From ba5190e494494caa7b2f85c008084055f98792e6 Mon Sep 17 00:00:00 2001 From: ebeahan <7226265+ebeahan@users.noreply.github.com> Date: Fri, 7 Aug 2026 19:58:56 +0000 Subject: [PATCH 1/2] add the 8.19.20 Fleet Server release notes --- changelog/8.19.20.asciidoc | 49 +++++++++++ changelog/8.19.20.yaml | 87 +++++++++++++++++++ ...t-libs-for-FIPS-peer-cert-enforcement.yaml | 36 -------- ...785185160-enrollment-version-conflict.yaml | 7 -- ...-parameterize-output-painless-scripts.yaml | 3 - ...output-secret-on-agent-update-failure.yaml | 11 --- ...788555-token-resolver-index-not-found.yaml | 7 -- 7 files changed, 136 insertions(+), 64 deletions(-) create mode 100644 changelog/8.19.20.asciidoc create mode 100644 changelog/8.19.20.yaml delete mode 100644 changelog/fragments/1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml delete mode 100644 changelog/fragments/1785185160-enrollment-version-conflict.yaml delete mode 100644 changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml delete mode 100644 changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml delete mode 100644 changelog/fragments/1785788555-token-resolver-index-not-found.yaml diff --git a/changelog/8.19.20.asciidoc b/changelog/8.19.20.asciidoc new file mode 100644 index 0000000000..c5cd8b7d02 --- /dev/null +++ b/changelog/8.19.20.asciidoc @@ -0,0 +1,49 @@ +// begin 8.19.20 relnotes + +[[release-notes-8.19.20]] +== 8.19.20 + +Review important information about the 8.19.20 release. + +[discrete] +[[security-updates-8.19.20]] +=== Security updates + + + + +* Treat output names as parameters in Elasticsearch update scripts. https://github.com/elastic/fleet-server/pull/7565[#7565] https://github.com/elastic/fleet-server/pull/7571[#7571] https://github.com/elastic/fleet-server/pull/7581[#7581] https://github.com/elastic/fleet-server/pull/7582[#7582] https://github.com/elastic/fleet-server/issues/7536[#7536] + + + + + + + + + + +[discrete] +[[enhancements-8.19.20]] +=== Enhancements + + + + +* Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement. https://github.com/elastic/fleet-server/pull/7565[#7565] https://github.com/elastic/fleet-server/pull/7571[#7571] https://github.com/elastic/fleet-server/pull/7581[#7581] https://github.com/elastic/fleet-server/pull/7582[#7582] https://github.com/elastic/fleet-server/issues/7536[#7536] + + + + +[discrete] +[[bug-fixes-8.19.20]] +=== Bug fixes + + + + +* Fix agent enrollment failures caused by 409 version conflicts during `.fleet-agents` primary shard relocation. https://github.com/elastic/fleet-server/pull/7446[#7446] +* Retain output API key secrets when agent document updates fail. https://github.com/elastic/fleet-server/pull/7565[#7565] https://github.com/elastic/fleet-server/pull/7571[#7571] https://github.com/elastic/fleet-server/pull/7581[#7581] https://github.com/elastic/fleet-server/pull/7582[#7582] https://github.com/elastic/fleet-server/issues/7536[#7536] +* Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist. https://github.com/elastic/fleet-server/pull/7548[#7548] + +// end 8.19.20 relnotes diff --git a/changelog/8.19.20.yaml b/changelog/8.19.20.yaml new file mode 100644 index 0000000000..d83bedfd9e --- /dev/null +++ b/changelog/8.19.20.yaml @@ -0,0 +1,87 @@ +version: 8.19.20 +entries: + - kind: enhancement + summary: Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement + description: | + Bump elastic-agent-libs to v0.46.0 which enforces FIPS 140-3 compliant peer + certificate key types across all TLS verification modes. Also set the + fips140=on GODEBUG default in the FIPS binary so it enforces FIPS mode at + runtime, and verify this in the binary FIPS marker check. + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7565 + - https://github.com/elastic/fleet-server/pull/7571 + - https://github.com/elastic/fleet-server/pull/7581 + - https://github.com/elastic/fleet-server/pull/7582 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + impact: "" + action: "" + timestamp: 1783518046 + file: + name: 1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml + checksum: 4a10327d1d112aae226e85943d1a9e6d68401369 + - kind: bug-fix + summary: Fix agent enrollment failures caused by 409 version conflicts during `.fleet-agents` primary shard relocation + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7446 + issue: [] + impact: "" + action: "" + timestamp: 1785185160 + file: + name: 1785185160-enrollment-version-conflict.yaml + checksum: dfa448208740beda8ed226ca97043992763f791e + - kind: security + summary: Treat output names as parameters in Elasticsearch update scripts + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7565 + - https://github.com/elastic/fleet-server/pull/7571 + - https://github.com/elastic/fleet-server/pull/7581 + - https://github.com/elastic/fleet-server/pull/7582 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + impact: "" + action: "" + timestamp: 1785505460 + file: + name: 1785505460-parameterize-output-painless-scripts.yaml + checksum: bbf0031cb9a16726b0cb08b07d2c3ba47db8d8e4 + - kind: bug-fix + summary: Retain output API key secrets when agent document updates fail + description: | + Fleet Server no longer deletes a newly created output API key secret when the + corresponding agent document update returns an error. Elasticsearch may have + committed an update even when the client times out waiting for its response; + deleting the secret in that case leaves the agent with a dangling reference. + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7565 + - https://github.com/elastic/fleet-server/pull/7571 + - https://github.com/elastic/fleet-server/pull/7581 + - https://github.com/elastic/fleet-server/pull/7582 + issue: + - https://github.com/elastic/fleet-server/issues/7536 + impact: "" + action: "" + timestamp: 1785539200 + file: + name: 1785539200-retain-output-secret-on-agent-update-failure.yaml + checksum: c1af6222145fa524c30a68bd2df623aab45c4480 + - kind: bug-fix + summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist + description: "" + component: fleet-server + pr: + - https://github.com/elastic/fleet-server/pull/7548 + issue: [] + impact: "" + action: "" + timestamp: 1785788555 + file: + name: 1785788555-token-resolver-index-not-found.yaml + checksum: 83f180df4d44010edb38dfcf98d91ced4811cbb2 diff --git a/changelog/fragments/1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml b/changelog/fragments/1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml deleted file mode 100644 index 730f80364d..0000000000 --- a/changelog/fragments/1783518046-Bump-elastic-agent-libs-for-FIPS-peer-cert-enforcement.yaml +++ /dev/null @@ -1,36 +0,0 @@ -# Kind can be one of: -# - breaking-change: a change to previously-documented behavior -# - deprecation: functionality that is being removed in a later release -# - bug-fix: fixes a problem in a previous version -# - enhancement: extends functionality but does not break or fix existing behavior -# - feature: new functionality -# - known-issue: problems that we are aware of in a given version -# - security: impacts on the security of a product or a user’s deployment. -# - upgrade: important information for someone upgrading from a prior version -# - other: does not fit into any of the other categories -kind: enhancement - -# Change summary; a 80ish characters long description of the change. -summary: Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement - -# Long description; in case the summary is not enough to describe the change -# this field accommodate a description without length limits. -# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment. -description: | - Bump elastic-agent-libs to v0.46.0 which enforces FIPS 140-3 compliant peer - certificate key types across all TLS verification modes. Also set the - fips140=on GODEBUG default in the FIPS binary so it enforces FIPS mode at - runtime, and verify this in the binary FIPS marker check. - -# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc. -component: fleet-server - -# PR URL; optional; the PR number that added the changeset. -# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added. -# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number. -# Please provide it if you are adding a fragment for a different PR. -#pr: https://github.com/owner/repo/1234 - -# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of). -# If not present is automatically filled by the tooling with the issue linked to the PR number. -#issue: https://github.com/owner/repo/1234 diff --git a/changelog/fragments/1785185160-enrollment-version-conflict.yaml b/changelog/fragments/1785185160-enrollment-version-conflict.yaml deleted file mode 100644 index 04f6831665..0000000000 --- a/changelog/fragments/1785185160-enrollment-version-conflict.yaml +++ /dev/null @@ -1,7 +0,0 @@ -kind: bug-fix - -summary: Fix agent enrollment failures caused by 409 version conflicts during `.fleet-agents` primary shard relocation - -component: fleet-server - -pr: https://github.com/elastic/fleet-server/pull/7446 diff --git a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml b/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml deleted file mode 100644 index 7bce16572c..0000000000 --- a/changelog/fragments/1785505460-parameterize-output-painless-scripts.yaml +++ /dev/null @@ -1,3 +0,0 @@ -kind: security -summary: Treat output names as parameters in Elasticsearch update scripts -component: fleet-server diff --git a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml b/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml deleted file mode 100644 index 6dbdb28edb..0000000000 --- a/changelog/fragments/1785539200-retain-output-secret-on-agent-update-failure.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: bug-fix - -summary: Retain output API key secrets when agent document updates fail - -description: | - Fleet Server no longer deletes a newly created output API key secret when the - corresponding agent document update returns an error. Elasticsearch may have - committed an update even when the client times out waiting for its response; - deleting the secret in that case leaves the agent with a dangling reference. - -component: fleet-server diff --git a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml b/changelog/fragments/1785788555-token-resolver-index-not-found.yaml deleted file mode 100644 index cf7a874420..0000000000 --- a/changelog/fragments/1785788555-token-resolver-index-not-found.yaml +++ /dev/null @@ -1,7 +0,0 @@ -kind: bug-fix - -summary: Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist - -component: fleet-server - -pr: https://github.com/elastic/fleet-server/pull/7548 From 705dc36a15bdad5c033aa16814eb8827a94d329c Mon Sep 17 00:00:00 2001 From: ebeahan Date: Fri, 7 Aug 2026 15:03:12 -0500 Subject: [PATCH 2/2] Fix remaining duplicate PRs. --- changelog/8.19.20.asciidoc | 6 +++--- changelog/8.19.20.yaml | 15 +++------------ 2 files changed, 6 insertions(+), 15 deletions(-) diff --git a/changelog/8.19.20.asciidoc b/changelog/8.19.20.asciidoc index c5cd8b7d02..a9a0af1b40 100644 --- a/changelog/8.19.20.asciidoc +++ b/changelog/8.19.20.asciidoc @@ -12,7 +12,7 @@ Review important information about the 8.19.20 release. -* Treat output names as parameters in Elasticsearch update scripts. https://github.com/elastic/fleet-server/pull/7565[#7565] https://github.com/elastic/fleet-server/pull/7571[#7571] https://github.com/elastic/fleet-server/pull/7581[#7581] https://github.com/elastic/fleet-server/pull/7582[#7582] https://github.com/elastic/fleet-server/issues/7536[#7536] +* Treat output names as parameters in Elasticsearch update scripts. https://github.com/elastic/fleet-server/pull/7543[#7543] https://github.com/elastic/fleet-server/issues/7536[#7536] @@ -30,7 +30,7 @@ Review important information about the 8.19.20 release. -* Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement. https://github.com/elastic/fleet-server/pull/7565[#7565] https://github.com/elastic/fleet-server/pull/7571[#7571] https://github.com/elastic/fleet-server/pull/7581[#7581] https://github.com/elastic/fleet-server/pull/7582[#7582] https://github.com/elastic/fleet-server/issues/7536[#7536] +* Bump elastic-agent-libs to v0.46.0 for FIPS 140-3 peer cert key-type enforcement. https://github.com/elastic/fleet-server/pull/7456[#7456] https://github.com/elastic/fleet-server/issues/7536[#7536] @@ -43,7 +43,7 @@ Review important information about the 8.19.20 release. * Fix agent enrollment failures caused by 409 version conflicts during `.fleet-agents` primary shard relocation. https://github.com/elastic/fleet-server/pull/7446[#7446] -* Retain output API key secrets when agent document updates fail. https://github.com/elastic/fleet-server/pull/7565[#7565] https://github.com/elastic/fleet-server/pull/7571[#7571] https://github.com/elastic/fleet-server/pull/7581[#7581] https://github.com/elastic/fleet-server/pull/7582[#7582] https://github.com/elastic/fleet-server/issues/7536[#7536] +* Retain output API key secrets when agent document updates fail. https://github.com/elastic/fleet-server/pull/7547[#7547] https://github.com/elastic/fleet-server/issues/7536[#7536] * Fix spurious resolveSeqNo errors on check-in when .fleet-actions index does not exist. https://github.com/elastic/fleet-server/pull/7548[#7548] // end 8.19.20 relnotes diff --git a/changelog/8.19.20.yaml b/changelog/8.19.20.yaml index d83bedfd9e..f3ad0f3c54 100644 --- a/changelog/8.19.20.yaml +++ b/changelog/8.19.20.yaml @@ -9,10 +9,7 @@ entries: runtime, and verify this in the binary FIPS marker check. component: fleet-server pr: - - https://github.com/elastic/fleet-server/pull/7565 - - https://github.com/elastic/fleet-server/pull/7571 - - https://github.com/elastic/fleet-server/pull/7581 - - https://github.com/elastic/fleet-server/pull/7582 + - https://github.com/elastic/fleet-server/pull/7456 issue: - https://github.com/elastic/fleet-server/issues/7536 impact: "" @@ -39,10 +36,7 @@ entries: description: "" component: fleet-server pr: - - https://github.com/elastic/fleet-server/pull/7565 - - https://github.com/elastic/fleet-server/pull/7571 - - https://github.com/elastic/fleet-server/pull/7581 - - https://github.com/elastic/fleet-server/pull/7582 + - https://github.com/elastic/fleet-server/pull/7543 issue: - https://github.com/elastic/fleet-server/issues/7536 impact: "" @@ -60,10 +54,7 @@ entries: deleting the secret in that case leaves the agent with a dangling reference. component: fleet-server pr: - - https://github.com/elastic/fleet-server/pull/7565 - - https://github.com/elastic/fleet-server/pull/7571 - - https://github.com/elastic/fleet-server/pull/7581 - - https://github.com/elastic/fleet-server/pull/7582 + - https://github.com/elastic/fleet-server/pull/7547 issue: - https://github.com/elastic/fleet-server/issues/7536 impact: ""