Skip to content

[RELEASE] Release version 2.19.4 #5717

Closed

Description

@github-actions

Release OpenSearch and OpenSearch Dashboards 2.19.4

I noticed that a manifest was automatically created in manifests/2.19.4. Please follow the following checklist to make a release.

How to use this issue

This Release Issue

This issue captures the state of the OpenSearch release, its assignee (Release Manager) is responsible for driving the release. Please contact them or @mention them on this issue for help. There are linked issues on components of the release where individual components can be tracked. For more information check the the Release Process OpenSearch Guide.

Please refer to the following link for the release version dates: Release Schedule and Maintenance Policy.

Entrance Criteria

Criteria Status Comments  Description
Each component release issue has an assigned owner N/A No new release issues created as it is a patch release
Documentation draft PRs are up and in tech review for all component changes 🟢
Sanity testing is done for all components 🟢
Code coverage has not decreased (all new code has tests) 🟢
Release notes are ready and available for all components 🟢
Roadmap is up-to-date (information is available to create release highlights) N/A
Release ticket is cut, and there's a forum post announcing the start of the window N/A No release issues are created for patch release
Any necessary security reviews are complete N/A No new features or enhancements added

OpenSearch 2.19.4 exit criteria status:

Criteria Status Comments  Description
Performance tests are run, results are posted to the release ticket and there no unexpected regressions N/A
No unpatched vulnerabilities of medium or higher severity that have been publicly known for more than 60 days 🟢
Documentation has been fully reviewed and signed off by the documentation community. N/A No new features added so no documentation to review
All integration tests are passing 🟢
Release blog is ready N/A

OpenSearch-Dashboards 2.19.4 exit criteria status:

Criteria Status Comments  Description
Documentation has been fully reviewed and signed off by the documentation community N/A No new features added so no documentation to review
No unpatched vulnerabilities of medium or higher severity that have been publicly known for more than 60 days 🟢
All integration tests are passing 🟢
Release blog is ready N/A

Preparation

Campaigns

Version Increment - _Ends REPLACE_RELEASE-minus-10-days

Feature Freeze - _Ends REPLACE_RELEASE-minus-12-days

  • OpenSearch / OpenSearch-Dashboards core and components teams finalize their features.

Code Complete - Ends REPLACE_RELEASE-minus-10-days

Release Branch, Release Candidate Creation and Testing - Ends REPLACE_RELEASE-minus-6-days

Performance testing validation - Ends REPLACE_RELEASE-minus-6-days

  • Post the benchmark-tests
  • Longevity tests do not show any issues.

Pre Release - Ends REPLACE_RELEASE-minus-1-days

Release - _Ends {_REPLACE_RELEASE-day}

Release Checklist.


Release Checklist

Pre-Release activities

  • Promote Repos.
      • OS
      • OSD
  • Promote Artifacts.
      • Windows
      • Linux Debian
      • Linux RPM
      • Linux TAR
  • Consolidated Release Notes.

Release activities

  • Docker Promotion.
  • Release Validation part 1.
      • OpenSearch and OpenSearch Dashboard Validation.
      • Validate the native plugin installation.
  • Merge consolidated release notes PR.
  • Website and Documentation Changes.
      • Merge staging website PR.
      • Promote the website changes to prod.
      • Add website alert.
  • Release Validation part 2.
      • Validate the artifact download URL's and signatures.
  • Release Validation part 3.
      • Trigger the validation build (Search for Completed validation for <> in the logs).
  • Maven Promotion.
  • Publish blog posts.
  • Advertise on Social Media.
  • Post on public slack and Github Release issue.


Post Release

Components

Replace with links to all component tracking issues.

Component On track Release Notes
{COMPONENT_ISSUE_LINK} {INDICATOR} {STATUS}
Legend

Symbol Meaning
🟢 On track with overall release
🟡 Missed last milestone
🔴 Missed multiple milestones

Activity

  1. removed
    untriagedIssues that have not yet been triaged
    on Sep 11, 2025
  2. self-assigned this
    on Sep 11, 2025
  3. deleted a comment from on Oct 22, 2025
  4. opensearch-ci-bot commented on Oct 31, 2025

    @opensearch-ci-bot
    Collaborator

    See OpenSearch RC 1 and OpenSearch-Dashboards RC 1 details

    OpenSearch 1 and OpenSearch-Dashboards 1 details

    ## OpenSearch 11510 and OpenSearch-Dashboards 8695 is ready for your test.

    OpenSearch - Build 11510
    OpenSearch Dashboards - Build 8695

    • Use the following Docker-Compose to setup a cluster

      docker-compose.yml

        
      version: '3'
      services:
        opensearch-node1:
          image: opensearchstaging/opensearch:2.19.4.11510
          container_name: opensearch-node1
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node1
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
              hard: 65536
          volumes:
            - opensearch-data1:/usr/share/opensearch/data
          ports:
            - 9200:9200
            - 9600:9600 # required for Performance Analyzer
          networks:
            - opensearch-net
        opensearch-node2:
          image: opensearchstaging/opensearch:2.19.4.11510
          container_name: opensearch-node2
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node2
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536
              hard: 65536
          volumes:
            - opensearch-data2:/usr/share/opensearch/data
          networks:
            - opensearch-net
        opensearch-dashboards:
          image: opensearchstaging/opensearch-dashboards:2.19.4.8695
          container_name: opensearch-dashboards
          ports:
            - 5601:5601
          expose:
            - "5601"
          environment:
            OPENSEARCH_HOSTS: '["https://opensearch-node1:9200","https://opensearch-node2:9200"]'
          networks:
            - opensearch-net
      volumes:
        opensearch-data1:
        opensearch-data2:
      

      networks:
      opensearch-net:

      • Download the above docker-compose.yml on your machine.
      • Get latest image versions docker-compose pull.
      • Start the cluster docker-compose up.
    • OpenSearch docker 2.19.4.11510

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch:2.19.4.11510 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "DISABLE_SECURITY_PLUGIN=true" opensearchstaging/opensearch:2.19.4.11510
        • Connect command curl http://localhost:9200/
      • Start with security
        • Docker command
        docker pull opensearchstaging/opensearch:2.19.4.11510 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" opensearchstaging/opensearch:2.19.4.11510
        
        • Connect command curl --insecure 'https://admin:myStrongPassword123!@localhost:9200/'
    • OpenSearch-Dashboards docker 2.19.4.8695

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8695 && docker run -it --network="host" -e "DISABLE_SECURITY_DASHBOARDS_PLUGIN=true" opensearchstaging/opensearch-dashboards:2.19.4.8695
        • URL http://localhost:5601/
      • Start with security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8695 && docker run -it --network="host" opensearchstaging/opensearch-dashboards:2.19.4.8695
        • URL http://localhost:5601/
    • Use TARs to deploy OpenSearch Manually

    Check how to install opensearch and dashboards on different platforms

    Integration Test Results

    Thank you

    OpenSearch Docker-Scan Results

    Workflow run

    
    
    
    Java (jar)
    ==========
    Total: 5 (UNKNOWN: 0, LOW: 1, MEDIUM: 3, HIGH: 1, CRITICAL: 0)
    
    ┌─────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────────────────┬─────────────────────────────────────────────────────────────┐
    │                     Library                     │ Vulnerability  │ Severity │ Status │ Installed Version │       Fixed Version        │                            Title                            │
    ├─────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────────┤
    │ io.netty:netty-codec                            │ CVE-2025-58057 │ MEDIUM   │ fixed  │ 4.1.118.Final     │ 4.1.125.Final              │ netty-codec: netty-codec-compression: Netty's BrotliDecoder │
    │ (filtered-security-analytics-commons-1.0.0.jar) │                │          │        │                   │                            │ is vulnerable to DoS via zip bomb style...                  │
    │                                                 │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2025-58057                  │
    ├─────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────────┤
    │ io.netty:netty-codec-http                       │ CVE-2025-58056 │ LOW      │        │ 4.1.108.Final     │ 4.1.125.Final, 4.2.5.Final │ netty-codec-http: Netty is vulnerable to request smuggling  │
    │ (filtered-security-analytics-commons-1.0.0.jar) │                │          │        │                   │                            │ due to incorrect parsing of...                              │
    │                                                 │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2025-58056                  │
    ├─────────────────────────────────────────────────┼────────────────┼──────────┤        │                   ├────────────────────────────┼─────────────────────────────────────────────────────────────┤
    │ io.netty:netty-codec-http2                      │ CVE-2025-55163 │ HIGH     │        │                   │ 4.2.4.Final, 4.1.124.Final │ netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS    │
    │ (filtered-security-analytics-commons-1.0.0.jar) │                │          │        │                   │                            │ Vulnerability                                               │
    │                                                 │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2025-55163                  │
    ├─────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────────┤
    │ org.bouncycastle:bc-fips (bc-fips-2.1.1.jar)    │ CVE-2025-12194 │ MEDIUM   │        │ 2.1.1             │ 2.1.2                      │ bcprov-lts8on: bc-fips: Uncontrolled Resource Consumption   │
    │                                                 │                │          │        │                   │                            │ vulnerability in Bouncy Castle                              │
    │                                                 │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2025-12194                  │
    ├─────────────────────────────────────────────────┼────────────────┤          │        ├───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────────┤
    │ org.bouncycastle:bcpkix-jdk15to18               │ CVE-2025-8916  │          │        │ 1.78.1            │ 1.79                       │ org.bouncycastle: BouncyCastle denial of service            │
    │ (bcpkix-jdk15to18-1.78.1.jar)                   │                │          │        │                   │                            │ https://avd.aquasec.com/nvd/cve-2025-8916                   │
    └─────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────────────────┴─────────────────────────────────────────────────────────────┘
    
    
    
    

    OpenSearch-Dashboards Docker-Scan Results

    Workflow run

    
    
    
    Node.js (node-pkg)
    ==================
    Total: 10 (UNKNOWN: 0, LOW: 7, MEDIUM: 0, HIGH: 2, CRITICAL: 1)
    
    ┌────────────────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬─────────────────────────────┬───────────────────────────────────────────────────────────┐
    │            Library             │ Vulnerability  │ Severity │  Status  │ Installed Version │        Fixed Version        │                           Title                           │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ axios (package.json)           │ CVE-2025-58754 │ HIGH     │ fixed    │ 0.30.0            │ 1.12.0, 0.30.2              │ axios: Axios DoS via lack of data size check              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-58754                │
    ├────────────────────────────────┼────────────────┼──────────┤          ├───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ brace-expansion (package.json) │ CVE-2025-5889  │ LOW      │          │ 1.1.11            │ 2.0.2, 1.1.12, 3.0.1, 4.0.1 │ brace-expansion: juliangruber brace-expansion index.js    │
    │                                │                │          │          │                   │                             │ expand redos                                              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-5889                 │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    ├────────────────────────────────┼────────────────┤          │          ├───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ cookie (package.json)          │ CVE-2024-47764 │          │          │ 0.5.0             │ 0.7.0                       │ cookie: cookie accepts cookie name, path, and domain with │
    │                                │                │          │          │                   │                             │ out of bounds...                                          │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2024-47764                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ fast-redact (package.json)     │ CVE-2025-57319 │          │ affected │ 3.1.1             │                             │ fast-redact: fast-redact prototype pollution              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57319                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ form-data (package.json)       │ CVE-2025-7783  │ CRITICAL │ fixed    │ 4.0.0             │ 2.5.4, 3.0.4, 4.0.4         │ form-data: Unsafe random function in form-data            │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-7783                 │
    ├────────────────────────────────┼────────────────┼──────────┤          ├───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ jspdf (package.json)           │ CVE-2025-57810 │ HIGH     │          │ 3.0.1             │ 3.0.2                       │ jspdf: jsPDF Denial of Service (DoS)                      │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57810                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ min-document (package.json)    │ CVE-2025-57352 │ LOW      │ affected │ 2.19.0            │                             │ min-document: min-document prototype pollution            │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57352                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ tmp (package.json)             │ CVE-2025-54798 │          │ fixed    │ 0.2.3             │ 0.2.4                       │ tmp: tmp Symbolic Link Write Vulnerability                │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-54798                │
    └────────────────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴─────────────────────────────┴───────────────────────────────────────────────────────────┘
    
    
    
    

  5. opensearch-ci-bot commented on Nov 4, 2025

    @opensearch-ci-bot
    Collaborator

    See OpenSearch RC 2 and OpenSearch-Dashboards RC 2 details

    OpenSearch 2 and OpenSearch-Dashboards 2 details

    ## OpenSearch 11515 and OpenSearch-Dashboards 8703 is ready for your test.

    OpenSearch - Build 11515
    OpenSearch Dashboards - Build 8703

    • Use the following Docker-Compose to setup a cluster

      docker-compose.yml

        
      version: '3'
      services:
        opensearch-node1:
          image: opensearchstaging/opensearch:2.19.4.11515
          container_name: opensearch-node1
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node1
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
              hard: 65536
          volumes:
            - opensearch-data1:/usr/share/opensearch/data
          ports:
            - 9200:9200
            - 9600:9600 # required for Performance Analyzer
          networks:
            - opensearch-net
        opensearch-node2:
          image: opensearchstaging/opensearch:2.19.4.11515
          container_name: opensearch-node2
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node2
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536
              hard: 65536
          volumes:
            - opensearch-data2:/usr/share/opensearch/data
          networks:
            - opensearch-net
        opensearch-dashboards:
          image: opensearchstaging/opensearch-dashboards:2.19.4.8703
          container_name: opensearch-dashboards
          ports:
            - 5601:5601
          expose:
            - "5601"
          environment:
            OPENSEARCH_HOSTS: '["https://opensearch-node1:9200","https://opensearch-node2:9200"]'
          networks:
            - opensearch-net
      volumes:
        opensearch-data1:
        opensearch-data2:
      

      networks:
      opensearch-net:

      • Download the above docker-compose.yml on your machine.
      • Get latest image versions docker-compose pull.
      • Start the cluster docker-compose up.
    • OpenSearch docker 2.19.4.11515

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch:2.19.4.11515 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "DISABLE_SECURITY_PLUGIN=true" opensearchstaging/opensearch:2.19.4.11515
        • Connect command curl http://localhost:9200/
      • Start with security
        • Docker command
        docker pull opensearchstaging/opensearch:2.19.4.11515 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" opensearchstaging/opensearch:2.19.4.11515
        
        • Connect command curl --insecure 'https://admin:myStrongPassword123!@localhost:9200/'
    • OpenSearch-Dashboards docker 2.19.4.8703

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8703 && docker run -it --network="host" -e "DISABLE_SECURITY_DASHBOARDS_PLUGIN=true" opensearchstaging/opensearch-dashboards:2.19.4.8703
        • URL http://localhost:5601/
      • Start with security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8703 && docker run -it --network="host" opensearchstaging/opensearch-dashboards:2.19.4.8703
        • URL http://localhost:5601/
    • Use TARs to deploy OpenSearch Manually

    Check how to install opensearch and dashboards on different platforms

    Integration Test Results

    Thank you

    OpenSearch Docker-Scan Results

    Workflow run

    
    
    
    
    
    

    OpenSearch-Dashboards Docker-Scan Results

    Workflow run

    
    
    
    Node.js (node-pkg)
    ==================
    Total: 8 (UNKNOWN: 0, LOW: 7, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
    
    ┌────────────────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬─────────────────────────────┬───────────────────────────────────────────────────────────┐
    │            Library             │ Vulnerability  │ Severity │  Status  │ Installed Version │        Fixed Version        │                           Title                           │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ brace-expansion (package.json) │ CVE-2025-5889  │ LOW      │ fixed    │ 1.1.11            │ 2.0.2, 1.1.12, 3.0.1, 4.0.1 │ brace-expansion: juliangruber brace-expansion index.js    │
    │                                │                │          │          │                   │                             │ expand redos                                              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-5889                 │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    ├────────────────────────────────┼────────────────┤          │          ├───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ cookie (package.json)          │ CVE-2024-47764 │          │          │ 0.5.0             │ 0.7.0                       │ cookie: cookie accepts cookie name, path, and domain with │
    │                                │                │          │          │                   │                             │ out of bounds...                                          │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2024-47764                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ fast-redact (package.json)     │ CVE-2025-57319 │          │ affected │ 3.1.1             │                             │ fast-redact: fast-redact prototype pollution              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57319                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ jspdf (package.json)           │ CVE-2025-57810 │ HIGH     │ fixed    │ 3.0.1             │ 3.0.2                       │ jspdf: jsPDF Denial of Service (DoS)                      │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57810                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ min-document (package.json)    │ CVE-2025-57352 │ LOW      │ affected │ 2.19.0            │                             │ min-document: min-document prototype pollution            │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57352                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ tmp (package.json)             │ CVE-2025-54798 │          │ fixed    │ 0.2.3             │ 0.2.4                       │ tmp: tmp Symbolic Link Write Vulnerability                │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-54798                │
    └────────────────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴─────────────────────────────┴───────────────────────────────────────────────────────────┘
    
    
    
    

  6. opensearch-ci-bot commented on Nov 4, 2025

    @opensearch-ci-bot
    Collaborator

    See OpenSearch RC 2 and OpenSearch-Dashboards RC 3 details

    OpenSearch 2 and OpenSearch-Dashboards 3 details

    ## OpenSearch 11515 and OpenSearch-Dashboards 8706 is ready for your test.

    OpenSearch - Build 11515
    OpenSearch Dashboards - Build 8706

    • Use the following Docker-Compose to setup a cluster

      docker-compose.yml

        
      version: '3'
      services:
        opensearch-node1:
          image: opensearchstaging/opensearch:2.19.4.11515
          container_name: opensearch-node1
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node1
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
              hard: 65536
          volumes:
            - opensearch-data1:/usr/share/opensearch/data
          ports:
            - 9200:9200
            - 9600:9600 # required for Performance Analyzer
          networks:
            - opensearch-net
        opensearch-node2:
          image: opensearchstaging/opensearch:2.19.4.11515
          container_name: opensearch-node2
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node2
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536
              hard: 65536
          volumes:
            - opensearch-data2:/usr/share/opensearch/data
          networks:
            - opensearch-net
        opensearch-dashboards:
          image: opensearchstaging/opensearch-dashboards:2.19.4.8706
          container_name: opensearch-dashboards
          ports:
            - 5601:5601
          expose:
            - "5601"
          environment:
            OPENSEARCH_HOSTS: '["https://opensearch-node1:9200","https://opensearch-node2:9200"]'
          networks:
            - opensearch-net
      volumes:
        opensearch-data1:
        opensearch-data2:
      

      networks:
      opensearch-net:

      • Download the above docker-compose.yml on your machine.
      • Get latest image versions docker-compose pull.
      • Start the cluster docker-compose up.
    • OpenSearch docker 2.19.4.11515

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch:2.19.4.11515 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "DISABLE_SECURITY_PLUGIN=true" opensearchstaging/opensearch:2.19.4.11515
        • Connect command curl http://localhost:9200/
      • Start with security
        • Docker command
        docker pull opensearchstaging/opensearch:2.19.4.11515 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" opensearchstaging/opensearch:2.19.4.11515
        
        • Connect command curl --insecure 'https://admin:myStrongPassword123!@localhost:9200/'
    • OpenSearch-Dashboards docker 2.19.4.8706

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8706 && docker run -it --network="host" -e "DISABLE_SECURITY_DASHBOARDS_PLUGIN=true" opensearchstaging/opensearch-dashboards:2.19.4.8706
        • URL http://localhost:5601/
      • Start with security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8706 && docker run -it --network="host" opensearchstaging/opensearch-dashboards:2.19.4.8706
        • URL http://localhost:5601/
    • Use TARs to deploy OpenSearch Manually

    Check how to install opensearch and dashboards on different platforms

    Integration Test Results

    Thank you

    OpenSearch Docker-Scan Results

    Workflow run

    
    
    
    
    
    

    OpenSearch-Dashboards Docker-Scan Results

    Workflow run

    
    
    
    Node.js (node-pkg)
    ==================
    Total: 8 (UNKNOWN: 0, LOW: 7, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
    
    ┌────────────────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬─────────────────────────────┬───────────────────────────────────────────────────────────┐
    │            Library             │ Vulnerability  │ Severity │  Status  │ Installed Version │        Fixed Version        │                           Title                           │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ brace-expansion (package.json) │ CVE-2025-5889  │ LOW      │ fixed    │ 1.1.11            │ 2.0.2, 1.1.12, 3.0.1, 4.0.1 │ brace-expansion: juliangruber brace-expansion index.js    │
    │                                │                │          │          │                   │                             │ expand redos                                              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-5889                 │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    ├────────────────────────────────┼────────────────┤          │          ├───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ cookie (package.json)          │ CVE-2024-47764 │          │          │ 0.5.0             │ 0.7.0                       │ cookie: cookie accepts cookie name, path, and domain with │
    │                                │                │          │          │                   │                             │ out of bounds...                                          │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2024-47764                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ fast-redact (package.json)     │ CVE-2025-57319 │          │ affected │ 3.1.1             │                             │ fast-redact: fast-redact prototype pollution              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57319                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ jspdf (package.json)           │ CVE-2025-57810 │ HIGH     │ fixed    │ 3.0.1             │ 3.0.2                       │ jspdf: jsPDF Denial of Service (DoS)                      │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57810                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ min-document (package.json)    │ CVE-2025-57352 │ LOW      │ affected │ 2.19.0            │                             │ min-document: min-document prototype pollution            │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57352                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ tmp (package.json)             │ CVE-2025-54798 │          │ fixed    │ 0.2.3             │ 0.2.4                       │ tmp: tmp Symbolic Link Write Vulnerability                │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-54798                │
    └────────────────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴─────────────────────────────┴───────────────────────────────────────────────────────────┘
    
    
    
    

  7. opensearch-ci-bot commented on Nov 5, 2025

    @opensearch-ci-bot
    Collaborator

    See OpenSearch RC 2 and OpenSearch-Dashboards RC 4 details

    OpenSearch 2 and OpenSearch-Dashboards 4 details

    ## OpenSearch 11515 and OpenSearch-Dashboards 8708 is ready for your test.

    OpenSearch - Build 11515
    OpenSearch Dashboards - Build 8708

    • Use the following Docker-Compose to setup a cluster

      docker-compose.yml

        
      version: '3'
      services:
        opensearch-node1:
          image: opensearchstaging/opensearch:2.19.4.11515
          container_name: opensearch-node1
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node1
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
              hard: 65536
          volumes:
            - opensearch-data1:/usr/share/opensearch/data
          ports:
            - 9200:9200
            - 9600:9600 # required for Performance Analyzer
          networks:
            - opensearch-net
        opensearch-node2:
          image: opensearchstaging/opensearch:2.19.4.11515
          container_name: opensearch-node2
          environment:
            - cluster.name=opensearch-cluster
            - node.name=opensearch-node2
            - discovery.seed_hosts=opensearch-node1,opensearch-node2
            - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
            - bootstrap.memory_lock=true
            - OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!
          ulimits:
            memlock:
              soft: -1
              hard: -1
            nofile:
              soft: 65536
              hard: 65536
          volumes:
            - opensearch-data2:/usr/share/opensearch/data
          networks:
            - opensearch-net
        opensearch-dashboards:
          image: opensearchstaging/opensearch-dashboards:2.19.4.8708
          container_name: opensearch-dashboards
          ports:
            - 5601:5601
          expose:
            - "5601"
          environment:
            OPENSEARCH_HOSTS: '["https://opensearch-node1:9200","https://opensearch-node2:9200"]'
          networks:
            - opensearch-net
      volumes:
        opensearch-data1:
        opensearch-data2:
      

      networks:
      opensearch-net:

      • Download the above docker-compose.yml on your machine.
      • Get latest image versions docker-compose pull.
      • Start the cluster docker-compose up.
    • OpenSearch docker 2.19.4.11515

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch:2.19.4.11515 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "DISABLE_SECURITY_PLUGIN=true" opensearchstaging/opensearch:2.19.4.11515
        • Connect command curl http://localhost:9200/
      • Start with security
        • Docker command
        docker pull opensearchstaging/opensearch:2.19.4.11515 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" opensearchstaging/opensearch:2.19.4.11515
        
        • Connect command curl --insecure 'https://admin:myStrongPassword123!@localhost:9200/'
    • OpenSearch-Dashboards docker 2.19.4.8708

      • Start without security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8708 && docker run -it --network="host" -e "DISABLE_SECURITY_DASHBOARDS_PLUGIN=true" opensearchstaging/opensearch-dashboards:2.19.4.8708
        • URL http://localhost:5601/
      • Start with security
        • Docker command docker pull opensearchstaging/opensearch-dashboards:2.19.4.8708 && docker run -it --network="host" opensearchstaging/opensearch-dashboards:2.19.4.8708
        • URL http://localhost:5601/
    • Use TARs to deploy OpenSearch Manually

    Check how to install opensearch and dashboards on different platforms

    Integration Test Results

    Thank you

    OpenSearch Docker-Scan Results

    Workflow run

    
    
    
    
    
    

    OpenSearch-Dashboards Docker-Scan Results

    Workflow run

    
    
    
    Node.js (node-pkg)
    ==================
    Total: 8 (UNKNOWN: 0, LOW: 7, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
    
    ┌────────────────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬─────────────────────────────┬───────────────────────────────────────────────────────────┐
    │            Library             │ Vulnerability  │ Severity │  Status  │ Installed Version │        Fixed Version        │                           Title                           │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ brace-expansion (package.json) │ CVE-2025-5889  │ LOW      │ fixed    │ 1.1.11            │ 2.0.2, 1.1.12, 3.0.1, 4.0.1 │ brace-expansion: juliangruber brace-expansion index.js    │
    │                                │                │          │          │                   │                             │ expand redos                                              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-5889                 │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    │                                │                │          │          │                   │                             │                                                           │
    ├────────────────────────────────┼────────────────┤          │          ├───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ cookie (package.json)          │ CVE-2024-47764 │          │          │ 0.5.0             │ 0.7.0                       │ cookie: cookie accepts cookie name, path, and domain with │
    │                                │                │          │          │                   │                             │ out of bounds...                                          │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2024-47764                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ fast-redact (package.json)     │ CVE-2025-57319 │          │ affected │ 3.1.1             │                             │ fast-redact: fast-redact prototype pollution              │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57319                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ jspdf (package.json)           │ CVE-2025-57810 │ HIGH     │ fixed    │ 3.0.1             │ 3.0.2                       │ jspdf: jsPDF Denial of Service (DoS)                      │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57810                │
    ├────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ min-document (package.json)    │ CVE-2025-57352 │ LOW      │ affected │ 2.19.0            │                             │ min-document: min-document prototype pollution            │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-57352                │
    ├────────────────────────────────┼────────────────┤          ├──────────┼───────────────────┼─────────────────────────────┼───────────────────────────────────────────────────────────┤
    │ tmp (package.json)             │ CVE-2025-54798 │          │ fixed    │ 0.2.3             │ 0.2.4                       │ tmp: tmp Symbolic Link Write Vulnerability                │
    │                                │                │          │          │                   │                             │ https://avd.aquasec.com/nvd/cve-2025-54798                │
    └────────────────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴─────────────────────────────┴───────────────────────────────────────────────────────────┘
    
    
    
    

  8. gaiksaya commented on Nov 6, 2025

    @gaiksaya
    Member
  9. unpinned this issue on Nov 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions