chore(opensearch): Bump to 3.8.0

CHANGELOG.md

@@ -16,6 +16,7 @@ All notable changes to this project will be documented in this file.
 - kafka: Add `4.3.1` ([#1659]).
 - stats-exporter: Add `0.31.0` ([#1664]).
 - hive: Add `4.2.1` ([#1637]).
+- opensearch: Add `3.8.0` ([#1669]).
 
 ### Changed
 
@@ -31,7 +32,7 @@ All notable changes to this project will be documented in this file.
 - vector: Generate the SBOM with the same feature set the binary is built with, so that the integrations that are not compiled in are no longer reported ([#1630]).
 - base images: Exclude the build-time dependencies from the Rust SBOMs ([#1630]).
 - kafka: Exclude the non-runtime configurations and the projects that are not shipped from the SBOM ([#1630]).
-- opensearch: Exclude the test framework, the test fixtures, the QA projects and the benchmarks from the SBOM of `3.1.0` and `3.4.0` ([#1630]).
+- opensearch: Exclude the test framework, the test fixtures, the QA projects and the benchmarks from the SBOM of `3.1.0` ([#1630]).
 - opensearch: Restrict the SBOM of the Prometheus exporter to the runtime dependencies ([#1630]).
 - opensearch-dashboards: Pass `--required-only` to cdxgen ([#1630]). This turned out to have no
   effect, see [#1635].
@@ -43,8 +44,7 @@ All notable changes to this project will be documented in this file.
   `tools` projects declare the Log4j runtime bindings there, so they were shipped in `libs/` without
   being part of the SBOM ([#1635]).
 - kafka: Exclude the `generator`, integration test and Connect test plugin projects from the SBOM ([#1635]).
-- opensearch: Exclude the `build-tools` project and the remaining unshipped projects from the SBOM of `3.1.0`
-  and `3.4.0` ([#1635]).
+- opensearch: Exclude the `build-tools` project and the remaining unshipped projects from the SBOM of `3.1.0` ([#1635]).
 - airflow, superset: Add the missing purls to all packages that are installed from a local wheel or
   a direct URL, and normalize the names in the purls as defined in the Python packaging
   specification ([#1635]).
@@ -66,6 +66,7 @@ All notable changes to this project will be documented in this file.
 - omid: remove 1.1.2 ([#1593]).
 - ci: Remove SLSA build provenance generation for published image indexes ([#1596]).
 - kafka: Removed `3.9.1`, `4.1.1` ([#1659]).
+- opensearch: Removed `3.4.0` ([#1669]).
 
 [#1593]: https://github.com/stackabletech/docker-images/pull/1593
 [#1595]: https://github.com/stackabletech/docker-images/pull/1595
@@ -84,6 +85,7 @@ All notable changes to this project will be documented in this file.
 [#1641]: https://github.com/stackabletech/docker-images/pull/1641
 [#1662]: https://github.com/stackabletech/docker-images/pull/1662
 [#1664]: https://github.com/stackabletech/docker-images/pull/1664
+[#1669]: https://github.com/stackabletech/docker-images/pull/1669
 
 ## [26.7.0] - 2026-07-21
 

opensearch/boil-config.toml

@@ -4,19 +4,19 @@
 [versions."3.1.0".local-images]
 java-devel = "21"
 jdk-base = "21"
-"opensearch/security-plugin" = "3.1.0.0"
 "opensearch/opensearch-prometheus-exporter" = "3.1.0.0"
+"opensearch/security-plugin" = "3.1.0.0"
 
 [versions."3.1.0".build-arguments]
 "opensearch-alerting-plugin-version" = "3.1.0.0"
-"opensearch-job-scheduler-plugin-version" = "3.1.0.0"
 "opensearch-anomaly-detection-plugin-version" = "3.1.0.0"
 "opensearch-asynchronous-search-plugin-version" = "3.1.0.0"
 "opensearch-cross-cluster-replication-plugin-version" = "3.1.0.0"
 "opensearch-custom-codecs-plugin-version" = "3.1.0.0"
 "opensearch-flow-framework-plugin-version" = "3.1.0.0"
 "opensearch-geospatial-plugin-version" = "3.1.0.0"
 "opensearch-index-management-plugin-version" = "3.1.0.0"
+"opensearch-job-scheduler-plugin-version" = "3.1.0.0"
 "opensearch-knn-plugin-version" = "3.1.0.0"
 "opensearch-ml-plugin-version" = "3.1.0.0"
 "opensearch-neural-search-plugin-version" = "3.1.0.0"
@@ -32,54 +32,23 @@ jdk-base = "21"
 "opensearch-ubi-plugin-version" = "3.1.0.0"
 "query-insights-plugin-version" = "3.1.0.0"
 
-# Deprecated since 26.7
-[versions."3.4.0".local-images]
-java-devel = "24"
-jdk-base = "24"
-"opensearch/security-plugin" = "3.4.0.0"
-"opensearch/opensearch-prometheus-exporter" = "3.4.0.0"
-
-[versions."3.4.0".build-arguments]
-"opensearch-alerting-plugin-version" = "3.4.0.0"
-"opensearch-job-scheduler-plugin-version" = "3.4.0.0"
-"opensearch-anomaly-detection-plugin-version" = "3.4.0.0"
-"opensearch-asynchronous-search-plugin-version" = "3.4.0.0"
-"opensearch-cross-cluster-replication-plugin-version" = "3.4.0.0"
-"opensearch-custom-codecs-plugin-version" = "3.4.0.0"
-"opensearch-flow-framework-plugin-version" = "3.4.0.0"
-"opensearch-geospatial-plugin-version" = "3.4.0.0"
-"opensearch-index-management-plugin-version" = "3.4.0.0"
-"opensearch-knn-plugin-version" = "3.4.0.0"
-"opensearch-ml-plugin-version" = "3.4.0.0"
-"opensearch-neural-search-plugin-version" = "3.4.0.0"
-"opensearch-notifications-core-plugin-version" = "3.4.0.0"
-"opensearch-notifications-plugin-version" = "3.4.0.0"
-"opensearch-observability-plugin-version" = "3.4.0.0"
-"opensearch-reports-scheduler-plugin-version" = "3.4.0.0"
-"opensearch-search-relevance-plugin-version" = "3.4.0.0"
-"opensearch-security-analytics-plugin-version" = "3.4.0.0"
-"opensearch-skills-plugin-version" = "3.4.0.0"
-"opensearch-sql-plugin-version" = "3.4.0.0"
-"opensearch-system-templates-plugin-version" = "3.4.0.0"
-"opensearch-ubi-plugin-version" = "3.4.0.0"
-"query-insights-plugin-version" = "3.4.0.0"
-
+# Deprecated since 26.11
 [versions."3.6.0".local-images]
 java-devel = "25"
 jdk-base = "25"
-"opensearch/security-plugin" = "3.6.0.0"
 "opensearch/opensearch-prometheus-exporter" = "3.6.0.0"
+"opensearch/security-plugin" = "3.6.0.0"
 
 [versions."3.6.0".build-arguments]
 "opensearch-alerting-plugin-version" = "3.6.0.0"
-"opensearch-job-scheduler-plugin-version" = "3.6.0.0"
 "opensearch-anomaly-detection-plugin-version" = "3.6.0.0"
 "opensearch-asynchronous-search-plugin-version" = "3.6.0.0"
 "opensearch-cross-cluster-replication-plugin-version" = "3.6.0.0"
 "opensearch-custom-codecs-plugin-version" = "3.6.0.0"
 "opensearch-flow-framework-plugin-version" = "3.6.0.0"
 "opensearch-geospatial-plugin-version" = "3.6.0.0"
 "opensearch-index-management-plugin-version" = "3.6.0.0"
+"opensearch-job-scheduler-plugin-version" = "3.6.0.0"
 "opensearch-knn-plugin-version" = "3.6.0.0"
 "opensearch-ml-plugin-version" = "3.6.0.0"
 "opensearch-neural-search-plugin-version" = "3.6.0.0"
@@ -94,3 +63,36 @@ jdk-base = "25"
 "opensearch-system-templates-plugin-version" = "3.6.0.0"
 "opensearch-ubi-plugin-version" = "3.6.0.0"
 "query-insights-plugin-version" = "3.6.0.0"
+
+[versions."3.8.0".local-images]
+java-devel = "25"
+jdk-base = "25"
+"opensearch/opensearch-prometheus-exporter" = "3.8.0.0"
+"opensearch/security-plugin" = "3.8.0.0"
+
+[versions."3.8.0".build-arguments]
+"opensearch-alerting-plugin-version" = "3.8.0.0"
+"opensearch-anomaly-detection-plugin-version" = "3.8.0.0"
+"opensearch-asynchronous-search-plugin-version" = "3.8.0.0"
+"opensearch-cross-cluster-replication-plugin-version" = "3.8.0.0"
+"opensearch-custom-codecs-plugin-version" = "3.8.0.0"
+"opensearch-flow-framework-plugin-version" = "3.8.0.0"
+"opensearch-geospatial-plugin-version" = "3.8.0.0"
+"opensearch-index-management-plugin-version" = "3.8.0.0"
+"opensearch-job-scheduler-plugin-version" = "3.8.0.0"
+"opensearch-knn-plugin-version" = "3.8.0.0"
+"opensearch-ltr-plugin-version" = "3.8.0.0"
+"opensearch-ml-plugin-version" = "3.8.0.0"
+"opensearch-neural-search-plugin-version" = "3.8.0.0"
+"opensearch-notifications-core-plugin-version" = "3.8.0.0"
+"opensearch-notifications-plugin-version" = "3.8.0.0"
+"opensearch-observability-plugin-version" = "3.8.0.0"
+"opensearch-performance-analyzer-plugin-version" = "3.8.0.0"
+"opensearch-reports-scheduler-plugin-version" = "3.8.0.0"
+"opensearch-search-relevance-plugin-version" = "3.8.0.0"
+"opensearch-security-analytics-plugin-version" = "3.8.0.0"
+"opensearch-skills-plugin-version" = "3.8.0.0"
+"opensearch-sql-plugin-version" = "3.8.0.0"
+"opensearch-system-templates-plugin-version" = "3.8.0.0"
+"opensearch-ubi-plugin-version" = "3.8.0.0"
+"query-insights-plugin-version" = "3.8.0.0"

opensearch/opensearch-prometheus-exporter/boil-config.toml

@@ -1,12 +1,10 @@
 [versions."3.1.0.0".local-images]
 java-devel = "21"
 
-[versions."3.4.0.0".local-images]
-# OpenSearch 3.4.0 bundles JDK 24, but the OpenSearch Prometheus Exporter can only be built with
-# JDK 21.
-java-devel = "21"
-
 [versions."3.6.0.0".local-images]
 # OpenSearch 3.6.0 bundles JDK 25, but the OpenSearch Prometheus Exporter can only be built with
 # JDK 21.
 java-devel = "21"
+
+[versions."3.8.0.0".local-images]
+java-devel = "25"

opensearch/opensearch-prometheus-exporter/stackable/patches/3.8.0.0/0001-Add-CycloneDX-plugin.patch

@@ -0,0 +1,42 @@
+From 6bafd68d2daa679a16894abce42a307035ee5346 Mon Sep 17 00:00:00 2001
+From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
+Date: Fri, 19 Jun 2026 11:14:39 +0200
+Subject: Add CycloneDX plugin
+
+---
+ build.gradle | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/build.gradle b/build.gradle
+index a0486c2..9444a1e 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -30,8 +30,26 @@ buildscript {
+     }
+ }
+
+-configurations {
+-    zipArchive
++plugins {
++    id("org.cyclonedx.bom") version "3.3.0"
++}
++
++// The SBOM must only describe what is shipped, so restrict it to the runtime dependencies.
++// Without this it also contains the test and build tooling (JUnit, Mockito, JaCoCo,
++// Checkstyle, ...). This has to be configured on the `cyclonedxDirectBom` task, the
++// `cyclonedxBom` extension below only configures the aggregation.
++cyclonedxDirectBom {
++    includeConfigs = ["runtimeClasspath"]
++    skipConfigs = ["compileClasspath", "testCompileClasspath"]
++}
++
++cyclonedxBom {
++    // Specified the type of project being built. Defaults to 'library'
++    projectType = org.cyclonedx.model.Component.Type.APPLICATION
++    // Specified the version of the CycloneDX specification to use. Defaults to VERSION_16.
++    schemaVersion = org.cyclonedx.Version.VERSION_16
++    jsonOutput = file("build/reports/cyclonedx/bom.json")
++    xmlOutput.unsetConvention()
+ }
+
+ apply plugin: 'java'

opensearch/opensearch-prometheus-exporter/stackable/patches/3.4.0.0/patchable.toml → opensearch/opensearch-prometheus-exporter/stackable/patches/3.8.0.0/patchable.toml

@@ -1,2 +1,2 @@
 mirror = "https://github.com/stackabletech/opensearch-prometheus-exporter"
-base = "13da5f22750d6665fb9fc7b0d171265e67948c34"
+base = "1247aeb9f190c68e08cd542747c31edfd295764d"

opensearch/security-plugin/boil-config.toml

@@ -1,8 +1,8 @@
 [versions."3.1.0.0".local-images]
 java-devel = "21"
 
-[versions."3.4.0.0".local-images]
-java-devel = "24"
-
 [versions."3.6.0.0".local-images]
 java-devel = "25"
+
+[versions."3.8.0.0".local-images]
+java-devel = "25"

opensearch/security-plugin/stackable/patches/3.4.0.0/0001-Add-CycloneDX-plugin.patch → opensearch/security-plugin/stackable/patches/3.8.0.0/0001-Add-CycloneDX-plugin.patch

@@ -1,21 +1,21 @@
-From 870b5dac41602586d987a6dd6b45f0b58e0f30e7 Mon Sep 17 00:00:00 2001
-From: dervoeti <lukas.krug@stackable.tech>
-Date: Tue, 22 Jul 2025 09:52:55 +0200
+From b546afb954e7595319a5eceba6f79c1794d59157 Mon Sep 17 00:00:00 2001
+From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
+Date: Fri, 19 Jun 2026 11:24:38 +0200
 Subject: Add CycloneDX plugin
 
 ---
  build.gradle | 13 +++++++++++++
  1 file changed, 13 insertions(+)
 
 diff --git a/build.gradle b/build.gradle
-index af480ede..b3c0ad34 100644
+index ea39593a..ffbe3c4f 100644
 --- a/build.gradle
 +++ b/build.gradle
-@@ -69,11 +69,24 @@ plugins {
+@@ -65,11 +65,24 @@ plugins {
      id 'eclipse'
-     id "com.github.spotbugs" version "6.4.4"
+     id "com.github.spotbugs" version "6.5.9"
      id "com.google.osdetector" version "1.7.3"
-+    id "org.cyclonedx.bom" version "3.1.0"
++    id "org.cyclonedx.bom" version "3.3.0"
  }
 
  allprojects {