diff --git a/changelog/9.5.1.yaml b/changelog/9.5.1.yaml new file mode 100644 index 0000000000..d73796b836 --- /dev/null +++ b/changelog/9.5.1.yaml @@ -0,0 +1,58 @@ +version: 9.5.1 +entries: + - kind: security + summary: Anchor artifact authorization on enrollment-derived policy ID + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7503 + issue: [] + impact: "" + action: "" + timestamp: 1753776000 + file: + name: 1753776000-artifact-authz-policy-id.yaml + checksum: 95d2da33af5c726db2445fa8e5f522f0198eb391 + - kind: security + summary: Treat output names as parameters in Elasticsearch update scripts + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7528 + issue: [] + impact: "" + action: "" + timestamp: 1785505460 + file: + name: 1785505460-parameterize-output-painless-scripts.yaml + checksum: bbf0031cb9a16726b0cb08b07d2c3ba47db8d8e4 + - kind: bug-fix + summary: Retain output API key secrets when agent document updates fail + description: | + Fleet Server no longer deletes a newly created output API key secret when the + corresponding agent document update returns an error. Elasticsearch may have + committed an update even when the client times out waiting for its response; + deleting the secret in that case leaves the agent with a dangling reference. + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7533 + issue: [] + impact: "" + action: "" + timestamp: 1785539200 + file: + name: 1785539200-retain-output-secret-on-agent-update-failure.yaml + checksum: c1af6222145fa524c30a68bd2df623aab45c4480 + - kind: bug-fix + summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7548 + issue: [] + impact: "" + action: "" + timestamp: 1785788555 + file: + name: 1785788555-token-resolver-index-not-found.yaml + checksum: 83f180df4d44010edb38dfcf98d91ced4811cbb2 diff --git a/changelog/fragments/1753776000-artifact-authz-policy-id.yaml b/changelog/fragments/1753776000-artifact-authz-policy-id.yaml deleted file mode 100644 index 1a9a296016..0000000000 --- a/changelog/fragments/1753776000-artifact-authz-policy-id.yaml +++ /dev/null @@ -1,8 +0,0 @@ -kind: security - -# Anchor artifact authorization on enrollment-derived PolicyID, not the -# check-in-supplied AgentPolicyID, to prevent cross-policy artifact download. -summary: Anchor artifact authorization on enrollment-derived policy ID - -component: fleet-server - diff --git a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml b/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml deleted file mode 100644 index 7bce16572c..0000000000 --- a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: security -summary: Treat output names as parameters in Elasticsearch update scripts -component: fleet-server diff --git a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml b/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml deleted file mode 100644 index 6dbdb28edb..0000000000 --- a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: bug-fix - -summary: Retain output API key secrets when agent document updates fail - -description: | - Fleet Server no longer deletes a newly created output API key secret when the - corresponding agent document update returns an error. Elasticsearch may have - committed an update even when the client times out waiting for its response; - deleting the secret in that case leaves the agent with a dangling reference. - -component: fleet-server diff --git a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml b/changelog/fragments/1785788555-token-resolver-index-not-found.yaml deleted file mode 100644 index cf7a874420..0000000000 --- a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml +++ /dev/null @@ -1,7 +0,0 @@ -kind: bug-fix - -summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist - -component: fleet-server - -pr: https://github.com/elastic/fleet-server/pull/7548 diff --git a/docs/release-notes/_snippets/9.5.1/breaking-changes.md b/docs/release-notes/_snippets/9.5.1/breaking-changes.md new file mode 100644 index 0000000000..fc3365591e --- /dev/null +++ b/docs/release-notes/_snippets/9.5.1/breaking-changes.md @@ -0,0 +1,3 @@ +## 9.5.1 [fleet-server-9.5.1-breaking-changes] + +_No breaking changes._ diff --git a/docs/release-notes/_snippets/9.5.1/deprecations.md b/docs/release-notes/_snippets/9.5.1/deprecations.md new file mode 100644 index 0000000000..ced119b2dc --- /dev/null +++ b/docs/release-notes/_snippets/9.5.1/deprecations.md @@ -0,0 +1,3 @@ +## 9.5.1 [fleet-server-9.5.1-deprecations] + +_No deprecations._ diff --git a/docs/release-notes/_snippets/9.5.1/index.md b/docs/release-notes/_snippets/9.5.1/index.md new file mode 100644 index 0000000000..72400e14a4 --- /dev/null +++ b/docs/release-notes/_snippets/9.5.1/index.md @@ -0,0 +1,20 @@ +## 9.5.1 [fleet-server-release-notes-9.5.1] + + + + + +### Fixes [fleet-server-9.5.1-fixes] + + +* Anchor artifact authorization on enrollment-derived policy ID. [#7503](https://github.com/elastic/fleet-server/pull/7503) +* Treat output names as parameters in Elasticsearch update scripts. [#7528](https://github.com/elastic/fleet-server/pull/7528) +* Retain output API key secrets when agent document updates fail. [#7533](https://github.com/elastic/fleet-server/pull/7533) + + Fleet Server no longer deletes a newly created output API key secret when the + corresponding agent document update returns an error. Elasticsearch may have + committed an update even when the client times out waiting for its response; + deleting the secret in that case leaves the agent with a dangling reference. + +* Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist. [#7548](https://github.com/elastic/fleet-server/pull/7548) + diff --git a/docs/release-notes/_snippets/breaking-changes/9.5.md b/docs/release-notes/_snippets/breaking-changes/9.5.md index cb8e0deea4..6dac242d9c 100644 --- a/docs/release-notes/_snippets/breaking-changes/9.5.md +++ b/docs/release-notes/_snippets/breaking-changes/9.5.md @@ -1,3 +1,6 @@ +:::{include} /release-notes/_snippets/9.5.1/breaking-changes.md +::: + :::{include} /release-notes/_snippets/9.5.0/breaking-changes.md ::: diff --git a/docs/release-notes/_snippets/deprecations/9.5.md b/docs/release-notes/_snippets/deprecations/9.5.md index 107d32fdb6..ba6c769acc 100644 --- a/docs/release-notes/_snippets/deprecations/9.5.md +++ b/docs/release-notes/_snippets/deprecations/9.5.md @@ -1,3 +1,6 @@ +:::{include} /release-notes/_snippets/9.5.1/deprecations.md +::: + :::{include} /release-notes/_snippets/9.5.0/deprecations.md ::: diff --git a/docs/release-notes/_snippets/index/9.5.md b/docs/release-notes/_snippets/index/9.5.md index 8f6194614f..5500848776 100644 --- a/docs/release-notes/_snippets/index/9.5.md +++ b/docs/release-notes/_snippets/index/9.5.md @@ -1,3 +1,6 @@ +:::{include} /release-notes/_snippets/9.5.1/index.md +::: + :::{include} /release-notes/_snippets/9.5.0/index.md :::