUG (#21638)
• Fix pull-based ingestion document mapper usage to reflect mapping updates (#21183)
• Fix pull-based ingestion consumer factory to be stateless and prevent race conditions (#21652)
• Fix pull-based ingestion multi-threaded writer batchStartPointer computation (#21697)
• Fix Netty4Http3ServerTransport to use configured HeaderVerifier and Decompressor instances (#21281)
• Convert varchar to str in analytics engine Project operations to fix DataFusion type errors (#21794)
• Fix microsecond() function and add timestamp lower-bound validation in analytics engine (#21793)
• Enforce write blocks for DFA hot-to-warm tiering to survive DiskThresholdMonitor removal (#21828)

Maintenance

• Bump Netty to 4.2.14.Final (#21772)
• Update Jackson to 2.21.3 / 3.1.3 (#21493)
• Update ASM to 9.10 (#21764)
• Update OpenTelemetry to 1.62.0 and SemConv to 1.41.0 (#21595)
• Update Project Reactor to 3.8.5 and Reactor Netty to 1.3.5 (#21226)
• Update bundled JDK to JDK 25.0.3 (#21353)
• Update log4j2 to 2.25.4 (#21416)
• Update httpclient5 to 5.6.1 (#21441)
• Bump commons-configuration2 from 2.14.0 to 2.15.0 (#21806)
• Bump org.apache.commons:commons-configuration2 from 2.13.0 to 2.14.0 (#21213)
• Bump com.google.protobuf from 0.9.6 to 0.10.0 (#21291)
• Bump org.apache.hadoop:hadoop-minicluster from 3.4.2 to 3.5.0 (#21138)
• Bump org.codehaus.woodstox:stax2-api from 4.2.2 to 4.3.0 (#21137)
• Bump org.jline:jline from 4.0.0 to 4.0.14 (#21471)
• Bump org.jsoup:jsoup from 1.22.1 to 1.22.2 (#21290)
• Bump com.nimbusds:nimbus-jose-jwt from 10.8 to 10.9 (#21214)
• Remove Unsafe class injection from Java agent (#21542)
• Replace mimalloc with jemalloc as global allocator for native sandbox plugins (#21497)
• Upgrade DataFusion to v53 and Arrow to v58 (#21590)
• Pin GitHub Actions to commit SHAs for supply chain security (#21808)
• Update FIPS bootstrap check to use OpenSearch env var instead of BouncyCastle system property (#21415)

Version 2.19.5 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 2.19.5

Bug Fixes

• Add case sensitivity as an argument to XContentMapValues.filter (#19976)
• Fix segment replication failure during rolling restart (#20498)

Infrastructure

• Update wrapper github workflow version (#20748)

Maintenance

• Bulk update of HDFS test fixture dependencies (#20768)
• Bump shadow-gradle-plugin from 8.3.9 to 9.3.1 (#20569)
• Bump netty from 4.1.125.Final to 4.1.131.Final (#20744)
• Bump log4j from 2.21.0 to 2.25.3 (#20308)

Version 3.6.0 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 3.6.0

Features

• Add bitmap64 query support (#20606)
• Add warmup phase for pull-based ingestion to prevent serving stale data before catching up with the streaming source (#20526)
• Implement field_mapping ingestion message mapper for pull-based ingestion (#20729)
• Add mapper_settings support and field_mapping mapper type for pull-based ingestion (#20722)
• Remove experimental tag for pull-based ingestion, marking it as public API (#20704)

Enhancements

• Add index warmer support for replica shards using segment replication (#20650)
• Add indices to search request slow log for easier request identification (#20588)
• Add node-level JVM and CPU runtime metrics following OpenTelemetry semantic conventions (#20844)
• Add new Sensitive setting property for tiering dynamic settings authorization (#20901)
• Add adaptive shard selection for bulk writes on append-only indices (#20065)
• Add support for expected remote cluster name validation in CCS sniff mode (#20532)
• Add search_settings support to WLM workload groups with initial timeout setting (#20536)
• Add scroll API support for workload management rule-based autotagging (#20151)
• Add stream request flag to SearchRequestContext for plugin consumption (#20530)
• Support Docker distribution builds for ppc64le, arm64, and s390x architectures (#20678)
• Fallback to Netty HTTP client when AWS CRT client is unavailable on the target platform (#20698)
• Add intra-segment support for single-value metric aggregations (sum, min, max, avg, stats, cardinality, value_count) (#20503)
• Expose wrapped scorer in ProfileScorer for plugin access to custom scorer methods (#20549)
• Fix ProfileScorer.getChildren() to expose wrapped scorer in the scorer tree hierarchy (#20607)
• Remove X-Request-Id format restrictions and make maximum length configurable (#21048)
• Make telemetry Tags immutable with allocation-efficient factories and content-based equality (#20788)
• Add ref_path support for package-based Hunspell dictionary loading with multi-tenant isolation (#20840)
• Prevent criteria field updates for context-aware indices to simplify version management (#20250)
• Add indexer interface to decouple IndexShard from Engine for pluggable engine architectures (#20675)
• Use ReadAdviseByContext for MMapDirectory instead of Lucene default read advise (#21062)

Bug Fixes

• Fix copy_to functionality for geo_point fields with object and array values (#20542)
• Fix field_caps returning empty results for disable_objects mappings and field name corruption (#20814)
• Fix terms lookup subquery to use cluster max_clause_count setting instead of hardcoded fallback (#20823)
• Fix terms aggregation performance regression on high-cardinality fields by adding a max cardinality setting (#20623)
• Fix terms aggregation performance regression using segment-to-global ordinals mapping (#20683)
• Fix array_index_out_of_bounds_exception with wildcard and aggregations under concurrent access (#20842)
• Add range validations in query builder and field mapper (#20518)
• Fix synonym_graph filter failure with word_delimiter_graph by handling analyzer dependency ordering (#19248)
• Fix index template pattern collision false positives for multi-wildcard patterns (#20702)
• Fix SecurityException when using opensearch.cgroups.hierarchy.override setting (#20565)
• Fix SLF4J component error caused by slf4j-api version mismatch with log4j binding (#20587)
• Fix JSON escaping in task details log metadata (#20802)
• Fix listBlobsByPrefixInSortedOrder in EncryptedBlobContainer to respect limit and prevent JVM exhaustion (#20514)
• Fix batched deletion of stale cluster metadata manifests to prevent remote storage pile-up (#20566)
• Fix segment replication infinite retry caused by stale metadata checkpoint (#20551)
• Fix ExitableTerms to delegate getMin/getMax methods avoiding slow path in field sort (#20775)
• Lazily initialize stored field reader in SourceLookup to avoid unnecessary madvise calls (#20827)
• Fix CriteriaBasedCodec to work with delegate codec (#20442)
• Show heap percent threshold instead of moving average in search cancellation messages (#20779)
• Relax updatedAt validation for WLM workload group creation to handle minor clock skew (#20486)
• Improve exception messaging when encountering legacy Elasticsearch version IDs during upgrade (#20512)
• Fix Windows service startup with OpenJDK by updating procrun to 1.5.1 (#20615)
• Expose STRICT_EXPAND_OPEN_HIDDEN_FORBID_CLOSED index option via static method (#20980)
• Fix stale segments cleanup to also trigger based on segments map size threshold (#20976)
• Move Randomness from server to lib/common to reduce FIPS demo installer size (#20570)
• Add accessUnixDomainSocket permission for transport-grpc on Windows (#20649)
• Harden HTTP/3 support detection by checking Quic native library availability for the target platform (#20680)
• Use OPENSEARCH_FIPS_MODE environment variable to enable FIPS enforced mode instead of checking for bcFIPS jars (#20625)
• Fix Arrow Flight transport TLS certificate hot-reload (#20700)
• Fix stream transport TLS certificate hot-reload by using live SSLContext from SecureTransportSettingsProvider (#20734)
• Ensure transient ThreadContext headers with propagators survive context restore (#20854)

Maintenance

• Bump Apache Lucene from 10.3.2 to 10.4.0 (#20735)
• Update Netty to 4.2.12.Final (#20586), (#20997), (#20998)
• Update Jackson to 2.21.2 (#20989)
• Bump OpenTelemetry to 1.60.1 and OpenTelemetry Semconv to 1.40.0 (#20737), (#20797)
• Bump Project Reactor to 3.8.4 and Reactor Netty to 1.3.4 (#20589), (#20834)
• Bump ch.qos.logback:logback-classic to 1.5.32 and logback-core to 1.5.27 (#20525), (#20761)
• Bump com.nimbusds:nimbus-jose-jwt from 10.7 to 10.8 (#20715)
• Bump com.sun.xml.bind:jaxb-impl from 4.0.6 to 4.0.7 (#20886)
• Bump com.netflix.nebula.ospackage-base from 12.2.0 to 12.3.0 (#20799)
• Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0 (#20576)
• Bump org.jline:jline from 3.30.6 to 4.0.0 (#20800)
• Bump org.jruby.jcodings:jcodings from 1.0.63 to 1.0.64 (#20713)
• Bump org.jruby.joni:joni from 2.2.3 to 2.2.7 (#20714), (#20759)
• Bump org.tukaani:xz from 1.11 to 1.12 (#20760)
• Bump shadow-gradle-plugin from 8.3.9 to 9.3.1 (#20569)

Version 3.5.0 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 3.5.0

Added

• Add support for fields containing dots in their name as literals (#19958)
• Add support for forward translog reading (#20163)
• Added public getter method in SourceFieldMapper to return excluded field (#20205)
• Add integ test for simulating node join left event when data node cluster state publication lag because the cluster applier thread being busy (#19907).
• Relax jar hell check when extended plugins share transitive dependencies (#20103)
• Added public getter method in SourceFieldMapper to return included field (#20290)
• Support for HTTP/3 (server side) (#20017)
• Add circuit breaker support for gRPC transport to prevent out-of-memory errors (#20203)
• Add index-level-encryption support for snapshots and remote-store (#20095)
• Adding BackWardCompatibility test for remote publication enabled cluster (#20221)
• Support for hll field mapper to support cardinality rollups (#20129)
• Add tracing support for StreamingRestChannel (#20361)
• Introduce new libs/netty4 module to share common implementation between netty-based plugins and modules (transport-netty4, transport-reactor-netty4) (#20447)
• Add validation to make crypto store settings immutable (#20123)
• Introduce concurrent translog recovery to accelerate segment replication primary promotion (#20251)
• Update to almalinux:10 (#20482)
• Add X-Request-Id to uniquely identify a search request (#19798)
• Added TopN selection logic for streaming terms aggregations (#20481)
• Added support for Intra Segment Search (#19704)
• Introduce AdditionalCodecs and EnginePlugin::getAdditionalCodecs hook to allow additional Codec registration (#20411)

Changed

• Handle custom metadata files in subdirectory-store (#20157)
• Add support for missing proto fields in GRPC FunctionScore and Highlight (#20169)
• Ensure all modules are included in INTEG_TEST testcluster distribution (#20241)
• Cleanup HttpServerTransport.Dispatcher in Netty tests (#20160)
• Use compact object headers with JDK25+ (#20392)
• Add cluster.initial_cluster_manager_nodes to testClusters OVERRIDABLE_SETTINGS (#20348)
• Add BigInteger support for unsigned_long fields in gRPC transport (#20346)
• Install demo security information when running ./gradlew run -PinstalledPlugins="['opensearch-security']" (#20372)
• Add Alt-Svc header support to advertise HTTP/3 availability (#20434)
• Refactor streaming agg query phase planning (#20471)

Fixed

• Fix Snapshot rename replacement unbounded length rename (#20464)
• Fix segment replication failure during rolling restart (#19234)
• Fix bug of warm index: FullFileCachedIndexInput was closed error (#20055)
• Fix flaky test ClusterMaxMergesAtOnceIT.testClusterLevelDefaultUpdatesMergePolicy (#18056)
• Fix bug in Assertion framework(Yaml Rest test): numeric comparison fails when comparing Integer vs Long (or Float vs Double) (#19376)
• Fix Netty deprecation warnings in transport-netty4 module (#20233)
• Fix snapshot restore when an index sort is present (#20284)
• Fix SearchPhaseExecutionException to properly initCause (#20320)
• [repository-s3] remove endpointOverride and let AWS SDK V2 S3 determine the s3 url based on bucket name or arn provided (#20345)
• Fix cluster.remote.<cluster_alias>.server_name setting no populating SNI (#20321)
• Fix X-Opaque-Id header propagation (along with other response headers) for streaming Reactor Netty 4 transport (#20371)
• Allow removing plugin that's optionally extended (#20417)
• Fix indexing regression and bug fixes for grouping criteria. (20145)
• LeafReader should not remove SubReaderWrappers incase IndexWriter encounters a non aborting Exception (#20193)
• Fix Netty deprecation warnings in transport-reactor-netty4 module (20429)
• Fix stats aggregation returning zero results with size:0. (20427)
• Fix the node local term and version being truncated in logs when host providers return very long IP or host strings (20432)
• Remove child level directory on refresh for CompositeIndexWriter (#20326)
• Fixes and refactoring in stream transport to make it more robust (#20359)

Dependencies

• Bump com.google.auth:google-auth-library-oauth2-http from 1.38.0 to 1.41.0 (#20183)
• Bump actions/checkout from 5 to 6 (#20186)
• Bump org.apache.commons:commons-configuration2 from 2.12.0 to 2.13.0 (#20185, #20184)
• Bump Project Reactor to 3.8.1 and Reactor Netty to 1.3.1 (#20217)
• Bump OpenTelemetry to 1.57.0 and OpenTelemetry Semconv to 1.37.0 (#20231)
• Bump peter-evans/create-pull-request from 7 to 8 (#20236)
• Bump org.apache.kerby:kerb-admin from 2.1.0 to 2.1.1 (#20235)
• Bump org.checkerframework:checker-qual from 3.49.0 to 3.52.1 (#20234)
• Bump netty to 4.2.9.Final (#20230)
• Bump log4j from 2.21.0 to 2.25.3 (#20308)
• Bump org.apache.logging.log4j:log4j-core from 2.25.2 to 2.25.3 (#20300)
• Bump ch.qos.logback:logback-core from 1.5.20 to 1.5.23 (#20303)
• Bump com.google.api.grpc:proto-google-iam-v1 from 1.57.0 to 1.58.2 (#20302)
• Bump actions/setup-java from 4 to 5 (#20304)
• Bump com.squareup.okhttp3:okhttp from 5.3.0 to 5.3.2 (#20331)
• Bump asm from 9.7 to 9.9.1 (#20330)
• Bump actions/upload-artifact from 5 to 6 (#20333)
• Bump com.google.http-client:google-http-client-appengine from 2.0.2 to 2.0.3 (#20332)
• Bump jackson from 2.18.1 to 2.20.1 (#20343)
• Bump opensearch-protobufs from 0.24.0 to 1.0.0 and update transport-grpc module compatibility (#20335)
• Bump Apache HttpClient5 to 5.6 (#20358)
• Bump Apache HttpCore5 to 5.4 (#20358)
• Bump org.jsoup:jsoup from 1.21.2 to 1.22.1 (#20368)
• Bump org.jline:jline from 3.30.5 to 3.30.6 (#20369)
• Bump lycheeverse/lychee-action from 2.6.1 to 2.7.0 (#20370)
• Bump opensearch-protobufs from 1.0.0 to 1.1.0 and update transport-grpc module compatibility (#20396)
• Bump ch.qos.logback:logback-classic from 1.5.23 to 1.5.24 (#20407)
• Bump org.wiremock:wiremock-standalone from 3.6.0 to 3.13.2 (#20406)
• Bump tj-actions/changed-files from 47.0.0 to 47.0.1 (#20408)
• Bump reactor-netty to 1.3.2, reactor to 3.8.2 (#20419)
• Bump org.apache.maven:maven-model from 3.9.6 to 3.9.12 (#20438)
• Bump dnsjava:dnsjava from 3.6.3 to 3.6.4 (#20440)
• Bump com.netflix.nebula.ospackage-base from 12.1.1 to 12.2.0 (#20439)
• Bump OpenTelemetry to 1.58.0 (#20441)
• Bump com.nimbusds:nimbus-jose-jwt from 10.6 to 10.7 (#20478)
• Bump opensearch-protobufs from 1.1.0 to 1.2.0 (#20480)
• Bump com.netflix.nebula:nebula-publishing-plugin from 21.1.0 to 23.0.0 (#20477)

Removed

• Remove identity-shiro from plugins folder (#20305)

Version 3.4.0 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 3.4.0

Added

• Allow setting index.creation_date on index creation and restore for plugin compatibility and migrations (#19931)
• Add support for a ForkJoinPool type (#19008)
• Add seperate shard limit validation for local and remote indices (#19532)
• Use Lucene pack method for half_float and unsigned_long when using ApproximatePointRangeQuery (#19553)
• New cluster setting search.query.max_query_string_length_monitor_only (#19539)
• Add a mapper for context aware segments grouping criteria (#19233)
• Return full error for GRPC error response (#19568)
• Add support for repository with Server side encryption enabled and client side encryption as well based on a flag (#19630)
• Add pluggable gRPC interceptors with explicit ordering(#19005)
• Add BindableServices extension point to transport-grpc-spi (#19304)
• Add metrics for the merged segment warmer feature (#18929)
• Handle deleted documents for filter rewrite sub-aggregation optimization (#19643)
• Add bulk collect API for filter rewrite sub-aggregation optimization (#19933)
• Allow collectors take advantage of preaggregated data using collectRange API (#20009)
• Bulk collection logic for metrics and cardinality aggregations (#20067)
• Add pointer based lag metric in pull-based ingestion (#19635)
• Introduced internal API for retrieving metadata about requested indices from transport actions (#18523)
• Add cluster defaults for merge autoThrottle, maxMergeThreads, and maxMergeCount; Add segment size filter to the merged segment warmer (#19629)
• Add build-tooling to run in FIPS environment (#18921)
• Add SMILE/CBOR/YAML document format support to Bulk GRPC endpoint (#19744)
• Make test-suite runnable under FIPS compliance support (#18491)
• Implement GRPC Search params Highlightand Sort (#19868)
• Implement GRPC ConstantScoreQuery, FuzzyQuery, MatchBoolPrefixQuery, MatchPhrasePrefix, PrefixQuery, MatchQuery (#19854)
• Add async periodic flush task support for pull-based ingestion (#19878)
• Add support for context aware segments (#19098)
• Implement GRPC FunctionScoreQuery (#19888)
• Implement error_trace parameter for bulk requests (#19985)
• Allow the truncate filter in normalizers (#19778)
• Support pull-based ingestion message mappers and raw payload support (#19765)
• Add search API tracker (#18601)
• Support dynamic consumer configuration update in pull-based ingestion (#19963)
• Cache the StoredFieldsReader for scroll query optimization (#20112)
• Add Hybrid Cardinality collector to prioritize Ordinals Collector (#19524)

Changed

• Combining filter rewrite and skip list to optimize sub aggregation(#19573)
• Faster terms query creation for keyword field with index and docValues enabled (#19350)
• Refactor to move prepareIndex and prepareDelete methods to Engine class (#19551)
• Omit maxScoreCollector in SimpleTopDocsCollectorContext when concurrent segment search enabled (#19584)
• Onboarding new maven snapshots publishing to s3 (#19619)
• Remove MultiCollectorWrapper and use MultiCollector in Lucene instead (#19595)
• Change implementation for percentiles aggregation for latency improvement (#19648)
• Wrap checked exceptions in painless.DefBootstrap to support JDK-25 (#19706)
• Refactor the ThreadPoolStats.Stats class to use the Builder pattern instead of constructors (#19317)
• Refactor the IndexingStats.Stats class to use the Builder pattern instead of constructors (#19306)
• Remove FeatureFlag.MERGED_SEGMENT_WARMER_EXPERIMENTAL_FLAG. (#19715)
• Replace java.security.AccessController with org.opensearch.secure_sm.AccessController in sub projects with SocketAccess class (#19803)
• Replace java.security.AccessController with org.opensearch.secure_sm.AccessController in discovery plugins (#19802)
• Change the default value of doc_values in WildcardFieldMapper to true. (#19796)
• Make Engine#loadHistoryUUID() protected and Origin#isFromTranslog() public (#19753)
• Bump opensearch-protobufs dependency to 0.23.0 and update transport-grpc module compatibility (#19831)
• Refactor the RefreshStats class to use the Builder pattern instead of constructors (#19835)
• Refactor the DocStats and StoreStats class to use the Builder pattern instead of constructors (#19863)
• Pass registry of headers from ActionPlugin.getRestHeaders to ActionPlugin.getRestHandlerWrapper (#19875)
• Refactor the Condition.Stats and DirectoryFileTransferTracker.Stats class to use the Builder pattern instead of constructors (#19862)
• Refactor the RemoteTranslogTransferTracker.Stats and RemoteSegmentTransferTracker.Stats class to use the Builder pattern instead of constructors (#19837)
• Refactor the GetStats, FlushStats and QueryCacheStats class to use the Builder pattern instead of constructors (#19935)
• Add RangeSemver for dependencies in plugin-descriptor.properties (#19939)
• Refactor the FieldDataStats and CompletionStats class to use the Builder pattern instead of constructors (#19936)
• Thread Context Preservation by gRPC Interceptor (#19776)
• Update NoOpResult constructors in the Engine to be public (#19950)
• Make XContentMapValues.filter case insensitive (#19976)
• Refactor the TranslogStats and RequestCacheStats class to use the Builder pattern instead of constructors (#19961)
• Improve performance of matrix_stats aggregation (#19989)
• Refactor the IndexPressutreStats, DeviceStats and TransportStats class to use the Builder pattern instead of constructors (#19991)
• Refactor the Cache.CacheStats class to use the Builder pattern instead of constructors (#20015)
• Refactor the HttpStats, ScriptStats, AdaptiveSelectionStats and OsStats class to use the Builder pattern instead of constructors (#20014)
• Bump opensearch-protobufs dependency to 0.24.0 and update transport-grpc module compatibility (#20059)
• Refactor the ShardStats, WarmerStats and IndexingPressureStats class to use the Builder pattern instead of constructors (#19966)
• Add skiplist optimization to auto_date_histogram aggregation (#20057)
• Throw exceptions for currently unsupported GRPC request-side fields (#20162)

Fixed

• Fix Allocation and Rebalance Constraints of WeightFunction are incorrectly reset (#19012)
• Fix flaky test FieldDataLoadingIT.testIndicesFieldDataCacheSizeSetting (#19571)
• Fix case-insensitive wildcard + aggregation query crash (#19489)
• Avoid primary shard failure caused by merged segment warmer exceptions (#19436)
• Fix pull-based ingestion out-of-bounds offset scenarios and remove persisted offsets (#19607)
• Fix issue with updating core with a patch number other than 0 (#19377)
• [Java Agent] Allow JRT protocol URLs in protection domain extraction (#19683)
• Fix potential concurrent modification exception when updating allocation filters (#19701)
• Fix wildcard query with escaped backslash followed by wildcard character (#19719)
• Fix file-based ingestion consumer to handle start point beyond max line number (#19757)
• Fix IndexOutOfBoundsException when running include/exclude on non-existent prefix in terms aggregations (#19637)
• Fixed assertion unsafe use of ClusterService.state() in ResourceUsageCollectorService ([#19775])(https://github.com/opensearch-project/OpenSearch/pull/19775))
• Fix Unified highlighter for nested fields when using matchPhrasePrefixQuery (#19442)
• Add S3Repository.LEGACY_MD5_CHECKSUM_CALCULATION to list of repository-s3 settings (#19788)
• Fix NullPointerException when restoring remote snapshot with missing shard size information (#19684)
• Fix NPE of ScriptScoreQuery (#19650)
• Fix ClassCastException in FlightClientChannel for requests larger than 16KB (#20010)
• Fix GRPC Bulk (#19937)
• Fix node bootstrap error when enable stream transport and remote cluster state (#19948)
• Keep track and release Reactor Netty 4 Transport accepted Http Channels during the Node shutdown (#20106)
• Fix deletion failure/error of unused index template; case when an index template matches a data stream but has a lower priority. (#20102)
• Fixed version incompatibility in remote state entities using bytestream for ser/de (#20080)
• Fix toBuilder method in EngineConfig to include mergedSegmentTransferTracker(#20105)
• Fixed handling of property index in BulkRequest during deserialization (#20132)
• Fix negative CPU usage values in node stats (#19120)
• Fix duplicate registration of FieldDataCache dynamic setting (#20140)
• Fix array out of bounds during aggregation (#20204)

Dependencies

• Bump Apache Lucene from 10.3.1 to 10.3.2 (#20026)
• Update to Gradle 9.2 (#19575) (#19856)
• Update bundled JDK to JDK-25 (#19314)
• Bump peter-evans/create-or-update-comment from 4 to 5 (#19536)
• Bump com.azure:azure-core-http-netty from 1.15.12 to 1.16.1 (#19533)
• Bump org.apache.zookeeper:zookeeper from 3.9.3 to 3.9.4 (#19535)
• Bump com.azure:azure-storage-common from 12.30.2 to 12.30.3 (#19615)
• Bump peter-evans/create-issue-from-file from 5 to 6 (#19616)
• Bump com.squareup.okhttp3:okhttp from 5.1.0 to 5.3.0 (#19614, #19944)
• Bump com.microsoft.azure:msal4j from 1.21.0 to 1.23.1 (#19688)
• Bump commons-net:commons-net from 3.11.1 to 3.12.0 (#19687)
• Bump org.apache.avro:avro from 1.12.0 to 1.12.1 (#19692)
• Bump com.github.spotbugs:spotbugs-annotations from 4.9.6 to 4.9.8 (#19691)
• Bump stefanzweifel/git-auto-commit-action from 6 to 7 (#19689)
• Bump ch.qos.logback modules from 1.5.18 to 1.5.20 in HDFS test fixture (#19763)
• Bump github/codeql-action from 3 to 4 (#19785)
• Bump gradle/actions from 4 to 5 (#19781)
• Bump org.bouncycastle:bc-fips from 2.1.1 to 2.1.2 (#19818)
• Bump com.google.http-client:google-http-client-gson from 1.47.1 to 2.0.0 (#19253)
• Bump com.sun.xml.bind:jaxb-impl from 2.2.3-1 to 4.0.6 (#19472)
• Bump tj-actions/changed-files from 46.0.5 to 47.0.0 (#19873)
• Bump com.google.api.grpc:proto-google-iam-v1 from 1.55.0 to 1.57.0 (#19872)
• Bump org.apache.commons:commons-text from 1.13.1 to 1.14.0 (#19871)
• Exclude group com.microsoft.sqlserver from hadoop-minicluster (#19889)
• Bump netty to 4.2.4 (#19178)
• Bump actions/github-script from 7 to 8 (#19946)
• Bump com.google.api:gax-httpjson from 2.69.0 to 2.72.1 (#19943)
• Update Hadoop to 3.4.2 and enable security (Kerberos) integration tests under JDK-24 and above (#19952)
• Bump com.google.cloud:google-cloud-storage from 2.55.0 to 2.60.0 (#20023)
• Bump commons-cli:commons-cli from 1.10.0 to 1.11.0 (#20022)
• Bump com.squareup.okio:okio from 3.16.0 to 3.16.3 (#20025)
• Bump org.tukaani:xz from 1.10 to 1.11 (#20082)
• Bump com.google.api:api-common from 2.52.0 to 2.55.1 (#20083)
• Bump actions/upload-artifact from 4 to 5 (#20081)
• Bump com.nimbusds:nimbus-jose-jwt from 10.5 to 10.6 (#20084)
• Bump commons-logging from 1.2 to 1.3.5 (#20156)

Deprecated

• Deprecated existing constructors in ThreadPoolStats.Stats in favor of the new Builder (#19317)
• Deprecated existing constructors in IndexingStats.Stats in favor of the new Builder (#19306)
• Deprecated existing constructors in RefreshStats in favor of the new Builder (#19835)
• Deprecated existing constructors in DocStats and StoreStats in favor of the new Builder (#19863)
• Deprecated existing constructors in Condition.Stats and DirectoryFileTransferTracker.Stats in favor of the new Builder (#19862)
• Deprecated existing constructors in RemoteTranslogTransferTracker.Stats and RemoteSegmentTransferTracker.Stats in favor of the new Builder (#19837)
• Deprecated existing constructors in GetStats, FlushStats and QueryCacheStats in favor of the new Builder (#19935)
• Deprecated existing constructors in FieldDataStats and CompletionStats in favor of the new Builder (#19936)
• Deprecated existing constructors in TranslogStats and RequestCacheStats in favor of the new Builder (#19961)
• Deprecated existing constructors in IndexPressutreStats, DeviceStats and TransportStats in favor of the new Builder (#19991)
• Deprecated existing constructors in Cache.CacheStats in favor of the new Builder (#20015)
• Deprecated existing constructors in HttpStats, ScriptStats, AdaptiveSelectionStats and OsStats in favor of the new Builder (#20014)
• Deprecated existing constructors in ShardStats, WarmerStats and IndexingPressureStats in favor of the new Builder (#19966)

Version 2.19.4 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 2.19.4

Added

• New cluster setting search.query.max_query_string_length (#19491)

Dependencies

• Bump Apache Lucene to 9.12.3 (#19444)
• Bump org.bouncycastle:bc-fips from 2.0.0 to 2.1.2 (#19155)
• Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.18.0 (#19155)
• Bump org.bouncycastle:bcprov-jdk18on from 1.78 to 1.79 (#19155)
• Bump org.bouncycastle:bcmail-jdk18on from 1.78 to 1.79 (#19155)
• Bump org.bouncycastle:bcpkix-jdk18on from 1.78 to 1.79 (#19155)
• Bump org.apache.tika from 2.9.2 to 3.2.2 (#19242)
• Bump org.apache.commons:commons-compress from 1.26.1 to 1.28.0 (#19125)
• Bump org.apache.commons:commonscodec from 1.16.1 to 1.18.0 (#19125)
• Replace commons-lang:commons-lang with org.apache.commons:commons-lang3 (#19229)
• Bump netty from 4.1.121.Final to 4.1.125.Final (#19270)
• Bump bouncycastle from 1.79 to 1.82 (#19552)
• Bump org.ajoberstar.grgit:grgit-core from 5.2.1 to 5.3.2 (#19606)
• Bump reactor-netty from 1.1.23 to 1.2.9 (#19603)
• Bump reactor from 3.5.20 to 3.7.5 (#19603)
• Bump org.apache.hadoop:hadoop-minicluster from 3.4.1 to 3.4.2 (#19605)
• Bump io.grpc deps from 1.68.2 to 1.75.0 (#19495)
• Bump com.nimbusds:nimbus-jose-jwt from 10.0.2 to 10.3 (#19604)
• Exclude commons-lang and org.jsonschema2pojo from hadoop-miniclusters (#19538)

Fixed

• Add task cancellation checks in aggregators (#18426)
• Fix OOM due to large number of shard result buffering (#19066)
• Fix QueryPhaseResultConsumer incomplete callback loops (#19231)
• Use ScoreDoc instead of FieldDoc when creating TopScoreDocCollectorManager to avoid unnecessary conversion (#18802)
• Fix IndexOutOfBoundsException when running include/exclude on non-existent prefix in terms aggregations (#19637)

Changed

• Replace centos:8 with almalinux:8 since centos docker images are deprecated (#19154)
• Allow plugins to copy folders into their config dir during installation (#19343)
• Onboarding new maven snapshots publishing to s3 (#19632)

Version 3.3.2 Release Notes

Compatible with OpenSearch 3.3.2 and OpenSearch Dashboards 3.3.0

Fixed

• [Star Tree] Fix sub-aggregator casting for search with profile=true (#19652)
• [Java Agent] Allow JRT protocol URLs in protection domain extraction (#19683)
• Fix bwc @timestamp upgrade issue by adding a version check on skip_list param (#19671)
• Fix issue with updating core with a patch number other than 0 (#19377)
• Fix IndexOutOfBoundsException when running include/exclude on non-existent prefix in terms aggregations (#19637)
• Add S3Repository.LEGACY_MD5_CHECKSUM_CALCULATION to list of repository-s3 settings (#19789)

Dependencies

• Bump ch.qos.logback modules from 1.5.18 to 1.5.20 in HDFS test fixture (#19764)
• Bump org.bouncycastle:bc-fips from 2.1.1 to 2.1.2 (#19817)

Version 3.3.1 Release Notes

OpenSearch 3.3.1 Only.

Fixed

• Fix issue with updating core with a patch number other than 0 (#19377)
• [Star Tree] Fix sub-aggregator casting for search with profile=true (#19652)
• Fix bwc @timestamp upgrade issue by adding a version check on skip_list param (#19671)