Merge remote-tracking branch 'origin/main' into esql_searchstats_for_…

…indexed_docvalues

build-tools-internal/src/main/groovy/elasticsearch.ide.gradle

@@ -137,15 +137,15 @@ if (providers.systemProperty('idea.active').getOrNull() == 'true') {
     }
   }
 
-  // modifies the idea module config to enable preview features on 'elasticsearch-native' module
+  // modifies the idea module config to enable preview features on ':libs:native' module
   tasks.register("enablePreviewFeatures") {
     group = 'ide'
     description = 'Enables preview features on native library module'
     dependsOn tasks.named("enableExternalConfiguration")
 
     doLast {
       ['main', 'test'].each { sourceSet ->
-        modifyXml(".idea/modules/libs/native/elasticsearch.libs.elasticsearch-native.${sourceSet}.iml") { xml ->
+        modifyXml(".idea/modules/libs/native/elasticsearch.libs.${project.project(':libs:native').name}.${sourceSet}.iml") { xml ->
           xml.component.find { it.'@name' == 'NewModuleRootManager' }?.'@LANGUAGE_LEVEL' = 'JDK_21_PREVIEW'
         }
       }

build-tools-internal/version.properties

@@ -2,7 +2,7 @@ elasticsearch     = 9.0.0
 lucene            = 10.0.0
 
 bundled_jdk_vendor = openjdk
-bundled_jdk = 22.0.1+8@c7ec1332f7bb44aeba2eb341ae18aca4
+bundled_jdk = 23+37@3c5b90190c68498b986a97f276efd28a
 # optional dependencies
 spatial4j         = 0.7
 jts               = 1.15.0

docs/changelog/114862.yaml

@@ -0,0 +1,5 @@
+pr: 114862
+summary: "[Inference API] Add API to get configuration of inference services"
+area: Machine Learning
+type: enhancement
+issues: []

docs/changelog/115624.yaml

@@ -0,0 +1,7 @@
+pr: 115624
+summary: "ES|QL: fix LIMIT pushdown past MV_EXPAND"
+area: ES|QL
+type: bug
+issues:
+ - 102084
+ - 102061

docs/changelog/115811.yaml

@@ -0,0 +1,5 @@
+pr: 115811
+summary: "Prohibit changes to index mode, source, and sort settings during restore"
+area: Logs
+type: bug
+issues: []

docs/changelog/115812.yaml

@@ -0,0 +1,5 @@
+pr: 115812
+summary: "Prohibit changes to index mode, source, and sort settings during resize"
+area: Logs
+type: bug
+issues: []

docs/changelog/115868.yaml

@@ -0,0 +1,5 @@
+pr: 115868
+summary: Forward bedrock connection errors to user
+area: Machine Learning
+type: bug
+issues: []

docs/changelog/115923.yaml

@@ -0,0 +1,16 @@
+pr: 115923
+summary: Apply more strict parsing of actions in bulk API
+area: Indices APIs
+type: breaking
+issues: [ ]
+breaking:
+  title: Apply more strict parsing of actions in bulk API
+  area: REST API
+  details: >-
+    Previously, the following classes of malformed input were deprecated but not rejected in the action lines of the a
+    bulk request: missing closing brace; additional keys after the action (which were ignored); additional data after
+    the closing brace (which was ignored). They will now be considered errors and rejected.
+  impact: >-
+    Users must provide well-formed input when using the bulk API. (They can request REST API compatibility with v8 to
+    get the previous behaviour back as an interim measure.)
+  notable: false

docs/changelog/115952.yaml

@@ -0,0 +1,5 @@
+pr: 115952
+summary: "ESQL: Fix a bug in VALUES agg"
+area: ES|QL
+type: bug
+issues: []

gradle/verification-metadata.xml

@@ -579,11 +579,6 @@
             <sha256 value="c8fb4839054d280b3033f800d1f5a97de2f028eb8ba2eb458ad287e536f3f25f" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.google.crypto.tink" name="tink" version="1.14.0">
-         <artifact name="tink-1.14.0.jar">
-            <sha256 value="47b2248705e0c9771bc259f22465a79655c1296e2d47aaee852adb7cdacb6198" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.google.errorprone" name="error_prone_annotations" version="2.11.0">
          <artifact name="error_prone_annotations-2.11.0.jar">
             <sha256 value="721cb91842b46fa056847d104d5225c8b8e1e8b62263b993051e1e5a0137b7ec" origin="Generated by Gradle"/>
@@ -759,11 +754,6 @@
             <sha256 value="8540247fad9e06baefa8fb45eb313802d019f485f14300e0f9d6b556ed88e753" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="com.google.protobuf" name="protobuf-java" version="4.27.0">
-         <artifact name="protobuf-java-4.27.0.jar">
-            <sha256 value="9072e60fe66cff5d6c0f11a1df21d8f3e4b29b5ee782b45c3fc75f59fbe2b839" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="com.google.protobuf" name="protobuf-java-util" version="3.25.5">
          <artifact name="protobuf-java-util-3.25.5.jar">
             <sha256 value="dacc58b2c3d2fa8d4bddc1acb881e78d6cf7c137dd78bc1d67f6aca732436a8d" origin="Generated by Gradle"/>
@@ -1851,6 +1841,27 @@
             <sha256 value="de7f00fd1bd0d3a4c678fff2681dfad19284d74d357218a4be6f623488d040da" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="openjdk_23" name="linux" version="23">
+         <artifact name="linux-23-aarch64.tar.gz">
+            <sha256 value="076dcf7078cdf941951587bf92733abacf489a6570f1df97ee35945ffebec5b7" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="linux-23-x64.tar.gz">
+            <sha256 value="08fea92724127c6fa0f2e5ea0b07ff4951ccb1e2f22db3c21eebbd7347152a67" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
+      <component group="openjdk_23" name="macos" version="23">
+         <artifact name="macos-23-aarch64.tar.gz">
+            <sha256 value="9527bf080a74ae6dca51df413aa826f0c011c6048885e4c8ad112172be8815f3" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="macos-23-x64.tar.gz">
+            <sha256 value="5c3a909fd2079d0e376dd43c85c4f7d02d08914866f196480bd47784b2a0121e" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
+      <component group="openjdk_23" name="windows" version="23">
+         <artifact name="windows-23-x64.zip">
+            <sha256 value="cba5013874ba50cae543c86fe6423453816c77281e2751a8a9a633d966f1dc04" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.abego.treelayout" name="org.abego.treelayout.core" version="1.0.3">
          <artifact name="org.abego.treelayout.core-1.0.3.jar">
             <sha256 value="fa5e31395c39c2e7d46aca0f81f72060931607b2fa41bd36038eb2cb6fb93326" origin="Generated by Gradle"/>

distribution/tools/entitlement-agent/build.gradle → libs/entitlement/agent/build.gradle

@@ -13,20 +13,20 @@ apply plugin: 'elasticsearch.build'
 apply plugin: 'elasticsearch.embedded-providers'
 
 embeddedProviders {
-  impl 'entitlement-agent', project(':distribution:tools:entitlement-agent:impl')
+  impl 'entitlement-agent', project(':libs:entitlement:agent:impl')
 }
 
 configurations {
   entitlementBridge
 }
 
 dependencies {
-  entitlementBridge project(":distribution:tools:entitlement-bridge")
+  entitlementBridge project(":libs:entitlement:bridge")
   compileOnly project(":libs:core")
-  compileOnly project(":distribution:tools:entitlement-runtime")
+  compileOnly project(":libs:entitlement")
   testImplementation project(":test:framework")
-  testImplementation project(":distribution:tools:entitlement-bridge")
-  testImplementation project(":distribution:tools:entitlement-agent:impl")
+  testImplementation project(":libs:entitlement:bridge")
+  testImplementation project(":libs:entitlement:agent:impl")
 }
 
 tasks.named('test').configure {

distribution/tools/entitlement-agent/impl/build.gradle → libs/entitlement/agent/impl/build.gradle

@@ -10,10 +10,10 @@
 apply plugin: 'elasticsearch.build'
 
 dependencies {
-  compileOnly project(':distribution:tools:entitlement-agent')
+  compileOnly project(':libs:entitlement:agent')
   implementation 'org.ow2.asm:asm:9.7'
   testImplementation project(":test:framework")
-  testImplementation project(":distribution:tools:entitlement-bridge")
+  testImplementation project(":libs:entitlement:bridge")
   testImplementation 'org.ow2.asm:asm-util:9.7'
 }
 

distribution/tools/entitlement-runtime/build.gradle → libs/entitlement/build.gradle

@@ -13,7 +13,7 @@ dependencies {
   compileOnly project(':libs:core') // For @SuppressForbidden
   compileOnly project(":libs:x-content") // for parsing policy files
   compileOnly project(':server') // To access the main server module for special permission checks
-  compileOnly project(':distribution:tools:entitlement-bridge')
+  compileOnly project(':libs:entitlement:bridge')
   testImplementation project(":test:framework")
 }
 

modules/mapper-extras/src/internalClusterTest/java/org/elasticsearch/index/mapper/MatchOnlyTextMapperIT.java

@@ -12,6 +12,7 @@
 import org.elasticsearch.action.bulk.BulkRequestBuilder;
 import org.elasticsearch.action.bulk.BulkResponse;
 import org.elasticsearch.action.support.WriteRequest;
+import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.index.mapper.extras.MapperExtrasPlugin;
 import org.elasticsearch.index.query.QueryBuilders;
 import org.elasticsearch.plugins.Plugin;
@@ -89,13 +90,14 @@ public void testHighlightingWithMatchOnlyTextFieldSyntheticSource() throws IOExc
         // load the source.
 
         String mappings = """
-            { "_source" : { "mode" : "synthetic" },
+            {
               "properties" : {
                 "message" : { "type" : "match_only_text" }
               }
             }
             """;
-        assertAcked(prepareCreate("test").setMapping(mappings));
+        Settings.Builder settings = Settings.builder().put(indexSettings()).put("index.mapping.source.mode", "synthetic");
+        assertAcked(prepareCreate("test").setSettings(settings).setMapping(mappings));
         BulkRequestBuilder bulk = client().prepareBulk("test").setRefreshPolicy(WriteRequest.RefreshPolicy.IMMEDIATE);
         for (int i = 0; i < 2000; i++) {
             bulk.add(

modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapperTests.java

@@ -64,19 +64,19 @@ protected Object getSampleValueForDocument() {
     }
 
     public void testExistsStandardSource() throws IOException {
-        assertExistsQuery(createMapperService(testMapping(false)));
+        assertExistsQuery(createMapperService(fieldMapping(b -> b.field("type", "match_only_text"))));
     }
 
     public void testExistsSyntheticSource() throws IOException {
-        assertExistsQuery(createMapperService(testMapping(true)));
+        assertExistsQuery(createSytheticSourceMapperService(fieldMapping(b -> b.field("type", "match_only_text"))));
     }
 
     public void testPhraseQueryStandardSource() throws IOException {
-        assertPhraseQuery(createMapperService(testMapping(false)));
+        assertPhraseQuery(createMapperService(fieldMapping(b -> b.field("type", "match_only_text"))));
     }
 
     public void testPhraseQuerySyntheticSource() throws IOException {
-        assertPhraseQuery(createMapperService(testMapping(true)));
+        assertPhraseQuery(createSytheticSourceMapperService(fieldMapping(b -> b.field("type", "match_only_text"))));
     }
 
     private void assertPhraseQuery(MapperService mapperService) throws IOException {
@@ -104,13 +104,6 @@ protected void registerParameters(ParameterChecker checker) throws IOException {
         );
     }
 
-    private static XContentBuilder testMapping(boolean syntheticSource) throws IOException {
-        if (syntheticSource) {
-            return syntheticSourceMapping(b -> b.startObject("field").field("type", "match_only_text").endObject());
-        }
-        return fieldMapping(b -> b.field("type", "match_only_text"));
-    }
-
     @Override
     protected void minimalMapping(XContentBuilder b) throws IOException {
         b.field("type", "match_only_text");
@@ -256,7 +249,7 @@ public void testDocValues() throws IOException {
     }
 
     public void testDocValuesLoadedFromSynthetic() throws IOException {
-        MapperService mapper = createMapperService(syntheticSourceFieldMapping(b -> b.field("type", "match_only_text")));
+        MapperService mapper = createSytheticSourceMapperService(fieldMapping(b -> b.field("type", "match_only_text")));
         assertScriptDocValues(mapper, "foo", equalTo(List.of("foo")));
     }
 

modules/repository-azure/build.gradle

@@ -63,8 +63,12 @@ dependencies {
   api "com.github.stephenc.jcip:jcip-annotations:1.0-1"
   api "com.nimbusds:content-type:2.3"
   api "com.nimbusds:lang-tag:1.7"
-  api "com.nimbusds:nimbus-jose-jwt:9.37.3"
-  api "com.nimbusds:oauth2-oidc-sdk:11.9.1"
+  api("com.nimbusds:nimbus-jose-jwt:9.37.3"){
+    exclude group: 'com.google.crypto.tink', module: 'tink' // it's an optional dependency on which we don't rely
+  }
+  api("com.nimbusds:oauth2-oidc-sdk:11.9.1"){
+    exclude group: 'com.google.crypto.tink', module: 'tink' // it's an optional dependency on which we don't rely
+  }
   api "jakarta.activation:jakarta.activation-api:1.2.1"
   api "jakarta.xml.bind:jakarta.xml.bind-api:2.3.3"
   api "net.java.dev.jna:jna-platform:${versions.jna}" // Maven says 5.14.0 but this aligns with the Elasticsearch-wide version
@@ -74,8 +78,6 @@ dependencies {
   api "org.codehaus.woodstox:stax2-api:4.2.2"
   api "org.ow2.asm:asm:9.3"
 
-  runtimeOnly "com.google.crypto.tink:tink:1.14.0"
-  runtimeOnly "com.google.protobuf:protobuf-java:4.27.0"
   runtimeOnly "com.google.code.gson:gson:2.11.0"
   runtimeOnly "org.cryptomator:siv-mode:1.5.2"
 
@@ -175,13 +177,11 @@ tasks.named("thirdPartyAudit").configure {
     //    'org.slf4j.ext.EventData' - bring back when https://github.com/elastic/elasticsearch/issues/93714 is done
 
     // Optional dependency of tink
-    'com.google.api.client.http.HttpHeaders',
-    'com.google.api.client.http.HttpRequest',
-    'com.google.api.client.http.HttpRequestFactory',
-    'com.google.api.client.http.HttpResponse',
-    'com.google.api.client.http.HttpTransport',
-    'com.google.api.client.http.javanet.NetHttpTransport',
-    'com.google.api.client.http.javanet.NetHttpTransport$Builder',
+    'com.google.crypto.tink.subtle.Ed25519Sign',
+    'com.google.crypto.tink.subtle.Ed25519Sign$KeyPair',
+    'com.google.crypto.tink.subtle.Ed25519Verify',
+    'com.google.crypto.tink.subtle.X25519',
+    'com.google.crypto.tink.subtle.XChaCha20Poly1305',
 
     // Optional dependency of nimbus-jose-jwt and oauth2-oidc-sdk
     'org.bouncycastle.asn1.pkcs.PrivateKeyInfo',
@@ -253,14 +253,6 @@ tasks.named("thirdPartyAudit").configure {
     'javax.activation.MailcapCommandMap',
     'javax.activation.MimetypesFileTypeMap',
     'reactor.core.publisher.Traces$SharedSecretsCallSiteSupplierFactory$TracingException',
-
-    'com.google.protobuf.MessageSchema',
-    'com.google.protobuf.UnsafeUtil',
-    'com.google.protobuf.UnsafeUtil$1',
-    'com.google.protobuf.UnsafeUtil$Android32MemoryAccessor',
-    'com.google.protobuf.UnsafeUtil$Android64MemoryAccessor',
-    'com.google.protobuf.UnsafeUtil$JvmMemoryAccessor',
-    'com.google.protobuf.UnsafeUtil$MemoryAccessor',
   )
 }