Preserve constant_score through filtered aliases

.github/workflows/publish-maven-snapshots.yml

@@ -35,7 +35,7 @@ jobs:
           unzip protoc.zip -d $HOME/.local && rm -v protoc.zip && protoc --version
 
       - name: Load secret
-        uses: 1password/load-secrets-action@dafbe7cb03502b260e2b2893c753c352eee545bf # v3
+        uses: 1password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1
         with:
           # Export loaded secrets as environment variables
           export-env: true

client/sniffer/licenses/jackson-core-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

libs/core/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

libs/x-content/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

modules/ingest-geoip/build.gradle

@@ -42,7 +42,9 @@ dependencies {
   api('com.maxmind.geoip2:geoip2:4.4.0')
   // geoip2 dependencies:
   api('com.maxmind.db:maxmind-db:3.2.0')
+  // required by geoip2
   api(libs.jackson.annotation)
+  api(libs.jackson.core)
   api(libs.jackson.databind)
   api(libs.jackson.datatype.jsr310)
 
@@ -75,3 +77,7 @@ if (Os.isFamily(Os.FAMILY_WINDOWS)) {
     systemProperty 'opensearch.geoip.load_db_on_heap', 'true'
   }
 }
+
+tasks.named("dependencyLicenses").configure {
+    mapping from: /jackson-.*/, to: 'jackson'
+}

modules/ingest-geoip/licenses/jackson-annotations-LICENSE → modules/ingest-geoip/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

modules/transport-netty4/src/main/java/org/opensearch/http/netty4/Netty4HttpServerTransport.java

@@ -98,9 +98,11 @@
 import io.netty.handler.codec.http.HttpServerUpgradeHandler.UpgradeCodecFactory;
 import io.netty.handler.codec.http2.CleartextHttp2ServerUpgradeHandler;
 import io.netty.handler.codec.http2.Http2CodecUtil;
+import io.netty.handler.codec.http2.Http2FrameCodec;
 import io.netty.handler.codec.http2.Http2FrameCodecBuilder;
 import io.netty.handler.codec.http2.Http2MultiplexHandler;
 import io.netty.handler.codec.http2.Http2ServerUpgradeCodec;
+import io.netty.handler.codec.http2.Http2Settings;
 import io.netty.handler.codec.http2.Http2StreamFrameToHttpObjectCodec;
 import io.netty.handler.logging.LogLevel;
 import io.netty.handler.logging.LoggingHandler;
@@ -429,7 +431,7 @@ protected void configurePipeline(Channel ch) {
                 public UpgradeCodec newUpgradeCodec(CharSequence protocol) {
                     if (AsciiString.contentEquals(Http2CodecUtil.HTTP_UPGRADE_PROTOCOL_NAME, protocol)) {
                         return new Http2ServerUpgradeCodec(
-                            Http2FrameCodecBuilder.forServer().build(),
+                            createHttp2FrameCodec(),
                             new Http2MultiplexHandler(createHttp2ChannelInitializer(ch.pipeline()))
                         );
                     } else {
@@ -518,8 +520,17 @@ protected void configureDefaultHttpPipeline(ChannelPipeline pipeline) {
         }
 
         protected void configureDefaultHttp2Pipeline(ChannelPipeline pipeline) {
-            pipeline.addLast(Http2FrameCodecBuilder.forServer().build())
-                .addLast(new Http2MultiplexHandler(createHttp2ChannelInitializer(pipeline)));
+            pipeline.addLast(createHttp2FrameCodec()).addLast(new Http2MultiplexHandler(createHttp2ChannelInitializer(pipeline)));
+        }
+
+        /**
+         * Advertises {@code http.max_header_size} as SETTINGS_MAX_HEADER_LIST_SIZE, otherwise Netty's 8kb default
+         * caps HTTP/2 request headers regardless of the configured value.
+         */
+        private Http2FrameCodec createHttp2FrameCodec() {
+            return Http2FrameCodecBuilder.forServer()
+                .initialSettings(Http2Settings.defaultSettings().maxHeaderListSize(handlingSettings.getMaxHeaderSize()))
+                .build();
         }
 
         private ChannelInitializer<Channel> createHttp2ChannelInitializerPriorKnowledge() {

modules/transport-netty4/src/test/java/org/opensearch/http/netty4/Netty4HttpServerTransportTests.java

@@ -490,6 +490,44 @@ protected void initChannel(SocketChannel ch) {
         }
     }
 
+    public void testLargeHeaderHttp2() throws InterruptedException {
+        final Settings settings = createBuilderWithPort().put(HttpTransportSettings.SETTING_HTTP_MAX_HEADER_SIZE.getKey(), "32kb").build();
+        final String url = "/thing";
+        final HttpServerTransport.Dispatcher dispatcher = dispatcherBuilderWithDefaults().withDispatchRequest(
+            (request, channel, threadContext) -> channel.sendResponse(new BytesRestResponse(OK, "done"))
+        ).build();
+
+        try (
+            Netty4HttpServerTransport transport = new Netty4HttpServerTransport(
+                settings,
+                networkService,
+                bigArrays,
+                threadPool,
+                xContentRegistry(),
+                dispatcher,
+                clusterSettings,
+                new SharedGroupFactory(settings),
+                NoopTracer.INSTANCE
+            )
+        ) {
+            transport.start();
+            final TransportAddress remoteAddress = randomFrom(transport.boundAddress().boundAddresses());
+
+            try (Netty4HttpClient client = Netty4HttpClient.http2()) {
+                final FullHttpRequest request = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.GET, url);
+                // Exceeds Netty's 8kb default for SETTINGS_MAX_HEADER_LIST_SIZE, but fits within http.max_header_size
+                request.headers().add("x-large-header", randomAlphaOfLength(16 * 1024));
+
+                final FullHttpResponse response = client.send(remoteAddress.address(), request);
+                try {
+                    assertThat(response.status(), equalTo(HttpResponseStatus.OK));
+                } finally {
+                    response.release();
+                }
+            }
+        }
+    }
+
     private Settings createSettings() {
         return createBuilderWithPort().build();
     }

plugins/arrow-base/build.gradle

@@ -30,6 +30,7 @@ dependencies {
     api "com.google.flatbuffers:flatbuffers-java:${versions.flatbuffers}"
     api "org.slf4j:slf4j-api:${versions.slf4j}"
     api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
+    api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
     api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson}"
     api "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${versions.jackson}"
     api "commons-codec:commons-codec:${versions.commonscodec}"

plugins/arrow-base/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

plugins/arrow-base/licenses/jackson-core-2.22.1.jar.sha1

@@ -0,0 +1 @@
+da7ffb60088d7e8f37ecdd3b617520971cc7b9bf

plugins/crypto-kms/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

plugins/discovery-ec2/build.gradle

@@ -73,6 +73,7 @@ dependencies {
   api "org.apache.logging.log4j:log4j-1.2-api:${versions.log4j}"
   api "org.slf4j:slf4j-api:${versions.slf4j}"
   api "commons-codec:commons-codec:${versions.commonscodec}"
+  api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
   api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
   api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
   api "org.reactivestreams:reactive-streams:${versions.reactivestreams}"

plugins/discovery-ec2/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

plugins/discovery-ec2/licenses/jackson-core-2.22.1.jar.sha1

@@ -0,0 +1 @@
+da7ffb60088d7e8f37ecdd3b617520971cc7b9bf

plugins/discovery-gce/build.gradle

@@ -25,6 +25,8 @@ dependencies {
   api "com.google.http-client:google-http-client:${versions.google_http_client}"
   api "com.google.http-client:google-http-client-gson:${versions.google_http_client}"
   api "com.google.http-client:google-http-client-jackson2:${versions.google_http_client}"
+  api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
+  api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
   api 'com.google.code.findbugs:jsr305:3.0.2'
   api "org.apache.httpcomponents:httpclient:${versions.httpclient}"
   api "org.apache.httpcomponents:httpcore:${versions.httpcore}"
@@ -49,6 +51,7 @@ restResources {
 tasks.named("dependencyLicenses").configure {
   mapping from: /google-.*/, to: 'google'
   mapping from: /opencensus.*/, to: 'opencensus'
+  mapping from: /jackson-.*/, to: 'jackson'
 }
 
 check {

modules/ingest-geoip/licenses/jackson-databind-LICENSE → plugins/discovery-gce/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

plugins/discovery-gce/licenses/jackson-annotations-2.22.jar.sha1

@@ -0,0 +1 @@
+15c67f9498d6934cff9510fc70c5a12e52290457

plugins/discovery-gce/licenses/jackson-core-2.22.1.jar.sha1

@@ -0,0 +1 @@
+da7ffb60088d7e8f37ecdd3b617520971cc7b9bf

plugins/ingestion-kinesis/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

plugins/ingestion-kinesis/licenses/jackson-core-2.22.1.jar.sha1

@@ -0,0 +1 @@
+da7ffb60088d7e8f37ecdd3b617520971cc7b9bf

plugins/repository-azure/build.gradle

@@ -77,6 +77,7 @@ dependencies {
   api "io.projectreactor.netty:reactor-netty-http:${versions.reactor_netty}"
   api "org.slf4j:slf4j-api:${versions.slf4j}"
   api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
+  api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
   api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
   api "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${versions.jackson}"
   api "com.fasterxml.jackson.dataformat:jackson-dataformat-xml:${versions.jackson}"

plugins/repository-azure/licenses/jackson-core-2.22.1.jar.sha1

@@ -0,0 +1 @@
+da7ffb60088d7e8f37ecdd3b617520971cc7b9bf

plugins/repository-gcs/build.gradle

@@ -83,6 +83,7 @@ dependencies {
   runtimeOnly "com.google.http-client:google-http-client-gson:2.0.3"
   runtimeOnly "com.google.http-client:google-http-client-appengine:2.0.3"
   runtimeOnly "com.google.http-client:google-http-client-jackson2:2.0.3"
+  runtimeOnly "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
   runtimeOnly "com.fasterxml.jackson.core:jackson-core:${versions.jackson}" // 2.18.2 in bom
   runtimeOnly "io.opencensus:opencensus-api:0.31.1"
   runtimeOnly "io.opencensus:opencensus-contrib-http-util:0.31.1"
@@ -141,6 +142,7 @@ tasks.named("dependencyLicenses").configure {
   mapping from: /opentelemetry-common.*/, to: 'opentelemetry-api'
   mapping from: /protobuf.*/, to: 'protobuf'
   mapping from: /proto-google.*/, to: 'proto-google'
+  mapping from: /jackson-.*/, to: 'jackson'
 }
 
 thirdPartyAudit {

modules/ingest-geoip/licenses/jackson-datatype-jsr310-LICENSE → plugins/repository-gcs/licenses/jackson-LICENSE

@@ -1,4 +1,4 @@
-This copy of Jackson JSON processor Java 8 Date/Time module is licensed under the
+This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
 specific rights regarding derivative works.

modules/ingest-geoip/licenses/jackson-datatype-jsr310-NOTICE → plugins/repository-gcs/licenses/jackson-NOTICE

@@ -3,12 +3,15 @@
 Jackson is a high-performance, Free/Open Source JSON processing library.
 It was originally written by Tatu Saloranta (tatu.saloranta@iki.fi), and has
 been in development since 2007.
-It is currently developed by a community of developers.
+It is currently developed by a community of developers, as well as supported
+commercially by FasterXML.com.
 
 ## Licensing
 
-Jackson components are licensed under Apache (Software) License, version 2.0,
-as per accompanying LICENSE file.
+Jackson core and extension components may licensed under different licenses.
+To find the details that apply to this artifact see the accompanying LICENSE file.
+For more information, including possible other licensing options, contact
+FasterXML.com (http://fasterxml.com).
 
 ## Credits
 

plugins/repository-gcs/licenses/jackson-annotations-2.22.jar.sha1

@@ -0,0 +1 @@
+15c67f9498d6934cff9510fc70c5a12e52290457

plugins/repository-gcs/licenses/jackson-core-2.22.1.jar.sha1

@@ -0,0 +1 @@
+da7ffb60088d7e8f37ecdd3b617520971cc7b9bf

plugins/repository-s3/licenses/jackson-LICENSE

@@ -1,7 +1,7 @@
 This copy of Jackson JSON processor streaming parser/generator is licensed under the
 Apache (Software) License, version 2.0 ("the License").
 See the License for details about distribution rights, and the
-specific rights regarding derivate works.
+specific rights regarding derivative works.
 
 You may obtain a copy of the License at:
 

plugins/repository-s3/licenses/jackson-core-2.22.1.jar.sha1

@@ -0,0 +1 @@
+da7ffb60088d7e8f37ecdd3b617520971cc7b9bf

plugins/repository-s3/licenses/jackson-dataformat-cbor-2.22.1.jar.sha1

@@ -0,0 +1 @@
+f1a9be02f8e042ee37441116b31104cec8ec9373

qa/wildfly/build.gradle

@@ -54,6 +54,7 @@ dependencies {
     exclude group: 'com.fasterxml.jackson.dataformat'
     exclude group: 'com.fasterxml.jackson.module'
   }
+  api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
   api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
   api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
   api "com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-base:${versions.jackson}"

sandbox/libs/analytics-framework/src/main/java/org/opensearch/analytics/spi/FilterDelegationHandle.java

@@ -62,13 +62,17 @@ public interface FilterDelegationHandle extends Closeable {
      * <p>Bit layout: word {@code i} contains matches for docs
      * {@code [minDoc + i*64, minDoc + (i+1)*64)}, LSB-first within each word.
      *
+     * <p>Return value packs two fields: upper 32 bits = next matching docId beyond
+     * maxDoc (or {@code Integer.MAX_VALUE} if exhausted), lower 32 bits = words written.
+     * Callers can use the nextDoc to skip subsequent RGs where {@code nextDoc >= rgMax}.
+     *
      * @param collectorKey key returned by {@link #createCollector(int, long, int, int)}
      * @param minDoc inclusive lower bound
      * @param maxDoc exclusive upper bound
      * @param out destination buffer; implementation writes up to {@code out.byteSize() / 8} words
-     * @return number of words written, or {@code -1} on error
+     * @return packed long: upper 32 = nextDoc, lower 32 = wordsWritten; or {@code -1} on error
      */
-    int collectDocs(int collectorKey, int minDoc, int maxDoc, MemorySegment out);
+    long collectDocs(int collectorKey, int minDoc, int maxDoc, MemorySegment out);
 
     /**
      * Release resources for a collector.

sandbox/plugins/analytics-backend-datafusion/rust/src/indexed_executor.rs

@@ -1360,9 +1360,9 @@ async unsafe fn execute_indexed_with_context_inner(
                         let eval: Arc<dyn RowGroupBitsetSource> = Arc::new(TreeBitsetSource {
                             tree: resolved,
                             evaluator: Arc::new(BitmapTreeEvaluator),
-                            leaves: Arc::new(CollectorLeafBitmaps {
-                                ffm_collector_calls: stream_metrics.ffm_collector_calls.clone(),
-                            }),
+                            leaves: Arc::new(CollectorLeafBitmaps::new(
+                                stream_metrics.ffm_collector_calls.clone(),
+                            )),
                             page_pruner: pruner,
                             cost_predicate,
                             cost_collector,

sandbox/plugins/analytics-backend-datafusion/rust/src/indexed_table/bool_tree.rs

@@ -31,6 +31,7 @@ use std::sync::Arc;
 use datafusion::physical_expr::PhysicalExpr;
 
 use super::index::RowGroupDocsCollector;
+use crate::indexed_table::index::CollectDocsResult;
 
 /// A node in the boolean query tree (unresolved).
 #[derive(Debug, Clone)]
@@ -463,6 +464,7 @@ pub fn residual_bool_to_physical_expr(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::indexed_table::index::CollectDocsResult;
     use crate::indexed_table::index::RowGroupDocsCollector;
     use datafusion::arrow::datatypes::{DataType, Field, Schema};
     use datafusion::common::ScalarValue;
@@ -473,8 +475,8 @@ mod tests {
     #[derive(Debug)]
     struct StubCollector(u8);
     impl RowGroupDocsCollector for StubCollector {
-        fn collect_packed_u64_bitset(&self, _: i32, _: i32) -> Result<Vec<u64>, String> {
-            Ok(vec![self.0 as u64])
+        fn collect_packed_u64_bitset(&self, _: i32, _: i32) -> Result<CollectDocsResult, String> {
+            Ok(vec![self.0 as u64].into())
         }
     }