Skip to content
TrustMyStack, home

OpenSearch

2.19.7
opensearch-project/OpenSearch

🔎 Open source distributed and RESTful search engine.

Version of opensearch-project/OpenSearch you run

CompareView on GitHub
Maintenance
Active345 commits in 3 months · bus factor 12
License
Apache-2.0Permissive · OSI-approved
Security
3 advisories3 medium
Supported versions
2 lines supportednewest 3 · oldest 2 · 1 ended

14k stars · 3.1k forks · 3.4k open issues · last release 25 days ago · data checked 3 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Supported versions

Source: endoflife.date
LineLatestReleasedSecurity fixes
33.9.0May 6, 2025Supported
22.19.7May 26, 2022Supported
11.3.20Jul 12, 2021Ended May 6, 2025

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • 3.0.0May 6, 2025

    Breaking Changes

    • Upgrade to Lucene 10.1.0 - PR (#16366)
    • JDK21 as minimum supported Java runtime (#10745)
    • Remove deprecated terms from Java API (#5214)
    • JPMS Support (Eliminate top level split packages ) Phase-0 only (#8110)
    • Add ThreadContextPermission for stashAndMergeHeaders and stashWithOrigin (#15039)
    • Add ThreadContextPermission for markAsSystemContext and allow core to perform the method (#15016)
    • Migrate client transports to Apache HttpClient / Core 5.x (#4459)
    • Validation changes on the Bulk Index API like enforcing 512 byte _id size limit (#6595)
    • Ability to use the node as coordinating node by passing node.roles as empty array (#3412)
    • Treat Setting value with empty array string as empty array (#10625)
    • Ensure Jackson default maximums introduced in 2.16.0 do not conflict with OpenSearch settings (#11811)
    • Setting a maximum depth for nested queries (#11670)
    • Fix interchanged formats of total_indexing_buffer_in_bytes and total_indexing_buffer (#17070)
    • Cleanup deprecated thread pool settings (#2595)
    • Replace "blacklist/whitelist" terminology in Java APIs (#1683)
    • Remove deprecated methods from JodaCompatibleZonedDateTime which are called by scripts (#3346)
    • List of deprecated code removal in 3.0- partially done (#2773)
    • Remove mmap.extensions setting (#9392)
    • Remove COMPAT locale provider (#13988)
    • Remove transport-nio plugin (#16887)
    • Deprecate CamelCase PathHierarchy tokenizer name (#10894)
    • Rename Class ending with Plugin to Module under modules dir (#4042)
    • Remove deprecated batch_size parameter from _bulk (#14283)

Release history

All releases on GitHub
Atom feed/feed/opensearch-project/OpenSearch
BadgeLatest version of opensearch-project/OpenSearch[![version](/badge/opensearch-project/OpenSearch)](/p/opensearch-project/OpenSearch)

Version 2.19.7 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 2.19.7

Enhancements

  • Add upper bound for the hot_threads snapshots parameter with configurable monitor.jvm.hot_threads.max_snapshots cluster setting (#23144)
  • Add search.query.max_query_nesting_depth setting to limit query_string parenthesis nesting depth and prevent StackOverflowError (#22854)
  • Cap max_determinized_states in completion suggester regex and fuzzy options to prevent heap exhaustion (#22925)
  • Disable Mustache partial template resolution in search templates (#22440)
  • Reject out-of-range WLM node threshold updates at validation time (#22678)

Bug Fixes

  • Fix unbounded recursion in JSON and binary deserialization that could cause StackOverflowError (#22427)
  • Strengthen scroll_id validation to prevent OOM from crafted scroll IDs with oversized counts (#22401)
  • Validate base_path in fs repository to prevent path traversal outside configured path.repo directories (#22381)
  • Fix handling of unsupported zstd HTTP content encoding in netty4 and nio transports (#23324)

Maintenance

Full release notesCompare with previous