Merge branch 'opensearch-project:main' into main

.node-version

@@ -1 +1 @@
-14.20.1
+14.21.3

.nvmrc

@@ -1 +1 @@
-14.20.1
+14.21.3

CHANGELOG.md

@@ -19,6 +19,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - [CVE-2022-25860] Bumps simple-git from 3.15.1 to 3.16.0 ([#3345](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3345))
 - [Security] Bumps hapi/statehood to 7.0.4 ([#3411](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3411))
 - [CVE-2023-25166] Bump formula to 3.0.1 ([#3416](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3416))
+- [CVE-2023-25653] Bump node-jose to 2.2.0 ([#3445](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3445))
 
 ### 📈 Features/Enhancements
 
@@ -61,6 +62,8 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - [Data] Update `createAggConfig` so that newly created configs can be added to beginning of `aggConfig` array ([#3160](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3160))
 - Add disablePrototypePoisoningProtection configuration to prevent JS client from erroring when cluster utilizes JS reserved words ([#2992](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2992))
 - [Multiple DataSource] Add support for SigV4 authentication ([#3058](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/3058))
+- Make build scripts find and use the latest version of Node.js that satisfies `engines.node` ([#3467](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/3467))
+- [Multiple DataSource] Refactor test connection to support SigV4 auth type ([#3456](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/3456))
 
 ### 🐛 Bug Fixes
 
@@ -109,6 +112,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Add recording of functional test artifacts if they fail ([#3190](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3190))
 - Improve yarn's performance in workflows by caching yarn's cache folder ([#3194](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3194))
 - Fix detection of Chrome's version on Darwin during CI ([#3296](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3296))
+- Upgrade yarn version to be compatible with @openearch-project/opensearch ([#3443](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3443))
 
 ### 📝 Documentation
 
@@ -130,6 +134,9 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Upgrade `vega-lite` dependency to ^5.6.0 ([#3076](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3076))
 - Bumps `re2` and `supertest` ([3018](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3018))
 - Bump `vega-tooltip` version from ^0.24.2 to ^0.30.0 ([#3358](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/3358))
+- Allow relaxing the Node.js runtime version requirement ([3402](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3402))
+- Relax the Node.js requirement to `^14.20.1` ([3463](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3463))
+- Bump the version of Node.js installed by `nvm` to `14.21.3` ([3463](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3463))
 
 ### 🪛 Refactoring
 

package.json

@@ -89,7 +89,7 @@
     "**/json-schema": "^0.4.0",
     "**/kind-of": ">=6.0.3",
     "**/loader-utils": "^2.0.4",
-    "**/node-jose": "^2.1.0",
+    "**/node-jose": "^2.2.0",
     "**/nth-check": "^2.0.1",
     "**/trim": "^0.0.3",
     "**/typescript": "4.0.2",
@@ -466,7 +466,7 @@
     "zlib": "^1.0.5"
   },
   "engines": {
-    "node": "14.20.1",
-    "yarn": "^1.21.1"
+    "node": "^14.20.1",
+    "yarn": "^1.22.10"
   }
 }

release-notes/opensearch-dashboards.release-notes-2.6.0.md

@@ -0,0 +1,47 @@
+## Version 2.6.0 Release Notes
+
+### 🛡 Security
+
+- [CVE-2022-37599] Bump loader-utils from `2.0.3` to `2.0.4` ([#3031](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3031))
+- [CVE-2022-37603] Bump loader-utils from `2.0.3` to `2.0.4` ([#3031](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3031))
+- [CVE-2022-25860] Bump simple-git from `3.15.1` to `3.16.0` ([#3345](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3345))
+- [CVE-2022-25881] Resolve http-cache-semantics from `4.1.0` to `4.1.1` ([#3409](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3409))
+- [Security] Bump hapi/statehood from `7.0.3` to `7.0.4` ([#3411](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3411))
+- [CVE-2023-25166] Bump formula from `3.0.0` to `3.0.1` ([#3416](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3416))
+- [CVE-2020-36632] Bump flat from `4.1.1` to `5.0.2` ([#3419](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3419))
+- [CVE-2023-25653] Bump node-jose from `2.1.1` to `2.2.0` ([#3445](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3445))
+- [CVE-2022-24999] Resolve qs from `6.5.3` to `6.11.0` ([#3450](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3450))
+- [CVE-2022-25758] Bump node-sass from `6.0.1` to `7.0.3` and sass-loader from `10.2.1` to `10.4.1` to bump scss-tokenizer from `0.2.3` to `0.4.3` ([#3455](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3455))
+- [CVE-2020-24025] Bump node-sass from `6.0.1` to `7.0.3` ([#3455](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3455))
+
+### 📈 Features/Enhancements
+
+- Add disablePrototypePoisoningProtection configuration to prevent JS client from erroring when cluster utilizes JS reserved words ([#2992](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2992))
+- [Multiple DataSource] Add support for SigV4 authentication ([#3058](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3058))
+- [Multiple DataSource] Refactor test connection to support SigV4 auth type ([#3456](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/3456))
+
+### 🐛 Bug Fixes
+
+- [Search Telemetry] Fix search telemetry's observable object that won't be GC-ed([#3390](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3390))
+- [Region Maps] Add ui setting to configure custom vector map's size parameter([#3399](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3399))
+
+### 🚞 Infrastructure
+
+- Fix detection of Chrome's version on Darwin during CI ([#3296](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3296))
+
+### 📝 Documentation
+
+- [Docs] Fix documentation link for date math ([#3207](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3207))
+
+### 🛠 Maintenance
+
+- Bump `re2` and `supertest` ([#3018](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3018))
+- Upgrade vega-tooltip to `0.30.0` to support custom tooltips ([#3359](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3359))
+- Allow relaxing the Node.js runtime version requirement ([#3402](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3402))
+- Make build scripts find and use the latest version of Node.js that satisfies `engines.node` ([#3467](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/3467))
+- Add `@opensearch-project/opensearch@^2.x` as dependency aliased as `@opensearch-project/opensearch-next` ([#3469](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3469))
+
+### 🔩 Tests
+
+- [BWC Tests] Add BWC tests for `2.6.0` ([#3356](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3356))
+- Prevent primitive linting limitations from being applied to unit tests found under `src/setup_node_env` ([#3403](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3403))

src/dev/build/lib/config.test.ts

@@ -79,10 +79,10 @@ describe('#getOpenSearchDashboardsPkg()', () => {
   });
 });
 
-describe('#getNodeVersion()', () => {
-  it('returns the node version from the OpenSearch Dashboards package.json', async () => {
+describe('#getNodeRange()', () => {
+  it('returns the node version range from the OpenSearch Dashboards package.json', async () => {
     const config = await setup();
-    expect(config.getNodeVersion()).toEqual(pkg.engines.node);
+    expect(config.getNodeRange()).toEqual(pkg.engines.node);
   });
 });
 

src/dev/build/lib/config.ts

@@ -86,7 +86,7 @@ export class Config {
     private readonly targetAllPlatforms: boolean,
     private readonly targetPlatforms: TargetPlatforms,
     private readonly pkg: Package,
-    private readonly nodeVersion: string,
+    private readonly nodeRange: string,
     private readonly repoRoot: string,
     private readonly versionInfo: VersionInfo,
     public readonly isRelease: boolean
@@ -102,8 +102,8 @@ export class Config {
   /**
    * Get the node version required by OpenSearch Dashboards
    */
-  getNodeVersion() {
-    return this.nodeVersion;
+  getNodeRange() {
+    return this.nodeRange;
   }
 
   /**

src/dev/build/tasks/create_archives_sources_task.ts

@@ -50,7 +50,7 @@ export const CreateArchivesSources: Task = {
 
         // copy node.js install
         await scanCopy({
-          source: getNodeDownloadInfo(config, platform).extractDir,
+          source: (await getNodeDownloadInfo(config, platform)).extractDir,
           destination: build.resolvePathForPlatform(platform, 'node'),
         });
 

src/dev/build/tasks/nodejs/download_node_builds_task.ts

@@ -30,16 +30,17 @@
 
 import { download, GlobalTask } from '../../lib';
 import { getNodeShasums } from './node_shasums';
-import { getNodeDownloadInfo } from './node_download_info';
+import { getLatestNodeVersion, getNodeDownloadInfo } from './node_download_info';
 
 export const DownloadNodeBuilds: GlobalTask = {
   global: true,
   description: 'Downloading node.js builds for all platforms',
   async run(config, log) {
-    const shasums = await getNodeShasums(log, config.getNodeVersion());
+    const latestNodeVersion = await getLatestNodeVersion(config);
+    const shasums = await getNodeShasums(log, latestNodeVersion);
     await Promise.all(
       config.getTargetPlatforms().map(async (platform) => {
-        const { url, downloadPath, downloadName } = getNodeDownloadInfo(config, platform);
+        const { url, downloadPath, downloadName } = await getNodeDownloadInfo(config, platform);
         await download({
           log,
           url,

src/dev/build/tasks/nodejs/extract_node_builds_task.test.ts

@@ -28,10 +28,6 @@
  * under the License.
  */
 
-import { readFileSync } from 'fs';
-import Path from 'path';
-
-import { REPO_ROOT } from '@osd/utils';
 import {
   ToolingLog,
   ToolingLogCollectingWriter,
@@ -41,6 +37,7 @@ import {
 
 import { Config } from '../../lib';
 import { ExtractNodeBuilds } from './extract_node_builds_task';
+import { getLatestNodeVersion } from './node_download_info';
 
 jest.mock('../../lib/fs');
 jest.mock('../../lib/get_build_number');
@@ -53,14 +50,6 @@ log.setWriters([testWriter]);
 
 expect.addSnapshotSerializer(createAbsolutePathSerializer());
 
-const nodeVersion = readFileSync(Path.resolve(REPO_ROOT, '.node-version'), 'utf8').trim();
-expect.addSnapshotSerializer(
-  createRecursiveSerializer(
-    (s) => typeof s === 'string' && s.includes(nodeVersion),
-    (s) => s.split(nodeVersion).join('<node version>')
-  )
-);
-
 async function setup() {
   const config = await Config.create({
     isRelease: true,
@@ -73,6 +62,16 @@ async function setup() {
     },
   });
 
+  const realNodeVersion = await getLatestNodeVersion(config);
+  if (realNodeVersion) {
+    expect.addSnapshotSerializer(
+      createRecursiveSerializer(
+        (s) => typeof s === 'string' && s.includes(realNodeVersion),
+        (s) => s.split(realNodeVersion).join('<node version>')
+      )
+    );
+  }
+
   return { config };
 }
 

src/dev/build/tasks/nodejs/extract_node_builds_task.ts

@@ -37,7 +37,7 @@ export const ExtractNodeBuilds: GlobalTask = {
   async run(config) {
     await Promise.all(
       config.getTargetPlatforms().map(async (platform) => {
-        const { downloadPath, extractDir } = getNodeDownloadInfo(config, platform);
+        const { downloadPath, extractDir } = await getNodeDownloadInfo(config, platform);
         if (platform.isWindows()) {
           await unzip(downloadPath, extractDir, { strip: 1 });
         } else {

src/dev/build/tasks/nodejs/node_download_info.ts

@@ -29,11 +29,15 @@
  */
 
 import { basename } from 'path';
+import fetch from 'node-fetch';
+import semver from 'semver';
 
 import { Config, Platform } from '../../lib';
 
-export function getNodeDownloadInfo(config: Config, platform: Platform) {
-  const version = config.getNodeVersion();
+const NODE_RANGE_CACHE: { [key: string]: string } = {};
+
+export async function getNodeDownloadInfo(config: Config, platform: Platform) {
+  const version = await getLatestNodeVersion(config);
   const arch = platform.getNodeArch();
 
   const downloadName = platform.isWindows()
@@ -52,3 +56,23 @@ export function getNodeDownloadInfo(config: Config, platform: Platform) {
     version,
   };
 }
+
+export async function getLatestNodeVersion(config: Config) {
+  const range = config.getNodeRange();
+  // Check cache and return if known
+  if (NODE_RANGE_CACHE[range]) return NODE_RANGE_CACHE[range];
+
+  const releaseDoc = await fetch('https://nodejs.org/dist/index.json');
+  const releaseList: [{ version: string }] = await releaseDoc.json();
+  const releases = releaseList.map(({ version }) => version.replace(/^v/, ''));
+  const maxVersion = semver.maxSatisfying(releases, range);
+
+  if (!maxVersion) {
+    throw new Error(`Cannot find a version of Node.js that satisfies ${range}.`);
+  }
+
+  // Cache it
+  NODE_RANGE_CACHE[range] = maxVersion;
+
+  return maxVersion;
+}

src/dev/build/tasks/nodejs/verify_existing_node_builds_task.test.ts

@@ -28,15 +28,10 @@
  * under the License.
  */
 
-import Path from 'path';
-import Fs from 'fs';
-
-import { REPO_ROOT } from '@osd/utils';
 import {
   ToolingLog,
   ToolingLogCollectingWriter,
   createAnyInstanceSerializer,
-  createRecursiveSerializer,
 } from '@osd/dev-utils';
 
 import { Config, Platform } from '../../lib';
@@ -48,7 +43,7 @@ jest.mock('../../lib/fs');
 jest.mock('../../lib/get_build_number');
 
 const { getNodeShasums } = jest.requireMock('./node_shasums');
-const { getNodeDownloadInfo } = jest.requireMock('./node_download_info');
+const { getNodeDownloadInfo, getLatestNodeVersion } = jest.requireMock('./node_download_info');
 const { getFileHash } = jest.requireMock('../../lib/fs');
 
 const log = new ToolingLog();
@@ -58,14 +53,6 @@ log.setWriters([testWriter]);
 expect.addSnapshotSerializer(createAnyInstanceSerializer(Config));
 expect.addSnapshotSerializer(createAnyInstanceSerializer(ToolingLog));
 
-const nodeVersion = Fs.readFileSync(Path.resolve(REPO_ROOT, '.node-version'), 'utf8').trim();
-expect.addSnapshotSerializer(
-  createRecursiveSerializer(
-    (s) => typeof s === 'string' && s.includes(nodeVersion),
-    (s) => s.split(nodeVersion).join('<node version>')
-  )
-);
-
 async function setup(actualShaSums?: Record<string, string>) {
   const config = await Config.create({
     isRelease: true,
@@ -74,6 +61,7 @@ async function setup(actualShaSums?: Record<string, string>) {
       linux: false,
       linuxArm: false,
       darwin: false,
+      windows: false,
     },
   });
 
@@ -89,9 +77,12 @@ async function setup(actualShaSums?: Record<string, string>) {
     return {
       downloadPath: `${platform.getName()}:${platform.getNodeArch()}:downloadPath`,
       downloadName: `${platform.getName()}:${platform.getNodeArch()}:downloadName`,
+      version: '<node version>',
     };
   });
 
+  getLatestNodeVersion.mockReturnValue('<node version>');
+
   getFileHash.mockImplementation((downloadPath: string) => {
     if (actualShaSums?.[downloadPath]) {
       return actualShaSums[downloadPath];
@@ -176,27 +167,31 @@ it('checks shasums for each downloaded node build', async () => {
           "value": Object {
             "downloadName": "linux:linux-x64:downloadName",
             "downloadPath": "linux:linux-x64:downloadPath",
+            "version": "<node version>",
           },
         },
         Object {
           "type": "return",
           "value": Object {
             "downloadName": "linux:linux-arm64:downloadName",
             "downloadPath": "linux:linux-arm64:downloadPath",
+            "version": "<node version>",
           },
         },
         Object {
           "type": "return",
           "value": Object {
             "downloadName": "darwin:darwin-x64:downloadName",
             "downloadPath": "darwin:darwin-x64:downloadPath",
+            "version": "<node version>",
           },
         },
         Object {
           "type": "return",
           "value": Object {
             "downloadName": "win32:win32-x64:downloadName",
             "downloadPath": "win32:win32-x64:downloadPath",
+            "version": "<node version>",
           },
         },
       ],

src/dev/build/tasks/nodejs/verify_existing_node_builds_task.ts

@@ -29,18 +29,19 @@
  */
 
 import { getFileHash, GlobalTask } from '../../lib';
-import { getNodeDownloadInfo } from './node_download_info';
+import { getNodeDownloadInfo, getLatestNodeVersion } from './node_download_info';
 import { getNodeShasums } from './node_shasums';
 
 export const VerifyExistingNodeBuilds: GlobalTask = {
   global: true,
   description: 'Verifying previously downloaded node.js build for all platforms',
   async run(config, log) {
-    const shasums = await getNodeShasums(log, config.getNodeVersion());
+    const latestNodeVersion = await getLatestNodeVersion(config);
+    const shasums = await getNodeShasums(log, latestNodeVersion);
 
     await Promise.all(
       config.getTargetPlatforms().map(async (platform) => {
-        const { downloadPath, downloadName } = getNodeDownloadInfo(config, platform);
+        const { downloadPath, downloadName } = await getNodeDownloadInfo(config, platform);
 
         const sha256 = await getFileHash(downloadPath, 'sha256');
         if (sha256 !== shasums[downloadName]) {

src/dev/build/tasks/notice_file_task.ts

@@ -57,7 +57,7 @@ export const CreateNoticeFile: Task = {
 
     log.info('Generating build notice');
 
-    const { extractDir: nodeDir, version: nodeVersion } = getNodeDownloadInfo(
+    const { extractDir: nodeDir, version: nodeVersion } = await getNodeDownloadInfo(
       config,
       config.hasSpecifiedPlatform()
         ? config.getPlatform(