Bump jruby 10.0 logstash 8.19

.buildkite/linux_jdk_matrix_pipeline.yml

@@ -7,7 +7,7 @@ env:
   # Every run tests all supported JDKs on the default OS. To narrow or broaden a run, set
   # MATRIX_OSES and/or MATRIX_JDKS (space-separated) in the build environment.
   DEFAULT_MATRIX_OS: "ubuntu-2204"
-  DEFAULT_MATRIX_JDKS: "adoptiumjdk_21 adoptiumjdk_17 openjdk_21 openjdk_17 zulu_21 zulu_17"
+  DEFAULT_MATRIX_JDKS: "adoptiumjdk_21 openjdk_21 zulu_21"
 
 steps:
   - command: |

.buildkite/scripts/setup_java.sh

@@ -4,7 +4,7 @@ set -e
 
 install_java() {
   # TODO: let's think about regularly creating a custom image for Logstash which may align on version.yml definitions
-  sudo apt update && sudo apt install -y openjdk-17-jdk && sudo apt install -y openjdk-17-jre
+  sudo apt update && sudo apt install -y openjdk-21-jdk && sudo apt install -y openjdk-21-jre
 }
 
 install_java

.buildkite/windows_jdk_matrix_pipeline.yml

@@ -4,7 +4,7 @@ env:
   # Every run tests all supported JDKs on the default OS. To narrow or broaden a run, set
   # MATRIX_OSES and/or MATRIX_JDKS (space-separated) in the build environment.
   DEFAULT_MATRIX_OS: "windows-2022"
-  DEFAULT_MATRIX_JDKS: "adoptiumjdk_21 adoptiumjdk_17 openjdk_21 openjdk_17 zulu_21 zulu_17"
+  DEFAULT_MATRIX_JDKS: "adoptiumjdk_21 openjdk_21 zulu_21"
 
 steps:
   - command: |

.ci/updatecli/bump-logstash-version.yml

@@ -33,7 +33,7 @@ sources:
     kind: shell
     scmid: default
     spec:
-      command: test -f Gemfile.jruby-3.1.lock.release
+      command: test -f Gemfile.jruby-3.4.lock.release
 
 conditions:
   release_track_provided:
@@ -87,10 +87,10 @@ targets:
     dependson:
       - 'source#lock_file_exists'
     spec:
-      file: Gemfile.jruby-3.1.lock.release
+      file: Gemfile.jruby-3.4.lock.release
       matchpattern: 'logstash-core \(= [0-9]+\.[0-9]+\.[0-9]+'
       replacepattern: 'logstash-core (= {{ requiredEnv "LOGSTASH_VERSION" }}'
-  
+
   update_gemfile_lock_spec:
     name: Update logstash-core spec in lockfile
     kind: file
@@ -100,6 +100,6 @@ targets:
     dependson:
       - 'source#lock_file_exists'
     spec:
-      file: Gemfile.jruby-3.1.lock.release
+      file: Gemfile.jruby-3.4.lock.release
       matchpattern: 'logstash-core \([0-9]+\.[0-9]+\.[0-9]+-java\)'
       replacepattern: 'logstash-core ({{ requiredEnv "LOGSTASH_VERSION" }}-java)'

.github/workflows/critical_vulnerability_scan.yml

@@ -10,7 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps: 
       - name: checkout repo content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
       - name: build tar distribution
         run: ./gradlew clean assembleTarDistribution
       - run: mkdir scan

.ruby-version

@@ -1 +1 @@
-jruby-9.4.9.0
+jruby-10.0.3.0

Gemfile.jruby-3.1.lock.release → Gemfile.jruby-3.4.lock.release

@@ -10,6 +10,7 @@ PATH
     logstash-core (8.19.20-java)
       clamp (~> 1, >= 1.3.3)
       concurrent-ruby (~> 1, < 1.1.10)
+      csv (~> 3.0)
       down (~> 5.2.0)
       elasticsearch (~> 8)
       filesize (~> 0.2)
@@ -18,6 +19,8 @@ PATH
       jrjackson (= 0.5.2)
       manticore (~> 0.6)
       minitar (~> 1)
+      multi_json (~> 1.19.1)
+      observer (~> 0.1)
       pry (~> 0.12)
       puma (~> 8.0)
       rack (~> 3)
@@ -87,7 +90,6 @@ GEM
     buftok (0.2.0)
     builder (3.3.0)
     cabin (0.9.1)
-    cgi (0.3.7-java)
     childprocess (4.1.0)
     ci_reporter (2.1.0)
       builder (>= 2.1.2)
@@ -101,6 +103,7 @@ GEM
     crack (1.0.1)
       bigdecimal
       rexml
+    csv (3.3.5)
     dalli (3.2.8)
     date (3.3.3-java)
     diff-lcs (1.6.2)
@@ -124,8 +127,6 @@ GEM
     elasticsearch-api (8.19.3)
       multi_json
     equalizer (0.0.11)
-    erb (4.0.4.1-java)
-      cgi (>= 0.3.3)
     et-orbi (1.2.11)
       tzinfo
     faraday (2.14.3)
@@ -708,7 +709,7 @@ GEM
     mini_mime (1.1.5)
     minitar (1.0.2)
     msgpack (1.8.3-java)
-    multi_json (1.15.0)
+    multi_json (1.19.1)
     multipart-post (2.4.1)
     murmurhash3 (0.1.6-java)
     mustache (0.99.8)
@@ -729,6 +730,7 @@ GEM
     nio4r (2.7.5-java)
     nokogiri (1.18.10-java)
       racc (~> 1.4)
+    observer (0.1.2)
     octokit (4.25.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
@@ -857,7 +859,7 @@ GEM
     tzinfo-data (1.2025.3)
       tzinfo (>= 1.0.0)
     unicode-display_width (2.6.0)
-    uri (0.12.5)
+    uri (1.0.4)
     webhdfs (0.11.0)
       addressable
     webmock (3.25.2)
@@ -876,11 +878,9 @@ DEPENDENCIES
   belzebuth
   benchmark-ips
   bigdecimal (~> 3.1)
-  cgi (~> 0.3.7)
   childprocess (~> 4)
   ci_reporter_rspec (~> 1)
   date (= 3.3.3)
-  erb (~> 4.0.3)
   fileutils (~> 1.7)
   flores (~> 0.0.8)
   fpm (~> 1, >= 1.14.1)
@@ -1004,8 +1004,8 @@ DEPENDENCIES
   stud (~> 0.0.22)
   thwait
   treetop
-  uri (~> 0.12.3)
+  uri (~> 1.0.3)
   webmock (~> 3)
 
 BUNDLED WITH
-   2.6.3
+   2.7.2

Gemfile.template

@@ -139,7 +139,8 @@ gem "logstash-output-tcp", "~> 6.2", :require => false
 gem "logstash-output-udp", "~> 3.2", :require => false
 gem "logstash-output-webhdfs", "~> 3.1", :require => false
 
-gem "cgi", "~> 0.3.7" # Pins until a new jruby version with updated cgi is released
-gem "uri", "~> 0.12.3" # Pins until a new jruby version with updated cgi is released
+#gem "cgi", "~> 0.3.7" # Pins until a new jruby version with updated cgi is released
+#gem "uri", "~> 0.12.3" # Pins until a new jruby version with updated cgi is released
+gem "uri", "~> 1.0.3" # keep in lockstep with JRuby's bundled default gem version
 gem "jar-dependencies", "= 0.5.4" # Pin to avoid conflict with default
-gem "erb", "~> 4.0.3" # Pins until a new jruby version with updated cgi is released
+#gem "erb", "~> 4.0.3" # Pins until a new jruby version with updated cgi is released