Merge remote-tracking branch 'origin/main' into updates_by_script_ras

.backportrc.json

@@ -1,9 +1,9 @@
 {
   "upstream" : "elastic/elasticsearch",
-  "targetBranchChoices" : [ "main", "8.14", "8.13", "8.12", "8.11", "8.10", "8.9", "8.8", "8.7", "8.6", "8.5", "8.4", "8.3", "8.2", "8.1", "8.0", "7.17", "6.8" ],
+  "targetBranchChoices" : [ "main", "8.15", "8.14", "8.13", "8.12", "8.11", "8.10", "8.9", "8.8", "8.7", "8.6", "8.5", "8.4", "8.3", "8.2", "8.1", "8.0", "7.17", "6.8" ],
   "targetPRLabels" : [ "backport" ],
   "branchLabelMapping" : {
-    "^v8.15.0$" : "main",
+    "^v8.16.0$" : "main",
     "^v(\\d+).(\\d+).\\d+(?:-(?:alpha|beta|rc)\\d+)?$" : "$1.$2"
   }
 }

.buildkite/pipelines/intake.yml

@@ -62,7 +62,7 @@ steps:
         timeout_in_minutes: 300
         matrix:
           setup:
-            BWC_VERSION: ["7.17.23", "8.14.2", "8.15.0"]
+            BWC_VERSION: ["7.17.23", "8.14.3", "8.15.0", "8.16.0"]
         agents:
           provider: gcp
           image: family/elasticsearch-ubuntu-2004

.buildkite/pipelines/periodic-packaging.yml

@@ -577,8 +577,8 @@ steps:
         env:
           BWC_VERSION: 8.13.4
 
-      - label: "{{matrix.image}} / 8.14.2 / packaging-tests-upgrade"
-        command: ./.ci/scripts/packaging-test.sh -Dbwc.checkout.align=true destructiveDistroUpgradeTest.v8.14.2
+      - label: "{{matrix.image}} / 8.14.3 / packaging-tests-upgrade"
+        command: ./.ci/scripts/packaging-test.sh -Dbwc.checkout.align=true destructiveDistroUpgradeTest.v8.14.3
         timeout_in_minutes: 300
         matrix:
           setup:
@@ -592,7 +592,7 @@ steps:
           buildDirectory: /dev/shm/bk
           diskSizeGb: 250
         env:
-          BWC_VERSION: 8.14.2
+          BWC_VERSION: 8.14.3
 
       - label: "{{matrix.image}} / 8.15.0 / packaging-tests-upgrade"
         command: ./.ci/scripts/packaging-test.sh -Dbwc.checkout.align=true destructiveDistroUpgradeTest.v8.15.0
@@ -611,6 +611,23 @@ steps:
         env:
           BWC_VERSION: 8.15.0
 
+      - label: "{{matrix.image}} / 8.16.0 / packaging-tests-upgrade"
+        command: ./.ci/scripts/packaging-test.sh -Dbwc.checkout.align=true destructiveDistroUpgradeTest.v8.16.0
+        timeout_in_minutes: 300
+        matrix:
+          setup:
+            image:
+              - rocky-8
+              - ubuntu-2004
+        agents:
+          provider: gcp
+          image: family/elasticsearch-{{matrix.image}}
+          machineType: custom-16-32768
+          buildDirectory: /dev/shm/bk
+          diskSizeGb: 250
+        env:
+          BWC_VERSION: 8.16.0
+
   - group: packaging-tests-windows
     steps:
       - label: "{{matrix.image}} / packaging-tests-windows"

.buildkite/pipelines/periodic.yml

@@ -642,8 +642,8 @@ steps:
             - signal_reason: agent_stop
               limit: 3
 
-      - label: 8.14.2 / bwc
-        command: .ci/scripts/run-gradle.sh -Dbwc.checkout.align=true v8.14.2#bwcTest
+      - label: 8.14.3 / bwc
+        command: .ci/scripts/run-gradle.sh -Dbwc.checkout.align=true v8.14.3#bwcTest
         timeout_in_minutes: 300
         agents:
           provider: gcp
@@ -653,7 +653,7 @@ steps:
           preemptible: true
           diskSizeGb: 250
         env:
-          BWC_VERSION: 8.14.2
+          BWC_VERSION: 8.14.3
         retry:
           automatic:
             - exit_status: "-1"
@@ -682,6 +682,26 @@ steps:
             - signal_reason: agent_stop
               limit: 3
 
+      - label: 8.16.0 / bwc
+        command: .ci/scripts/run-gradle.sh -Dbwc.checkout.align=true v8.16.0#bwcTest
+        timeout_in_minutes: 300
+        agents:
+          provider: gcp
+          image: family/elasticsearch-ubuntu-2004
+          machineType: n1-standard-32
+          buildDirectory: /dev/shm/bk
+          preemptible: true
+          diskSizeGb: 250
+        env:
+          BWC_VERSION: 8.16.0
+        retry:
+          automatic:
+            - exit_status: "-1"
+              limit: 3
+              signal_reason: none
+            - signal_reason: agent_stop
+              limit: 3
+
   - label: concurrent-search-tests
     command: .ci/scripts/run-gradle.sh -Dbwc.checkout.align=true -Dtests.jvm.argline=-Des.concurrent_search=true -Des.concurrent_search=true functionalTests
     timeout_in_minutes: 420
@@ -751,7 +771,7 @@ steps:
           setup:
             ES_RUNTIME_JAVA:
               - openjdk17
-            BWC_VERSION: ["7.17.23", "8.14.2", "8.15.0"]
+            BWC_VERSION: ["7.17.23", "8.14.3", "8.15.0", "8.16.0"]
         agents:
           provider: gcp
           image: family/elasticsearch-ubuntu-2004
@@ -801,7 +821,7 @@ steps:
               - openjdk21
               - openjdk22
               - openjdk23
-            BWC_VERSION: ["7.17.23", "8.14.2", "8.15.0"]
+            BWC_VERSION: ["7.17.23", "8.14.3", "8.15.0", "8.16.0"]
         agents:
           provider: gcp
           image: family/elasticsearch-ubuntu-2004

.ci/bwcVersions

@@ -31,5 +31,6 @@ BWC_VERSION:
   - "8.11.4"
   - "8.12.2"
   - "8.13.4"
-  - "8.14.2"
+  - "8.14.3"
   - "8.15.0"
+  - "8.16.0"

.ci/snapshotBwcVersions

@@ -1,4 +1,5 @@
 BWC_VERSION:
   - "7.17.23"
-  - "8.14.2"
+  - "8.14.3"
   - "8.15.0"
+  - "8.16.0"

benchmarks/src/main/java/org/elasticsearch/benchmark/search/aggregations/TermsReduceBenchmark.java

@@ -71,7 +71,7 @@ public class TermsReduceBenchmark {
     private final SearchPhaseController controller = new SearchPhaseController((task, req) -> new AggregationReduceContext.Builder() {
         @Override
         public AggregationReduceContext forPartialReduction() {
-            return new AggregationReduceContext.ForPartial(null, null, task, builder);
+            return new AggregationReduceContext.ForPartial(null, null, task, builder, b -> {});
         }
 
         @Override

build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/toolchain/OracleOpenJdkToolchainResolver.java

@@ -88,7 +88,7 @@ public String url(String os, String arch, String extension) {
     List<JdkBuild> builds = List.of(
         getBundledJdkBuild(),
         // 23 early access
-        new EarlyAccessJdkBuild(JavaLanguageVersion.of(23), "23", "23")
+        new EarlyAccessJdkBuild(JavaLanguageVersion.of(23), "23", "24")
     );
 
     private JdkBuild getBundledJdkBuild() {

build-tools-internal/version.properties

@@ -1,4 +1,4 @@
-elasticsearch     = 8.15.0
+elasticsearch     = 8.16.0
 lucene            = 9.11.1
 
 bundled_jdk_vendor = openjdk

docs/build.gradle

@@ -1815,6 +1815,20 @@ setups['setup-snapshots'] = setups['setup-repository'] + '''
             "run_as": [ "other_user" ],
             "metadata" : {"version": 1}
           }
+'''
+  setups['user_role'] = '''
+  - do:
+      security.put_role:
+        name: "my_user_role"
+        body: >
+          {
+            "description": "Grants user access to some indicies.",
+            "indices": [
+              {"names": ["index1", "index2" ], "privileges": ["all"], "field_security" : {"grant" : [ "title", "body" ]}}
+              ],
+            "metadata" : {"version": 1}
+          }
+
 '''
   setups['jacknich_user'] = '''
   - do:

docs/changelog/106520.yaml

@@ -0,0 +1,6 @@
+pr: 106520
+summary: Updated the transport CA name in Security Auto-Configuration.
+area: Security
+type: bug
+issues:
+ - 106455

docs/changelog/107191.yaml

@@ -0,0 +1,17 @@
+pr: 107191
+summary: Stricter failure handling in multi-repo get-snapshots request handling
+area: Snapshot/Restore
+type: bug
+issues: []
+highlight:
+  title: Stricter failure handling in multi-repo get-snapshots request handling
+  body: |
+    If a multi-repo get-snapshots request encounters a failure in one of the
+    targeted repositories then earlier versions of Elasticsearch would proceed
+    as if the faulty repository did not exist, except for a per-repository
+    failure report in a separate section of the response body. This makes it
+    impossible to paginate the results properly in the presence of failures. In
+    versions 8.15.0 and later this API's failure handling behaviour has been
+    made stricter, reporting an overall failure if any targeted repository's
+    contents cannot be listed.
+  notable: true

docs/changelog/109501.yaml

@@ -0,0 +1,14 @@
+pr: 109501
+summary: Reflect latest changes in synthetic source documentation
+area: Mapping
+type: enhancement
+issues: []
+highlight:
+  title: Synthetic `_source` improvements
+  body: |-
+    There are multiple improvements to synthetic `_source` functionality:
+
+    * Synthetic `_source` is now supported for all field types including `nested` and `object`. `object` fields are supported with `enabled` set to `false`.
+
+    * Synthetic `_source` can be enabled together with `ignore_malformed` and `ignore_above` parameters for all field types that support them.
+  notable: false

docs/changelog/109684.yaml

@@ -0,0 +1,5 @@
+pr: 109684
+summary: Avoid `ModelAssignment` deadlock
+area: Machine Learning
+type: bug
+issues: []

docs/changelog/109873.yaml

@@ -0,0 +1,5 @@
+pr: 109873
+summary: "ESQL: add Arrow dataframes output format"
+area: ES|QL
+type: feature
+issues: []

docs/changelog/110019.yaml

@@ -0,0 +1,6 @@
+pr: 110019
+summary: Improve mechanism for extracting the result of a `PlainActionFuture`
+area: Distributed
+type: enhancement
+issues:
+ - 108125

docs/changelog/110021.yaml

@@ -0,0 +1,6 @@
+pr: 110021
+summary: "[ES|QL] validate `mv_sort` order"
+area: ES|QL
+type: bug
+issues:
+ - 109910

docs/changelog/110361.yaml

@@ -0,0 +1,7 @@
+pr: 110361
+summary: Don't detect `PlainActionFuture` deadlock on concurrent complete
+area: Distributed
+type: bug
+issues:
+ - 110181
+ - 110360

docs/changelog/110383.yaml

@@ -0,0 +1,5 @@
+pr: 110383
+summary: Add bulk delete roles API
+area: Security
+type: enhancement
+issues: []

docs/changelog/110391.yaml

@@ -0,0 +1,6 @@
+pr: 110391
+summary: Fix ST_DISTANCE Lucene push-down for complex predicates
+area: ES|QL
+type: bug
+issues:
+ - 110349

docs/changelog/110400.yaml

@@ -0,0 +1,5 @@
+pr: 110400
+summary: Introduce compute listener
+area: ES|QL
+type: bug
+issues: []

docs/changelog/110431.yaml

@@ -0,0 +1,5 @@
+pr: 110431
+summary: "[Inference API] Fix serialization for inference delete endpoint response"
+area: Machine Learning
+type: bug
+issues: []

docs/changelog/110520.yaml

@@ -0,0 +1,5 @@
+pr: 110520
+summary: Add protection for OOM during aggregations partial reduction
+area: Aggregations
+type: enhancement
+issues: []

docs/changelog/110540.yaml

@@ -0,0 +1,16 @@
+pr: 110540
+summary: Deprecate using slm privileges to access ilm
+area: ILM+SLM
+type: deprecation
+issues: []
+deprecation:
+  title: Deprecate using slm privileges to access ilm
+  area: REST API
+  details: The `read_slm` privilege can get the ILM status, and
+    the `manage_slm` privilege can start and stop ILM. Access to these 
+    APIs should be granted using the `read_ilm` and `manage_ilm` privileges
+    instead. Access to ILM APIs will be removed from SLM privileges in
+    a future major release, and is now deprecated.
+  impact: Users that need access to the ILM status API should now 
+    use the `read_ilm` privilege. Users that need to start and stop ILM, 
+    should use the `manage_ilm` privilege.

docs/reference/data-streams/tsds.asciidoc

@@ -53,8 +53,9 @@ shard segments by `_tsid` and `@timestamp`.
 documents, the document `_id` is a hash of the document's dimensions and
 `@timestamp`. A TSDS doesn't support custom document `_id` values.
 
+
 * A TSDS uses <<synthetic-source,synthetic `_source`>>, and as a result is
-subject to a number of <<synthetic-source-restrictions,restrictions>>.
+subject to some <<synthetic-source-restrictions,restrictions>> and <<synthetic-source-modifications,modifications>> applied to the `_source` field.
 
 NOTE: A time series index can contain fields other than dimensions or metrics.