OpenSearch
Logging · products/opensearch.yaml · RSS
Latest 3.9.0 Sep 29, 2026
Latest per track
| Track | Latest | Released |
|---|---|---|
| 3 | 3.9.0 | Sep 29, 2026 |
| 2 | 2.19.7 | Oct 20, 2026 |
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 3 | 3.9.0 | May 6, 2025 | — · maintained |
| 2 | 2.19.7 | May 26, 2022 | — · maintained |
| 1 | 1.3.20 | Jul 12, 2021 | May 6, 2025 · ended |
Recent releases
securityBound completion suggester max_determinized_states to prevent heap exhaustion (CVE-2026-63136) ()
securityUpdate log4j to 2.25.5 (CVE-2026-49844) ()
breakingRemove obsolete OS packaging tests ()
securityBump bc-fips to 2.1.3 to fix CVE-2026-8149 ()
securityUpgrade Jackson 2 to 2.22.1 to resolve CVE-2026-54515 ()
securityBump Hadoop from 3.4.2 to 3.5.0 to resolve CVE-2026-2332 ()
breakingRemove Unsafe class injection from Java agent ()
securityPin GitHub Actions to commit SHAs for supply chain security ()
securityInstall demo security information when running ./gradlew run -PinstalledPlugins="['opensearch-security']" ()
breakingRemove identity-shiro from plugins folder ()
breakingRemove MultiCollectorWrapper and use MultiCollector in Lucene instead ()
breakingRemove FeatureFlag.MERGED_SEGMENT_WARMER_EXPERIMENTAL_FLAG. ()
securityReplace java.security.AccessController with org.opensearch.secure_sm.AccessController in sub projects with SocketAccess class ()
breakingRemove cap on Java version used by forbidden APIs ()
breakingEnable backward compatibility tests on Mac ()
breakingRemove experimental designation from transport-grpc settings ()
securityUpdate Apache HttpClient5 and HttpCore5 (CVE-2025-27820) ()
breaking[repository-s3] Removed existing ineffective server_side_encryption setting ()
breakingUpgrade to Lucene 10.1.0 - PR ()
breakingJDK21 as minimum supported Java runtime ()
breakingRemove deprecated terms from Java API ()