Version 3.8.0 Release Notes
Compatible with OpenSearch and OpenSearch Dashboards version 3.8.0
Features
- Add grok debugger into Dev Tools for verifying grok patterns against log data (#12133)
- Add per-item hover popover system to the icon side navigation for plugin-extensible quick actions (#12285)
- Add user settings and workspace settings pages for per-scope UI setting management (#12329)
- Enable ElasticSearch 6.8+ clusters to be used as data sources with SQL and PPL query support (#12324)
- Enable dashboard variables feature by default (#12435)
- Integrate dynamic config to disable global settings updates for non-admin users (#10959)
- Add PPL lint engine with head-without-sort and division-by-zero rules (#12274)
- Add PPL linter field validation and command typo quick-fix suggestions (#12298)
- Add 6 structural PPL linting rules including join type, dedup, multisearch, union, and replace validation (#12319)
- Add PPL lint backend feature flag and explain/calcite proxy routes (#12255)
- Add PPL Query Builder for Explore Logs (#12398)
- Add Create alert rule entry point on Explore Metrics page (#12168)
- Add Logs Drilldown onboarding canvas to Explore for per-index dataset creation (#12407)
- Add warning banner when saving complex queries as visualizations (#12410)
- Auto-open chat window on first visit for improved AI feature discoverability (#12233)
- Add role field to SlashCommandResult for assistant-style local messages in chat (#12197)
- Hide /investigate suggestion card when the required tool is unavailable (#12300)
- Improve tool result rendering in chat with table, JSON, and markdown support (#12333)
- Parse and display inline suggestions from agent responses in chat (#12210)
- Support custom variable labels and field selection for dashboard query variables (#12345)
- Support variables in visualization panel titles (#12322)
- Register page context for AI chatbot in classic Discover page (#12278)
- Add data source selector in chat when no default data source is available (#12205)
- Add search and filters to the workspace home page (#12368)
- Add feature flag for dashboard variablesJSON saved-object field (#12312)
- Add dashboard.variables.enabled feature flag to config (#12426)
Enhancements
- Simplify dashboard variable URL state to store only selections instead of full definitions (#12375)
- Combine workspace switcher and manage links in the footer menu with first-visit tour (#12327)
- Mark requested workspace collaborator IDs not returned by the API as sentinel to avoid re-fetching (#12209)
- Prioritize AG-UI routing over ML Commons in chat proxy (#12380)
- Loosen data source title length limit from 32 to 64 characters for AOSS compatibility (#12421)
- Allow PPL Vega for AnalyticEngine type data sources (#12198)
- Hide all sample data for unsupported data sources (#12288)
- Enable variable feature in start:explore command (#12313)
- Expose overwriteSavedObjectsWithWorkspaceId for plugin sample dataset installation (#12204)
Bug Fixes
- Allow PPL queries to have spaces in source expressions (#12339)
- Fix autocomplete value suggestions for legacy Elasticsearch clusters (#12330)
- Fix PPL time filter to avoid script compilation rate limit on OpenSearch (#12408)
- Fix TSVB series ID for non-math metrics causing phantom split labels (#12409)
- Fix creating index patterns for ES 6.x versions by using modern data-source client (#12307)
- Fix workspace default route not being honored when workspace mode is enabled (#12046)
- Fix error toast showing generic 'Error' without descriptive message in production (#12372)
- Fix missing osd-ui-framework dist CSS in production build (#12223)
- Harden HTTP redirect path handling to reject malformed paths starting with '//' or '/\' (#12188)
- Fix side navigation redirecting to hidden feature-flag-disabled pages (#12260)
- Fix trace dataset auto-creation producing index patterns with no fields (#12236)
- Fix date picker filtering for SQL visualizations on dashboards (#12183)
- Gate SQL language in Explore dataset creation under feature flag (#12379)
- Validate collaborator permission combinations and reject invalid ones in workspace APIs (#12186)
- Fix duplicate shortcut registration for focus_query_bar causing crashes (#11395)
- Fix dashboard save failing with strict_dynamic_mapping_exception on variablesJSON (#12302)
- Fix Explore traces flyout not updating when a different trace is selected while open (#12291)
- Fix workspace title breadcrumb landing on feature-flag-disabled page (#12396)
- Fix visualization editor panel padding and border styling (#12326)
- Fix data-explorer fields sidebar collapse button not working in Safari (#12231)
- Fix client-side math evaluation for TSVB split, percentile, and ordering cases (#12185)
- Hide disabled query panel actions and remove duplicate metrics button (#12331)
- Include data connection meta in metrics tab PromQL query (#12202)
- Make list control search case-insensitive in Controls visualization (#12405)
- Exclude Observability (otel) sample set on AnalyticEngine data sources due to nested field incompatibility (#12216)
- Gate config import on advancedSettings.save capability and allow remaining objects to import (#12220)
- Clear stale tool call states when starting new chat conversation (#12346)
- Resolve slash commands after data source selection in chat (#12314)
- Guard useOpenOnUrlMarker against undefined window.location.hash in tests (#12317)
- Fix combined minLength+maxLength validation in config schema after joi v17 migration (#12215)
- Prevent privilege escalation via unauthorized data source credential access (#12258)
- Bound input and linearize loops in /api/core/capabilities to prevent DoS (#12292)
- Sanitize field formatter output in doc viewer table row to prevent XSS (#12190)
- Add AST-based validation for Vega expressions to prevent XSS via DOM traversal (#12422)
- Prevent DoS via chained datasource functions in Timeline (#12217)
- Add maxSize limits to scroll_count route arrays to prevent OOM DoS (#12191)
- Reject Content-Encoding on saved objects import to prevent decompression bomb DoS (#12189)
- Normalize configUsers/configGroups to array before matching to prevent substring false positives (#12343)
- Split configUsers and configGroups string by comma, space, or tab for multi-value handling (#12383)
- Fix incorrect document URL when embedding Discover table in a dashboard (#12376)
- Fix Data Table visualization missing from Create New Visualization type picker (#12280)
- Update command suggestions on slash command register/unregister in chat (#12281)
- Fix Discover data table columns not resizing on container size change (#12199)
- Sync languageType to queryEditorState from saved query on init for PromQL visualizations (#12222)
- Fix visualization snapshot storing flavor as explore object type (#12221)
- Fix chat data source validation logic and pass correct data source ID (#12213)
- Fix disabled dashboard filter overriding visualization filter (#12427)
- Fix ESLint 10 concurrency warning terminating lint and share plugin registration for flat config (#12362)
- Revert auto-open chat window feature due to layout conflicts with flyouts and toasts (#12309)
Infrastructure
- Onboard new backport-pr reusable GitHub workflow (#12272)
- Pin GitHub Actions to commit SHAs for supply chain security (#12041)
- Update opensearch-build workflow references from commit SHA to main (#12219)
- Regroup Cypress tests by feature area for Explore ciGroups (#12389)
- Bump Node.js from v22.22.3 to v22.23.0 for security fixes (#12234)
- Upgrade Jest to 30.4.2 and jsdom to 26.1.0 (#12381)
- Upgrade ESLint to 10.6.0 and Prettier to 3.9.4 (#12340)
- Upgrade Rspack to v2 (#11933)
- Remove leftover webpack dependencies after Rspack migration (#12295)
- Remove all grunt infrastructure from the repository (#11953)
- Use major version in .nvmrc to avoid requiring exact Node.js version (#12270)
Maintenance
- Upgrade Babel dependencies to 7.29.7 to resolve CVE (#12271)
- Upgrade elastic-apm-node to 4.18.0, query-string to 9.4.1, decode-uri-component to 0.5.0 for CVEs (#12366)
- Upgrade hono, immutable, js-yaml, linkify-it, and tar for CVEs (#12364)
- Upgrade postcss-selector-parser to 6.1.4 and dompurify to 3.4.11 for CVEs (#12282)
- Upgrade puppeteer to 24.43.1, ws to 8.21.1, body-parser to 2.3.0, mocha to 11.7.6, diff to 8.0.4 for CVEs (#12406)
- Upgrade react-use to 17.6.1 to address js-cookie CVE (#12200)
- Remove extract-zip and upgrade yauzl to 3.4.0, fast-uri to 3.1.3 for CVEs (#12306)
- Remove joi 17.13.3 from @types/hapi to address CVE (#12214)
- Upgrade shell-quote to 1.9.0 for CVE (#12289)
- Update dependencies to address multiple high and medium severity CVEs (#12266)
- Upgrade echarts to v6.1.0 to address CVE-2026-45249 (#12064)
- Upgrade @hapi/hapi from 20.2.1 to 21.4.9 and related packages for CVE (#12187)
- Upgrade uuid from 3.3.2 to 11.1.1 to address CVE-2026-41907 (#12315)
- Migrate joi from v14 to v17 and remove hoek vulnerability workaround (#11957)
- Replace @amoo-miki/numeral fork with stock @elastic/numeral plus BigInt helper (#12208)