[RELEASE] Release version 3.3.2

[github-actions]

Release OpenSearch and OpenSearch Dashboards 3.3.2

I noticed that a manifest was automatically created in manifests/3.3.2. Please follow the following checklist to make a release.

---

This release is opened due to a bug fix in the original 3.3.0/3.3.1 release related to ML/KNN/Neural/MCP/Skills/Metadata, only OS updated to 3.3.2 version here.

Release Schedule:

• 2025/10/23: OpenSearch Core and Plugin owners merge bug fix PRs
• 2025/10/24: Infra Team bump specific plugin versions
• 2025/10/27: Code freeze
• 2025/10/28: RC1
• 2025/10/29: IntegTests
• 2025/10/30: Quick release 3.3.2 launch on Tuesday

Related PRs:

• opensearch-build:
  • Added dependent plugins for search relevance #5794
  • [AUTO] Update input manifests #5798
  • Switch publish min windows to use bat #5808
  • [3.3.2] Manifest Commit Lock with action UPDATE_TO_RECENT_COMMITS #5812
  • [3.3.2] Manifest Commit Lock with action UPDATE_TO_RECENT_COMMITS #5813
  • [3.3.2] Manifest Commit Lock with action UPDATE_TO_RECENT_COMMITS #5814
  • Bump 3.3.2 version helm-charts#708
  • Update 3.3.2 version ansible-playbook#196
  • [3.3.2] Manifest Commit and Consolidated Release Notes #5820
• opensearch docs:
  • Bump docs to 3.3.2 version with OS updates only documentation-website#11404
• OpenSearch:
  • [Backport main] [AUTO] Add release notes for 3.3.2 OpenSearch#19800
    • [AUTO] Add release notes for 3.3.2 OpenSearch#19799
  • Similar to [AUTO] Increment version to 3.3.1. OpenSearch#19662 in branch 3.3
    • Bump 3.3 branch to version 3.3.2 OpenSearch#19732
  • Similar to Fix bwc on main by adding 3.3.1 to bwcVersions OpenSearch#19703 in branch main
    • Bump bwc on main with 3.3.2 bwcVersions OpenSearch#19734
  • [Backport 3.3] Remaining Lucene103Codec changes OpenSearch#19739
  • [3.3] Bump ch.qos.logback modules from 1.5.18 to 1.5.20 in HDFS test fixture OpenSearch#19764
  • Add S3Repository.LEGACY_MD5_CHECKSUM_CALCULATION to list of repository-s3 settings OpenSearch#19788
    • [3.3] Add S3Repository.LEGACY_MD5_CHECKSUM_CALCULATION to list of repository-s3 settings OpenSearch#19789
  • [Backport 3.3] Fix IndexOutOfBoundsException when running include/exclude with non-existent prefix term OpenSearch#19790
  • [Java Agent] Allow JRT protocol URLs in protection domain extraction OpenSearch#19683
  • [Backport 3.3] Remaining Lucene103Codec changes OpenSearch#19739
  • [Java Agent] Allow JRT protocol URLs in protection domain extraction OpenSearch#19683
    • [Backport 3.3] [Java Agent] Allow JRT protocol URLs in protection domain extraction OpenSearch#19709
  • Potential RC2: [3.3] Bump org.bouncycastle:bc-fips from 2.1.1 to 2.1.2 OpenSearch#19817
• Docs:
  • Bump docs to 3.3.2 version with OS updates only documentation-website#11404
• Neural Search
  • [Agentic Search] Update User Prompt with output format instructions neural-search#1621
    • [Backport 3.3] [Agentic Search] Update User Prompt with output format instructions neural-search#1623
  • [Agentic Search] Add conversation search support with agentic search neural-search#1626
    • [Backport 3.3] [Agentic Search] Add conversation search support with agentic search neural-search#1627
  • [Agentic Search] Extract JSON from Agent Response neural-search#1631
    • [Backport 3.3] [Agentic Search] Extract JSON from Agent Response neural-search#1632
  • [Agentic Search] Extract agent summary trace based on model type neural-search#1633
    • [Backport 3.3] [Agentic Search] Extract agent summary trace based on model type neural-search#1634
  • [AUTO] Add release notes for 3.3.2 neural-search#1635
    • [Backport main] [AUTO] Add release notes for 3.3.2 neural-search#1636
• ML/MCP:
  • [Backport main] [AUTO] Add release notes for 3.3.2 ml-commons#4373
    • [AUTO] Add release notes for 3.3.2 ml-commons#4372
  • [BUG] Failed to get tools from external MCP server ml-commons#4209
    • [Backport 3.3] add refresh policy; add checkpoint id field ml-commons#4306
    • combine json chunks from requests ml-commons#4317
      • [Backport 3.3] combine json chunks from requests ml-commons#4349
    • Fix unsupported operation exception in execute tool API ml-commons#4325
      • [Backport 3.3] Fix unsupported operation exception in execute tool API ml-commons#4350
    • [Backport 3.3] Onboard to s3 snapshots ml-commons#4328
    • [Backport 3.3] Fix scratch pad when return_history is true ml-commons#4316
    • Fixing regex bypass issue ml-commons#4336
      • [Backport 3.3] Fixing regex bypass issue ml-commons#4344
    • Use filtered output in agent tool response streaming ml-commons#4335
      • [Backport 3.3] Use filtered output in agent tool response streaming ml-commons#4366
    • Add name validation to index prefix ml-commons#4332
      • [Backport 3.3] Add name validation to index prefix ml-commons#4346
  • Fix CVE-2025-58057 ml-commons#4338
    • [Backport 3.3] Fix CVE-2025-58057 ml-commons#4343
  • Support MCP connector in agent update API ml-commons#4352
    • [Backport 3.3] Support MCP connector in agent update API ml-commons#4353
  • [Agentic Search]Add extract JSON processor in Query Planning Tool ml-commons#4356
    • [Backport 3.3] [Agentic Search]Add extract JSON processor in Query Planning Tool ml-commons#4363
  • Fixing regex bypass issue ml-commons#4336
    • [Backport 3.3] Fixing regex bypass issue ml-commons#4344
  • Nova mme support ml-commons#4360
    • [Manual backport 3.3] Nova mme support ml-commons#4368
• k-NN:
  • [AUTO] Add release notes for 3.3.2 k-NN#2966
    • [Backport 3.3] [AUTO] Add release notes for 3.3.2 k-NN#2967
  • [Backport 3.3] Do not apply memory optimized search for old indices. k-NN#2949
• skills:
  • [AUTO] Add release notes for 3.3.2 skills#664
    • [Backport 3.3] [AUTO] Add release notes for 3.3.2 skills#665
  • fix regex bypass issue skills#656
    • [Backport 3.3]fix regex bypass issue (#656) skills#663
• Metadata sdk:
  • [AUTO] Add release notes for 3.3.2 opensearch-remote-metadata-sdk#280
    • [Backport 3.3] [AUTO] Add release notes for 3.3.2 opensearch-remote-metadata-sdk#281
  • upgrading netty codec version opensearch-remote-metadata-sdk#273
    • [Backport 3.3] upgrading netty codec version opensearch-remote-metadata-sdk#274
• Flow Framework: netty
  • Up to: [AUTO] Increment version to 3.3.2-SNAPSHOT flow-framework#1256
• Notifications: netty
  • Up to: [AUTO] Increment version to 3.3.2-SNAPSHOT notifications#1093
• SA: [BUG] Stop use snapshots in non-snapshots builds security-analytics#1607
  • [AUTO] Increment version to 3.3.2-SNAPSHOT security-analytics#1598
• Query-Insights: [BUG] Stop use snapshots in non-snapshots builds #1607 query-insights#473
  • [Backport 3.3] Onboarding new maven snapshots publishing to s3 (query-insights) query-insights#471
• Security: FIPS
  • [AUTO] Add release notes for 3.3.2 security#5757
    • [Backport main] [AUTO] Add release notes for 3.3.2 security#5758
  • Add security provider earlier in bootstrap process security#5749
    • [Backport 3.3] Add security provider earlier in bootstrap process (#5749) security#5756
• Others:
  • [opensearch] Update to use release creation date instead of tag commit date endoflife-date/endoflife.date#8823

---

How to use this issue

This Release Issue

This issue captures the state of the OpenSearch release, its assignee (Release Manager) is responsible for driving the release. Please contact them or @mention them on this issue for help. There are linked issues on components of the release where individual components can be tracked. For more information check the the Release Process OpenSearch Guide.

Please refer to the following link for the release version dates: Release Schedule and Maintenance Policy.

Release Checklist

Entrance Criteria

Criteria	Status	Description	Comments
Each component release issue has an assigned owner	🟢
Documentation draft PRs are up and in tech review for all component changes	🟢
Sanity testing is done for all components	🟢
Code coverage has not decreased (all new code has tests)	🟢
Release notes are ready and available for all components	🟢
Roadmap is up-to-date (information is available to create release highlights)	🟢
Release ticket is cut, and there's a forum post announcing the start of the window	🟢
Any necessary security reviews are complete	🟢

OpenSearch 3.3.2 exit criteria status:

Criteria	Status	Description	Comments
Performance tests are run, results are posted to the release ticket and there no unexpected regressions	🟢
No unpatched vulnerabilities of medium or higher severity that have been publicly known for more than 60 days	🟢
Documentation has been fully reviewed and signed off by the documentation community.	🟢
All integration tests are passing	🟢
Release blog is ready	🟢

OpenSearch-Dashboards 3.3.2 exit criteria status:

Criteria	Status	Description	Comments
Documentation has been fully reviewed and signed off by the documentation community	🟢
No unpatched vulnerabilities of medium or higher severity that have been publicly known for more than 60 days	🟢
All integration tests are passing	🟢
Release blog is ready	🟢

Preparation

• Release manager assigned.
• Update release page on the website with release manager and release issue details. Sample PR
• Existence of label in each component repo. For more information check the release-label section.
• Increase the build frequency.
• Release Issue.

Campaigns

• Component Release Issue.
• Release Campaigns.

Version Increment - _Ends REPLACE_RELEASE-minus-10-days

• Core Version Increment.
• Components Version Increment.

Feature Freeze - _Ends REPLACE_RELEASE-minus-12-days

• OpenSearch / OpenSearch-Dashboards core and components teams finalize their features.

Code Complete - Ends REPLACE_RELEASE-minus-10-days

• Mark this as done once the Code Complete is reviewed.
• Create/Verify pull requests to add each component to relase input manifests/3.3.2/opensearch-3.3.2.yml and manifests/3.3.2/opensearch-dashboards-3.3.2.yml.

Release Branch, Release Candidate Creation and Testing - Ends REPLACE_RELEASE-minus-6-days

• Core Release Branch.
• Components Release Branch.
• Generate Release Candidate.
• Docker Scan.
• Integ Test.
  • TAR
  • RPM
  • DEB
  • Windows
• Backwards Compatibility Tests.
• Broadcast and Communication.
• Release Candidate Lock.
• Stop Release Candidate periodic auto builds

Performance testing validation - Ends REPLACE_RELEASE-minus-6-days

• Post the benchmark-tests
• Longevity tests do not show any issues.

Pre Release - Ends REPLACE_RELEASE-minus-1-days

• Release Labeled Issues.
• Go or No-Go.
• Release Notes.

Release - _Ends {_REPLACE_RELEASE-day}

• Central Promotion Workflow.
• Collaboration with the Project Management Team.

Release Checklist.

Release Checklist

Pre-Release activities

• Promote Repos.
  • • OS
  • • OSD
• Promote Artifacts.
  • • Windows
  • • Linux Debian
  • • Linux RPM
  • • Linux TAR
• Consolidated Release Notes.

Release activities

• Docker Promotion.
• Release Validation part 1.
  • • OpenSearch and OpenSearch Dashboard Validation.
  • • Validate the native plugin installation.
• Merge consolidated release notes PR.
• Website and Documentation Changes.
  • • Merge staging website PR.
  • • Promote the website changes to prod.
  • • Add website alert.
• Release Validation part 2.
  • • Validate the artifact download URL's and signatures.
• Release Validation part 3.
  • • Trigger the validation build (Search for Completed validation for <> in the logs).
• Maven Promotion.
• Publish blog posts.
• Advertise on Social Media.
• Post on public slack and Github Release issue.

Post Release

• Release Tags.
• Input Manifest Update.
• OpenSearch Build Release notes.
• Decrease the Build Frequency.
• Retrospective Issue.
• Helm and Ansible Playbook release.
• Upcoming Release Preparation.

Components

Replace with links to all component tracking issues.

Component	On track	Release Notes
{COMPONENT_ISSUE_LINK}	{INDICATOR}	{STATUS}

Legend

Symbol	Meaning
🟢	On track with overall release
🟡	Missed last milestone
🟢	Missed multiple milestones

[peterzhuamazon]

See OpenSearch RC 1 (11502) details

Validation: https://build.ci.opensearch.org/blue/organizations/jenkins/distribution-validation/detail/distribution-validation/3890/pipeline/

OpenSearch 1 details

## OpenSearch 11502 is ready for your test.

OpenSearch - Build 11502

• OpenSearch docker 3.3.2.11502

  • Start without security
    • Docker command docker pull opensearchstaging/opensearch:3.3.2.11502 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "DISABLE_SECURITY_PLUGIN=true" opensearchstaging/opensearch:3.3.2.11502
    • Connect command curl http://localhost:9200/
  • Start with security
    • Docker command

    docker pull opensearchstaging/opensearch:3.3.2.11502 && docker run -it -p 9200:9200 -e "discovery.type=single-node" -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" opensearchstaging/opensearch:3.3.2.11502
    

    • Connect command curl --insecure 'https://admin:myStrongPassword123!@localhost:9200/'

• Use TARs to deploy OpenSearch Manually

  • OpenSearch - Build 11502 (Note: Windows version does not have performance analyzer plugin)
    • arm64 [manifest] [tar] [rpm][deb]
    • x64 [manifest] [tar] [rpm] [deb] [windows]

Check how to install opensearch on different platforms

Integration Test Results

• Use the https://metrics.opensearch.org/_dashboards/goto/9ed74dd90eb31c7b83f3542e43328088?security_tenant=global.

Thank you

OpenSearch Docker-Scan Results

Workflow run

Java (jar)
==========
Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 5, HIGH: 0, CRITICAL: 0)

┌──────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│                   Library                    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├──────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ org.bouncycastle:bc-fips (bc-fips-2.1.1.jar) │ CVE-2025-12194 │ MEDIUM   │ fixed  │ 2.1.1             │ 2.1.2         │ bcprov-lts8on: bc-fips: Uncontrolled Resource Consumption │
│                                              │                │          │        │                   │               │ vulnerability in Bouncy Castle                            │
│                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-12194                │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
│                                              │                │          │        │                   │               │                                                           │
└──────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

[peterzhuamazon]

RC1 IntegTests:

• OS:
  • TAR X64: ✅
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10487/pipeline
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10496/pipeline
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10502/pipeline
  • TAR ARM64: ✅
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10486/pipeline
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10497/pipeline
  • DEB X64: ✅
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10491/pipeline
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10500/pipeline
  • DEB ARM64: ✅
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10490/pipeline
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10501/pipeline
  • RPM X64: ✅
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10489/pipeline
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10498/pipeline
  • RPM ARM64: ✅
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10488/pipeline
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10499/pipeline
  • ZIP X64:⏳(skipped, pending RC2)
    • https://build.ci.opensearch.org/blue/organizations/jenkins/integ-test/detail/integ-test/10495/pipeline
• OSD:
  • Pending RC2