Merge branch '8.x' into ua/security-soln-logsdb-callout

config/serverless.yml

@@ -235,3 +235,5 @@ discover.enableUiSettingsValidations: true
 xpack.dataUsage.enabled: true
 # This feature is disabled in Serverless until fully tested within a Serverless environment
 xpack.dataUsage.enableExperimental: ['dataUsageDisabled']
+# This feature is disabled in Serverless until Inference Endpoint become enabled within a Serverless environment
+xpack.stack_connectors.enableExperimental: ['inferenceConnectorOff']

docs/api/upgrade-assistant/batch_reindexing.asciidoc

@@ -6,9 +6,11 @@
 
 experimental["The underlying Upgrade Assistant concepts are stable, but the APIs for managing Upgrade Assistant are experimental."]
 
-Start or resume multiple <<start-resume-reindex, reindexing>> tasks in one request. Additionally, reindexing tasks started or resumed
-via the batch endpoint will be placed on a queue and executed one-by-one, which ensures that minimal cluster resources
-are consumed over time.
+Start or resume upgrading multiple indices in one request. Additionally, <<start-resume-reindex, reindexing>> tasks for upgrading 
+indices that are started or resumed via the batch endpoint will be placed on a queue and executed one-by-one. This ensures that 
+minimal cluster resources are consumed over time. 
+
+NOTE: This API does not support data streams.
 
 [[batch-start-resume-reindex-request]]
 ==== Request

package.json

@@ -117,7 +117,7 @@
     "@elastic/ecs": "^8.11.5",
     "@elastic/elasticsearch": "^8.17.0",
     "@elastic/ems-client": "8.6.3",
-    "@elastic/eui": "98.2.1-borealis.1",
+    "@elastic/eui": "98.2.2-borealis.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/node-crypto": "^1.2.3",
     "@elastic/numeral": "^2.5.1",
@@ -712,7 +712,6 @@
     "@kbn/observability-onboarding-plugin": "link:x-pack/solutions/observability/plugins/observability_onboarding",
     "@kbn/observability-plugin": "link:x-pack/solutions/observability/plugins/observability",
     "@kbn/observability-shared-plugin": "link:x-pack/solutions/observability/plugins/observability_shared",
-    "@kbn/observability-synthetics-test-data": "link:x-pack/solutions/observability/packages/synthetics_test_data",
     "@kbn/observability-utils-browser": "link:x-pack/solutions/observability/packages/utils_browser",
     "@kbn/observability-utils-common": "link:x-pack/solutions/observability/packages/utils_common",
     "@kbn/observability-utils-server": "link:x-pack/solutions/observability/packages/utils_server",
@@ -1187,7 +1186,7 @@
     "minimatch": "^3.1.2",
     "moment": "^2.30.1",
     "moment-duration-format": "^2.3.2",
-    "moment-timezone": "^0.5.46",
+    "moment-timezone": "^0.5.47",
     "monaco-editor": "^0.44.0",
     "monaco-yaml": "^5.1.0",
     "murmurhash": "^2.0.1",
@@ -1216,7 +1215,7 @@
     "pretty-ms": "6.0.0",
     "prop-types": "^15.8.1",
     "proxy-from-env": "1.0.0",
-    "puppeteer": "23.7.0",
+    "puppeteer": "24.1.1",
     "query-string": "^6.13.2",
     "rbush": "^3.0.1",
     "re-resizable": "^6.9.9",
@@ -1472,6 +1471,7 @@
     "@kbn/mock-idp-plugin": "link:packages/kbn-mock-idp-plugin",
     "@kbn/mock-idp-utils": "link:packages/kbn-mock-idp-utils",
     "@kbn/observability-onboarding-e2e": "link:x-pack/solutions/observability/plugins/observability_onboarding/e2e",
+    "@kbn/observability-synthetics-test-data": "link:x-pack/solutions/observability/packages/synthetics_test_data",
     "@kbn/openapi-bundler": "link:packages/kbn-openapi-bundler",
     "@kbn/openapi-generator": "link:packages/kbn-openapi-generator",
     "@kbn/optimizer": "link:packages/kbn-optimizer",

packages/kbn-apm-synthtrace/README.md

@@ -119,7 +119,7 @@ Scenario files accept 3 arguments, 2 of them optional and 1 mandatory
 |-------------|:----------|------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `generate`  | mandatory | This is the main function responsible for returning the events which will be indexed                                                                 |
 | `bootstrap`  | optional  | In case some setup needs to be done, before the data is generated, this function provides access to all available ES Clients to play with            |
-| `setClient` | optional  | By default the apmEsClient used to generate data. If anyother client like logsEsClient needs to be used instead, this is where it should be returned |
+| `teardown` | optional  | In case some setup needs to be done, after all data is generated, this function provides access to all available ES Clients to play with |
 
 The following options are supported:
 

packages/kbn-apm-synthtrace/src/cli/scenario.ts

@@ -40,4 +40,5 @@ type Generate<TFields> = (options: {
 export type Scenario<TFields> = (options: RunOptions & { logger: Logger }) => Promise<{
   bootstrap?: (options: EsClients & KibanaClients) => Promise<void>;
   generate: Generate<TFields>;
+  teardown?: (options: EsClients & KibanaClients) => Promise<void>;
 }>;

packages/kbn-apm-synthtrace/src/cli/utils/start_live_data_upload.ts

@@ -37,7 +37,11 @@ export async function startLiveDataUpload({
   } = await bootstrap(runOptions);
 
   const scenario = await getScenario({ file, logger });
-  const { generate, bootstrap: scenarioBootsrap } = await scenario({ ...runOptions, logger });
+  const {
+    generate,
+    bootstrap: scenarioBootsrap,
+    teardown: scenarioTearDown,
+  } = await scenario({ ...runOptions, logger });
 
   if (scenarioBootsrap) {
     await scenarioBootsrap({
@@ -57,11 +61,26 @@ export async function startLiveDataUpload({
   // @ts-expect-error upgrade typescript v4.9.5
   const cachedStreams: WeakMap<SynthtraceEsClient, PassThrough> = new WeakMap();
 
-  process.on('SIGINT', () => closeStreams());
-  process.on('SIGTERM', () => closeStreams());
-  process.on('SIGQUIT', () => closeStreams());
+  process.on('SIGINT', () => closeStreamsAndTeardown());
+  process.on('SIGTERM', () => closeStreamsAndTeardown());
+  process.on('SIGQUIT', () => closeStreamsAndTeardown());
+
+  async function closeStreamsAndTeardown() {
+    if (scenarioTearDown) {
+      try {
+        await scenarioTearDown({
+          apmEsClient,
+          logsEsClient,
+          infraEsClient,
+          syntheticsEsClient,
+          entitiesEsClient,
+          entitiesKibanaClient,
+        });
+      } catch (error) {
+        logger.error('Error during scenario teardown', error);
+      }
+    }
 
-  function closeStreams() {
     currentStreams.forEach((stream) => {
       stream.end(() => {
         process.exit(0);

packages/kbn-apm-synthtrace/src/cli/utils/synthtrace_worker.ts

@@ -77,7 +77,7 @@ async function start() {
 
   logger.info(`Running scenario from ${bucketFrom.toISOString()} to ${bucketTo.toISOString()}`);
 
-  const { generate, bootstrap } = await scenario({ ...runOptions, logger });
+  const { generate, bootstrap, teardown } = await scenario({ ...runOptions, logger });
 
   if (bootstrap) {
     await bootstrap({
@@ -133,6 +133,17 @@ async function start() {
 
     await Promise.all(promises);
   });
+
+  if (teardown) {
+    await teardown({
+      apmEsClient,
+      logsEsClient,
+      infraEsClient,
+      syntheticsEsClient,
+      entitiesEsClient,
+      entitiesKibanaClient,
+    });
+  }
 }
 
 parentPort!.on('message', (message) => {

packages/kbn-apm-synthtrace/src/lib/logs/logs_synthtrace_es_client.ts

@@ -52,6 +52,15 @@ export class LogsSynthtraceEsClient extends SynthtraceEsClient<LogDocument> {
     }
   }
 
+  async deleteIndexTemplate(name: IndexTemplateName) {
+    try {
+      await this.client.indices.deleteIndexTemplate({ name });
+      this.logger.info(`Index template successfully deleted: ${name}`);
+    } catch (err) {
+      this.logger.error(`Index template deletion failed: ${name} - ${err.message}`);
+    }
+  }
+
   async createComponentTemplate({
     name,
     mappings,
@@ -150,6 +159,17 @@ export class LogsSynthtraceEsClient extends SynthtraceEsClient<LogDocument> {
     }
   }
 
+  async deleteCustomPipeline(id = LogsCustom) {
+    try {
+      this.client.ingest.deletePipeline({
+        id,
+      });
+      this.logger.info(`Custom pipeline deleted: ${id}`);
+    } catch (err) {
+      this.logger.error(`Custom pipeline deletion failed: ${id} - ${err.message}`);
+    }
+  }
+
   getDefaultPipeline({ includeSerialization }: Pipeline = { includeSerialization: true }) {
     return logsPipeline({ includeSerialization });
   }

packages/kbn-apm-synthtrace/src/scenarios/degraded_logs.ts

@@ -36,6 +36,9 @@ const scenario: Scenario<LogDocument> = async (runOptions) => {
     bootstrap: async ({ logsEsClient }) => {
       if (isLogsDb) await logsEsClient.createIndexTemplate(IndexTemplateName.LogsDb);
     },
+    teardown: async ({ logsEsClient }) => {
+      await logsEsClient.deleteIndexTemplate(IndexTemplateName.LogsDb);
+    },
     generate: ({ range, clients: { logsEsClient } }) => {
       const { logger } = runOptions;
 

packages/kbn-apm-synthtrace/src/scenarios/failed_logs.ts

@@ -75,6 +75,11 @@ const scenario: Scenario<LogDocument> = async (runOptions) => {
         },
       });
     },
+    teardown: async ({ logsEsClient }) => {
+      await logsEsClient.deleteComponentTemplate(LogsCustom);
+      await logsEsClient.deleteCustomPipeline();
+      if (isLogsDb) await logsEsClient.deleteIndexTemplate(IndexTemplateName.LogsDb);
+    },
     generate: ({ range, clients: { logsEsClient } }) => {
       const { logger } = runOptions;
 

packages/kbn-apm-synthtrace/src/scenarios/logs_and_metrics.ts

@@ -38,6 +38,9 @@ const scenario: Scenario<LogDocument> = async (runOptions) => {
     bootstrap: async ({ logsEsClient }) => {
       if (isLogsDb) await logsEsClient.createIndexTemplate(IndexTemplateName.LogsDb);
     },
+    teardown: async ({ logsEsClient }) => {
+      await logsEsClient.deleteIndexTemplate(IndexTemplateName.LogsDb);
+    },
     generate: ({ range, clients: { logsEsClient, apmEsClient } }) => {
       const { numServices = 3 } = runOptions.scenarioOpts || {};
       const { logger } = runOptions;

packages/kbn-apm-synthtrace/src/scenarios/logs_traces_hosts.ts

@@ -52,6 +52,9 @@ const scenario: Scenario<LogDocument | InfraDocument | ApmFields> = async (runOp
     bootstrap: async ({ logsEsClient }) => {
       if (isLogsDb) await logsEsClient.createIndexTemplate(IndexTemplateName.LogsDb);
     },
+    teardown: async ({ logsEsClient }) => {
+      await logsEsClient.deleteIndexTemplate(IndexTemplateName.LogsDb);
+    },
     generate: ({ range, clients: { logsEsClient, infraEsClient, apmEsClient } }) => {
       const {
         numSpaces,

packages/kbn-apm-synthtrace/src/scenarios/simple_logs.ts

@@ -70,6 +70,9 @@ const scenario: Scenario<LogDocument> = async (runOptions) => {
     bootstrap: async ({ logsEsClient }) => {
       if (isLogsDb) await logsEsClient.createIndexTemplate(IndexTemplateName.LogsDb);
     },
+    teardown: async ({ logsEsClient }) => {
+      await logsEsClient.deleteIndexTemplate(IndexTemplateName.LogsDb);
+    },
     generate: ({ range, clients: { logsEsClient } }) => {
       const { logger } = runOptions;
 

packages/kbn-apm-synthtrace/src/scenarios/simple_non_ecs_logs.ts

@@ -78,6 +78,9 @@ const scenario: Scenario<LogDocument> = async (runOptions) => {
       await logsEsClient.createIndex('cloud-logs-synth.2-default');
       if (isLogsDb) await logsEsClient.createIndexTemplate(IndexTemplateName.LogsDb);
     },
+    teardown: async ({ logsEsClient }) => {
+      await logsEsClient.deleteIndexTemplate(IndexTemplateName.LogsDb);
+    },
     generate: ({ range, clients: { logsEsClient } }) => {
       const { logger } = runOptions;
 

packages/kbn-apm-synthtrace/src/scenarios/unstructured_logs.ts

@@ -20,6 +20,9 @@ const scenario: Scenario<LogDocument> = async (runOptions) => {
     bootstrap: async ({ logsEsClient }) => {
       if (isLogsDb) await logsEsClient.createIndexTemplate(IndexTemplateName.LogsDb);
     },
+    teardown: async ({ logsEsClient }) => {
+      await logsEsClient.deleteIndexTemplate(IndexTemplateName.LogsDb);
+    },
     generate: ({ range, clients: { logsEsClient } }) => {
       const { logger } = runOptions;
 

packages/kbn-optimizer/limits.yml

@@ -158,7 +158,7 @@ pageLoadAssetSize:
   serverlessSearch: 72995
   sessionView: 77750
   share: 88160
-  slo: 37039
+  slo: 45000
   snapshotRestore: 79032
   spaces: 57868
   stackAlerts: 58316

packages/kbn-storybook/templates/index.ejs

@@ -23,6 +23,7 @@
       <!-- Added for Kibana shared dependencies -->
       <script>
         window.__kbnPublicPath__ = { 'kbn-ui-shared-deps-npm': '', 'kbn-ui-shared-deps-src': '' };
+        window.__kbnHardenPrototypes__ = false;
       </script>
       <script src="kbn-ui-shared-deps-npm.dll.js"></script>
       <script src="kbn-ui-shared-deps-src.js"></script>

src/core/packages/http/server-internal/src/csp/config.ts

@@ -90,6 +90,10 @@ const configSchema = schema.object(
           defaultValue: [],
           validate: getDirectiveValidator({ allowNone: false, allowNonce: false }),
         }),
+        object_src: schema.arrayOf(schema.string(), {
+          defaultValue: [],
+          validate: getDirectiveValidator({ allowNone: true, allowNonce: false }),
+        }),
       })
     ),
     strict: schema.boolean({ defaultValue: true }),

src/core/packages/http/server-internal/src/csp/csp_config.test.ts

@@ -36,7 +36,7 @@ describe('CspConfig', () => {
         "disableEmbedding": false,
         "disableUnsafeEval": true,
         "header": "script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'",
-        "reportOnlyHeader": "form-action 'report-sample' 'self'",
+        "reportOnlyHeader": "form-action 'report-sample' 'self'; object-src 'report-sample' 'none'",
         "strict": true,
         "warnLegacyBrowsers": true,
       }

src/core/packages/http/server-internal/src/csp/csp_directives.ts

@@ -22,13 +22,15 @@ export type CspDirectiveName =
   | 'img-src'
   | 'report-uri'
   | 'report-to'
-  | 'form-action';
+  | 'form-action'
+  | 'object-src';
 
 /**
  * The default report only directives rules
  */
 export const defaultReportOnlyRules: Partial<Record<CspDirectiveName, string[]>> = {
   'form-action': [`'report-sample'`, `'self'`],
+  'object-src': [`'report-sample'`, `'none'`],
 };
 
 /**
@@ -189,6 +191,10 @@ const parseConfigDirectives = (cspConfig: CspConfigType): CspConfigDirectives =>
     reportOnlyDirectives.set('form-action', cspConfig.report_only?.form_action);
   }
 
+  if (cspConfig.report_only?.object_src?.length) {
+    reportOnlyDirectives.set('object-src', cspConfig.report_only?.object_src);
+  }
+
   return {
     enforceDirectives,
     reportOnlyDirectives,

src/core/server/integration_tests/http/lifecycle.test.ts

@@ -1498,7 +1498,7 @@ describe('runs with default preResponse handlers', () => {
       `script-src 'report-sample' 'self' 'unsafe-eval'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'`
     );
     expect(response.header['content-security-policy-report-only']).toBe(
-      `form-action 'report-sample' 'self'`
+      `form-action 'report-sample' 'self'; object-src 'report-sample' 'none'`
     );
   });
 });

src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker

@@ -40,6 +40,7 @@ kibana_vars=(
     csp.report_uri
     csp.report_to
     csp.report_only.form_action
+    csp.report_only.object_src
     permissionsPolicy.report_to
     data.autocomplete.valueSuggestions.terminateAfter
     data.autocomplete.valueSuggestions.timeout

src/dev/license_checker/config.ts

@@ -87,7 +87,7 @@ export const LICENSE_OVERRIDES = {
   '[email protected]': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
   '@mapbox/[email protected]': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
   '@elastic/[email protected]': ['Elastic License 2.0'],
-  '@elastic/[email protected].1-borealis.1': ['Elastic License 2.0 OR AGPL-3.0-only OR SSPL-1.0'],
+  '@elastic/[email protected].2-borealis.0': ['Elastic License 2.0 OR AGPL-3.0-only OR SSPL-1.0'],
   '[email protected]': ['CC-BY-4.0'], // retired ODC‑By license https://github.com/mattcg/language-subtag-registry
   '[email protected]': ['MIT'], // license in importing module https://www.npmjs.com/package/binary
   '@bufbuild/[email protected]': ['Apache-2.0'], // license (Apache-2.0 AND BSD-3-Clause)

src/dev/yarn_deduplicate/index.ts

@@ -17,7 +17,7 @@ const yarnLock = readFileSync(yarnLockFile, 'utf-8');
 const output = fixDuplicates(yarnLock, {
   useMostCommon: false,
   excludeScopes: ['@types'],
-  excludePackages: ['axe-core', '@babel/types', 'csstype', 'yaml'],
+  excludePackages: ['axe-core', '@babel/types', 'csstype', 'yaml', 'zod'],
 });
 
 writeFileSync(yarnLockFile, output);

src/platform/packages/private/kbn-esql-editor/src/editor_footer/errors_warnings_popover.tsx

@@ -87,7 +87,12 @@ function ErrorsWarningsContent({
                     </EuiFlexItem>
                   </EuiFlexGroup>
                 </EuiFlexItem>
-                <EuiFlexItem grow={false} css={euiTextBreakWord()}>
+                <EuiFlexItem
+                  grow={false}
+                  css={css`
+                    ${euiTextBreakWord()}
+                  `}
+                >
                   {item.message}
                 </EuiFlexItem>
               </EuiFlexGroup>