From b2a8320efa35f89db362536b3333866ca9b7d9be Mon Sep 17 00:00:00 2001 From: ebeahan <7226265+ebeahan@users.noreply.github.com> Date: Fri, 7 Aug 2026 16:56:17 +0000 Subject: [PATCH 1/2] add the 9.5.1 Fleet Server release notes --- changelog/9.5.1.yaml | 73 +++++++++++++++++++ .../1753776000-artifact-authz-policy-id.yaml | 8 -- ...-parameterize-output-painless-scripts.yaml | 3 - ...output-secret-on-agent-update-failure.yaml | 11 --- ...788555-token-resolver-index-not-found.yaml | 7 -- .../_snippets/9.5.1/breaking-changes.md | 3 + .../_snippets/9.5.1/deprecations.md | 3 + docs/release-notes/_snippets/9.5.1/index.md | 20 +++++ .../_snippets/breaking-changes/9.5.md | 3 + .../_snippets/deprecations/9.5.md | 3 + docs/release-notes/_snippets/index/9.5.md | 3 + 11 files changed, 108 insertions(+), 29 deletions(-) create mode 100644 changelog/9.5.1.yaml delete mode 100644 changelog/fragments/1753776000-artifact-authz-policy-id.yaml delete mode 100644 changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml delete mode 100644 changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml delete mode 100644 changelog/fragments/1785788555-token-resolver-index-not-found.yaml create mode 100644 docs/release-notes/_snippets/9.5.1/breaking-changes.md create mode 100644 docs/release-notes/_snippets/9.5.1/deprecations.md create mode 100644 docs/release-notes/_snippets/9.5.1/index.md diff --git a/changelog/9.5.1.yaml b/changelog/9.5.1.yaml new file mode 100644 index 0000000000..84885c6a15 --- /dev/null +++ b/changelog/9.5.1.yaml @@ -0,0 +1,73 @@ +version: 9.5.1 +entries: + - kind: security + summary: Anchor artifact authorization on enrollment-derived policy ID + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7563 + - https://github.com/elastic/fleet-server/pull/7571 + - https://github.com/elastic/fleet-server/pull/7583 + - https://github.com/elastic/fleet-server/pull/7572 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + - https://github.com/elastic/fleet-server/issues/7570 + impact: "" + action: "" + timestamp: 1753776000 + file: + name: 1753776000-artifact-authz-policy-id.yaml + checksum: 95d2da33af5c726db2445fa8e5f522f0198eb391 + - kind: security + summary: Treat output names as parameters in Elasticsearch update scripts + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7563 + - https://github.com/elastic/fleet-server/pull/7571 + - https://github.com/elastic/fleet-server/pull/7583 + - https://github.com/elastic/fleet-server/pull/7572 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + - https://github.com/elastic/fleet-server/issues/7570 + impact: "" + action: "" + timestamp: 1785505460 + file: + name: 1785505460-parameterize-output-painless-scripts.yaml + checksum: bbf0031cb9a16726b0cb08b07d2c3ba47db8d8e4 + - kind: bug-fix + summary: Retain output API key secrets when agent document updates fail + description: | + Fleet Server no longer deletes a newly created output API key secret when the + corresponding agent document update returns an error. Elasticsearch may have + committed an update even when the client times out waiting for its response; + deleting the secret in that case leaves the agent with a dangling reference. + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7563 + - https://github.com/elastic/fleet-server/pull/7571 + - https://github.com/elastic/fleet-server/pull/7583 + - https://github.com/elastic/fleet-server/pull/7572 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + - https://github.com/elastic/fleet-server/issues/7570 + impact: "" + action: "" + timestamp: 1785539200 + file: + name: 1785539200-retain-output-secret-on-agent-update-failure.yaml + checksum: c1af6222145fa524c30a68bd2df623aab45c4480 + - kind: bug-fix + summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7548 + issue: [] + impact: "" + action: "" + timestamp: 1785788555 + file: + name: 1785788555-token-resolver-index-not-found.yaml + checksum: 83f180df4d44010edb38dfcf98d91ced4811cbb2 diff --git a/changelog/fragments/1753776000-artifact-authz-policy-id.yaml b/changelog/fragments/1753776000-artifact-authz-policy-id.yaml deleted file mode 100644 index 1a9a296016..0000000000 --- a/changelog/fragments/1753776000-artifact-authz-policy-id.yaml +++ /dev/null @@ -1,8 +0,0 @@ -kind: security - -# Anchor artifact authorization on enrollment-derived PolicyID, not the -# check-in-supplied AgentPolicyID, to prevent cross-policy artifact download. -summary: Anchor artifact authorization on enrollment-derived policy ID - -component: fleet-server - diff --git a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml b/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml deleted file mode 100644 index 7bce16572c..0000000000 --- a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: security -summary: Treat output names as parameters in Elasticsearch update scripts -component: fleet-server diff --git a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml b/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml deleted file mode 100644 index 6dbdb28edb..0000000000 --- a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: bug-fix - -summary: Retain output API key secrets when agent document updates fail - -description: | - Fleet Server no longer deletes a newly created output API key secret when the - corresponding agent document update returns an error. Elasticsearch may have - committed an update even when the client times out waiting for its response; - deleting the secret in that case leaves the agent with a dangling reference. - -component: fleet-server diff --git a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml b/changelog/fragments/1785788555-token-resolver-index-not-found.yaml deleted file mode 100644 index cf7a874420..0000000000 --- a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml +++ /dev/null @@ -1,7 +0,0 @@ -kind: bug-fix - -summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist - -component: fleet-server - -pr: https://github.com/elastic/fleet-server/pull/7548 diff --git a/docs/release-notes/_snippets/9.5.1/breaking-changes.md b/docs/release-notes/_snippets/9.5.1/breaking-changes.md new file mode 100644 index 0000000000..fc3365591e --- /dev/null +++ b/docs/release-notes/_snippets/9.5.1/breaking-changes.md @@ -0,0 +1,3 @@ +## 9.5.1 [fleet-server-9.5.1-breaking-changes] + +_No breaking changes._ diff --git a/docs/release-notes/_snippets/9.5.1/deprecations.md b/docs/release-notes/_snippets/9.5.1/deprecations.md new file mode 100644 index 0000000000..ced119b2dc --- /dev/null +++ b/docs/release-notes/_snippets/9.5.1/deprecations.md @@ -0,0 +1,3 @@ +## 9.5.1 [fleet-server-9.5.1-deprecations] + +_No deprecations._ diff --git a/docs/release-notes/_snippets/9.5.1/index.md b/docs/release-notes/_snippets/9.5.1/index.md new file mode 100644 index 0000000000..1a03fdca4e --- /dev/null +++ b/docs/release-notes/_snippets/9.5.1/index.md @@ -0,0 +1,20 @@ +## 9.5.1 [fleet-server-release-notes-9.5.1] + + + + + +### Fixes [fleet-server-9.5.1-fixes] + + +* Anchor artifact authorization on enrollment-derived policy ID. [#7563](https://github.com/elastic/fleet-server/pull/7563) [#7571](https://github.com/elastic/fleet-server/pull/7571) [#7583](https://github.com/elastic/fleet-server/pull/7583) [#7572](https://github.com/elastic/fleet-server/pull/7572) [#7536](https://github.com/elastic/fleet-server/issues/7536) [#7570](https://github.com/elastic/fleet-server/issues/7570) +* Treat output names as parameters in Elasticsearch update scripts. [#7563](https://github.com/elastic/fleet-server/pull/7563) [#7571](https://github.com/elastic/fleet-server/pull/7571) [#7583](https://github.com/elastic/fleet-server/pull/7583) [#7572](https://github.com/elastic/fleet-server/pull/7572) [#7536](https://github.com/elastic/fleet-server/issues/7536) [#7570](https://github.com/elastic/fleet-server/issues/7570) +* Retain output API key secrets when agent document updates fail. [#7563](https://github.com/elastic/fleet-server/pull/7563) [#7571](https://github.com/elastic/fleet-server/pull/7571) [#7583](https://github.com/elastic/fleet-server/pull/7583) [#7572](https://github.com/elastic/fleet-server/pull/7572) [#7536](https://github.com/elastic/fleet-server/issues/7536) [#7570](https://github.com/elastic/fleet-server/issues/7570) + + Fleet Server no longer deletes a newly created output API key secret when the + corresponding agent document update returns an error. Elasticsearch may have + committed an update even when the client times out waiting for its response; + deleting the secret in that case leaves the agent with a dangling reference. + +* Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist. [#7548](https://github.com/elastic/fleet-server/pull/7548) + diff --git a/docs/release-notes/_snippets/breaking-changes/9.5.md b/docs/release-notes/_snippets/breaking-changes/9.5.md index cb8e0deea4..6dac242d9c 100644 --- a/docs/release-notes/_snippets/breaking-changes/9.5.md +++ b/docs/release-notes/_snippets/breaking-changes/9.5.md @@ -1,3 +1,6 @@ +:::{include} /release-notes/_snippets/9.5.1/breaking-changes.md +::: + :::{include} /release-notes/_snippets/9.5.0/breaking-changes.md ::: diff --git a/docs/release-notes/_snippets/deprecations/9.5.md b/docs/release-notes/_snippets/deprecations/9.5.md index 107d32fdb6..ba6c769acc 100644 --- a/docs/release-notes/_snippets/deprecations/9.5.md +++ b/docs/release-notes/_snippets/deprecations/9.5.md @@ -1,3 +1,6 @@ +:::{include} /release-notes/_snippets/9.5.1/deprecations.md +::: + :::{include} /release-notes/_snippets/9.5.0/deprecations.md ::: diff --git a/docs/release-notes/_snippets/index/9.5.md b/docs/release-notes/_snippets/index/9.5.md index 8f6194614f..5500848776 100644 --- a/docs/release-notes/_snippets/index/9.5.md +++ b/docs/release-notes/_snippets/index/9.5.md @@ -1,3 +1,6 @@ +:::{include} /release-notes/_snippets/9.5.1/index.md +::: + :::{include} /release-notes/_snippets/9.5.0/index.md ::: From c72ca4c7df0b317f2416bf5ed3e5a1ed69d24b45 Mon Sep 17 00:00:00 2001 From: ebeahan Date: Fri, 7 Aug 2026 12:06:28 -0500 Subject: [PATCH 2/2] add missing PRs links --- changelog/9.5.1.yaml | 27 +++++---------------- docs/release-notes/_snippets/9.5.1/index.md | 6 ++--- 2 files changed, 9 insertions(+), 24 deletions(-) diff --git a/changelog/9.5.1.yaml b/changelog/9.5.1.yaml index 84885c6a15..d73796b836 100644 --- a/changelog/9.5.1.yaml +++ b/changelog/9.5.1.yaml @@ -5,13 +5,8 @@ entries: description: "" component: fleet-server pr: - - https://github.com/elastic/fleet-server/pull/7563 - - https://github.com/elastic/fleet-server/pull/7571 - - https://github.com/elastic/fleet-server/pull/7583 - - https://github.com/elastic/fleet-server/pull/7572 - issue: - - https://github.com/elastic/fleet-server/issues/7536 - - https://github.com/elastic/fleet-server/issues/7570 + - https://github.com/elastic/fleet-server/pull/7503 + issue: [] impact: "" action: "" timestamp: 1753776000 @@ -23,13 +18,8 @@ entries: description: "" component: fleet-server pr: - - https://github.com/elastic/fleet-server/pull/7563 - - https://github.com/elastic/fleet-server/pull/7571 - - https://github.com/elastic/fleet-server/pull/7583 - - https://github.com/elastic/fleet-server/pull/7572 - issue: - - https://github.com/elastic/fleet-server/issues/7536 - - https://github.com/elastic/fleet-server/issues/7570 + - https://github.com/elastic/fleet-server/pull/7528 + issue: [] impact: "" action: "" timestamp: 1785505460 @@ -45,13 +35,8 @@ entries: deleting the secret in that case leaves the agent with a dangling reference. component: fleet-server pr: - - https://github.com/elastic/fleet-server/pull/7563 - - https://github.com/elastic/fleet-server/pull/7571 - - https://github.com/elastic/fleet-server/pull/7583 - - https://github.com/elastic/fleet-server/pull/7572 - issue: - - https://github.com/elastic/fleet-server/issues/7536 - - https://github.com/elastic/fleet-server/issues/7570 + - https://github.com/elastic/fleet-server/pull/7533 + issue: [] impact: "" action: "" timestamp: 1785539200 diff --git a/docs/release-notes/_snippets/9.5.1/index.md b/docs/release-notes/_snippets/9.5.1/index.md index 1a03fdca4e..72400e14a4 100644 --- a/docs/release-notes/_snippets/9.5.1/index.md +++ b/docs/release-notes/_snippets/9.5.1/index.md @@ -7,9 +7,9 @@ ### Fixes [fleet-server-9.5.1-fixes] -* Anchor artifact authorization on enrollment-derived policy ID. [#7563](https://github.com/elastic/fleet-server/pull/7563) [#7571](https://github.com/elastic/fleet-server/pull/7571) [#7583](https://github.com/elastic/fleet-server/pull/7583) [#7572](https://github.com/elastic/fleet-server/pull/7572) [#7536](https://github.com/elastic/fleet-server/issues/7536) [#7570](https://github.com/elastic/fleet-server/issues/7570) -* Treat output names as parameters in Elasticsearch update scripts. [#7563](https://github.com/elastic/fleet-server/pull/7563) [#7571](https://github.com/elastic/fleet-server/pull/7571) [#7583](https://github.com/elastic/fleet-server/pull/7583) [#7572](https://github.com/elastic/fleet-server/pull/7572) [#7536](https://github.com/elastic/fleet-server/issues/7536) [#7570](https://github.com/elastic/fleet-server/issues/7570) -* Retain output API key secrets when agent document updates fail. [#7563](https://github.com/elastic/fleet-server/pull/7563) [#7571](https://github.com/elastic/fleet-server/pull/7571) [#7583](https://github.com/elastic/fleet-server/pull/7583) [#7572](https://github.com/elastic/fleet-server/pull/7572) [#7536](https://github.com/elastic/fleet-server/issues/7536) [#7570](https://github.com/elastic/fleet-server/issues/7570) +* Anchor artifact authorization on enrollment-derived policy ID. [#7503](https://github.com/elastic/fleet-server/pull/7503) +* Treat output names as parameters in Elasticsearch update scripts. [#7528](https://github.com/elastic/fleet-server/pull/7528) +* Retain output API key secrets when agent document updates fail. [#7533](https://github.com/elastic/fleet-server/pull/7533) Fleet Server no longer deletes a newly created output API key secret when the corresponding agent document update returns an error. Elasticsearch may have