[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/dgraph-io/ristretto	require	major	v0.2.0 → v2.4.2
github.com/jstemmer/go-junit-report	indirect	major	v1.0.0 → v2.1.0

---

Release Notes

dgraph-io/ristretto (github.com/dgraph-io/ristretto)

v2.4.2

Compare Source

Fixed

• Revert eager pre-allocation of the sampledLFU keyCosts map (#​482), which allocated
  NumCounters/10 map buckets at boot and caused a large RSS regression for caches with high
  NumCounters

Full Changelog: dgraph-io/ristretto@v2.4.1...v2.4.2

v2.4.1

Compare Source

Fixed

• Revert eager pre-allocation of the sampledLFU keyCosts map (#​482), which allocated
  NumCounters/10 map buckets at boot and caused a large RSS regression for caches with high
  NumCounters

Full Changelog: dgraph-io/ristretto@v2.4.1...v2.4.2

v2.4.0

Compare Source

Changed

• Pre-allocate keyCosts map in sampledLFU (#​482)

Fixed

• Handle mremap size mismatch on Linux s390x (#​491)

Full Changelog: dgraph-io/ristretto@v2.4.0...v2.4.1

v2.3.0

Compare Source

Added

• Implement public Cache.IterValues() method (#​475)
• Allow custom key types with underlying types in Key constraint (#​478)

Fixed

• Fix compilation on 32-bit archs (#​465)

Full Changelog: dgraph-io/ristretto@v2.3.0...v2.4.0

v2.2.0

Compare Source

Added

• Add public Cache.RemainingCost() method (#​448)
• Add support for uint keys (#​463)

Fixed

• Fix typo: ffor → for (#​456)
• Correct grammar in error message (#​461)

Full Changelog: dgraph-io/ristretto@v2.2.0...v2.3.0

v2.1.0

Compare Source

Changed

• Remove dependency: github.com/pkg/errors (#​443)

Fixed

• Switch from using a sync.WaitGroup to closing a channel of struct{} (#​442)

Full Changelog: dgraph-io/ristretto@v2.1.0...v2.2.0

v2.0.1

Compare Source

Added

• Add ShouldUpdate() function in config (#​427)

Fixed

• Fix memory leak while cleaning up expiration map (#​429)
• Execute m.Unlock in defer in store.go (#​425)

Full Changelog: dgraph-io/ristretto@v2.0.1...v2.1.0

v2.0.0

Compare Source

Fixed

• Wait for goroutines to finish (#​423)
• Bump golang.org/x/sys from 0.27.0 to 0.28.0 in the minor group (#​421)
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 in the minor group (#​420)
• Bump golang.org/x/sys from 0.26.0 to 0.27.0 in the minor group (#​419)

Full Changelog: dgraph-io/ristretto@v2.0.0...v2.0.1

v1.0.1

Compare Source

This release is deprecated

v1.0.0

Compare Source

This release is deprecated

jstemmer/go-junit-report (github.com/jstemmer/go-junit-report)

v2.1.0: Version 2.1.0

Compare Source

v2.1.0 changelog

• Fix #​147: Make timestamps in generated report more accurate.
• Fix #​140: Escape illegal XML characters in junit output.
• Fix #​145: Handle build errors in test packages with the _test suffix.
• Fix #​145: Don't ignore build errors that did not belong to a package.
• Fix #​134: Json test output was not parsed correctly when using the -race flag in go test.
• Add support for === NAME lines introduced in Go1.20
• junit: Add File attribute to testsuite.
• junit: Allow multiple properties with the same name.
• junit: Add the Testsuites.WriteXML convenience method.

v2.0.0: Version 2.0.0

Compare Source

Changes since v1.0.0

• Support for parsing go test -json output.
• Distinguish between build/runtime errors and test failures.
• JUnit report now includes output for all tests and benchmarks, and global output that doesn't belong to any test.
• Use full Go package name in generated report instead of only last path segment.
• Add support for reading skipped/failed benchmarks.
• Add -subtest-mode flag to exclude or ignore results of subtest parent tests.
• Add -in and -out flags for specifying input and output files respectively.
• Add -iocopy flag to copy stdin directly to stdout.
• Add -prop flags to set key/value properties in generated report.
• Add -parser flag to switch between regular go test (default) and go test -json parsing.
• Output in JUnit XML is written in <![CDATA[]]> tags for improved readability.
• Add hostname, timestamp and id attributes to JUnit XML.
• Improve accuracy of benchmark time calculation and update formatting in report.
• No longer strip leading whitespace from test output.
• The formatter and parser packages have been replaced with junit and parser/gotest packages respectively.
• Add support for parsing lines longer than 64KiB.
• The JUnit errors/failures attributes are now required fields.
• Drop support for parsing pre-Go1.13 test output.
• Deprecate -go-version flag.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR updates Go dependencies (github.com/dgraph-io/ristretto and github.com/jstemmer/go-junit-report) but currently introduces verified compatibility breakage in this repository, so overall risk is high and the PR is not merge-ready as-is.

Dependency 1: github.com/dgraph-io/ristretto v0.2.0 → github.com/dgraph-io/ristretto/v2 v2.4.2

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found — local build fails due v2 API/generics change not fully adapted (internal/pkg/cache/impl_ristretto.go:16: cannot use generic type ristretto.Config[K ristretto.Key, V any] without instantiation)
Testable in PR	✅ Yes — PR validation paths exist (.github/workflows/pre-commit.yml on pull_request; Buildkite PR pipeline enabled in .buildkite/pull-requests.json with build_on_commit: true)

Changelog highlights (v0.2.0 → v2.4.2)

• v2 series introduces API evolution and ongoing cache internals changes; latest v2.4.2 reverts eager sampledLFU.keyCosts pre-allocation to address high RSS regression.
• No CVE/GHSA identifiers were called out in upstream release notes for this bump.
• Security/CVE-focused readout: changes appear reliability/performance-oriented (memory behavior), with no explicit authn/authz/crypto/input-validation surface change noted.

Usage in this repository

• Direct runtime usage is in cache implementation:
  • internal/pkg/cache/impl_ristretto.go:10 imports github.com/dgraph-io/ristretto/v2
  • internal/pkg/cache/impl_ristretto.go:16 constructs ristretto.Config and now fails compile against v2 generics API.
• Module bump is in go.mod:7.
• Transitive update also bumps github.com/dgryski/go-farm in go.sum.

Compatibility assessment

• This is a Go major-version migration (v0 path → /v2 module path).
• Current code change updates import path but does not complete required v2 API adaptation for ristretto.Config, producing a compile-time failure.
• Verified locally via go test ./internal/pkg/cache -count=1 (fails at impl_ristretto.go:16).

Dependency 2: github.com/jstemmer/go-junit-report v1.0.0 → github.com/jstemmer/go-junit-report/v2 v2.1.0 (dev-tools)

Ecosystem: Go (dev/CI tooling)

Check	Result
Breaking changes	⚠️ Found — current state lacks matching /v2 checksum entries in dev-tools/go.sum, and tool invocation errors (missing go.sum entry for .../v2)
Testable in PR	✅ Yes — this tool is used by CI scripts in PR paths (.buildkite/scripts/unit_test.sh:18, integration_test.sh:16, unit_test_fipsonly.sh:18)

Changelog highlights (v1.0.0 → v2.1.0)

• v2 adds/changes parser and XML-report behavior (including go test -json support, parser package changes, output structure improvements).
• v2.1.0 contains parser/output correctness fixes (timestamps, XML escaping, race-flag JSON parsing handling).
• No CVE/GHSA identifiers were called out in upstream release notes.
• Security/CVE-focused readout: upstream changes are parser/output correctness; no explicit crypto/authn/authz or permission-scope broadening noted.

Usage in this repository

• Invoked in Mage: magefile.go:1708 via go tool -modfile dev-tools/go.mod github.com/jstemmer/go-junit-report.
• Used by CI scripts:
  • .buildkite/scripts/unit_test.sh:18
  • .buildkite/scripts/integration_test.sh:16
  • .buildkite/scripts/unit_test_fipsonly.sh:18
• Dependency bump appears in dev-tools/go.mod (.../v2 v2.1.0), while dev-tools/go.sum still shows only v1.0.0 entries (dev-tools/go.sum:54-55).

Compatibility assessment

• This is a major version migration for a CI/dev tool.
• The current PR state is internally inconsistent for module metadata (v2 required, v1-only sum entries), which causes immediate tool-resolution error in local verification.
• Even though production runtime impact is indirect, this affects test/report generation in CI and should be fixed before merge.

Labels Applied

No labels applied. oblt-aw/ai/merge-ready was not applied because overall risk is high with confirmed compatibility failures in current PR content.

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-renovate-prod]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[mergify]

This pull request is now in conflicts. Could you fix it @elastic-renovate-prod[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/8.19-golang/major-go-dependencies upstream/renovate/8.19-golang/major-go-dependencies
git merge upstream/8.19
git push upstream renovate/8.19-golang/major-go-dependencies

[Copilot]

🟡 Changes recommended

The Ristretto upgrade leaves non-integration builds broken, JUnit tooling references inconsistent with the v2 dependency, and generated notices stale, causing a CI consistency failure once compilation is fixed.

3 open issues

• Regenerate NOTICE files for the Ristretto dependency update · New
• Update cache configuration for Ristretto v2 generics · New
• Update JUnit report tool references and checksums to v2 · New

What changed in this PR

Updates Fleet Server’s cache dependency and JUnit reporting tool to their v2 modules on the 8.19 branch.

Changes:

• Upgrades Ristretto from v0.2.0 to v2.4.2 and changes the cache import.
• Upgrades the go-junit-report requirement from v1.0.0 to v2.1.0.
• Refreshes root-module checksums for Ristretto and go-farm.

File	Description
internal/​pkg/​cache/​impl_ristretto.go	Switches the Ristretto import to /v2.
go.sum	Updates Ristretto and go-farm checksums.
go.mod	Requires Ristretto v2.4.2.
dev-tools/​go.mod	Requires go-junit-report v2.1.0.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The incomplete Ristretto v2 generic migration breaks non-integration builds, and outdated go-junit-report package references prevent JUnit report generation.

3 open issues

• Update cache configuration for Ristretto v2 generics
• Regenerate NOTICE files for the Ristretto dependency update
• Update JUnit report tool references and checksums to v2

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR updates two Go dependencies, but the ristretto major bump introduces a confirmed compile break in runtime cache code and the go-junit-report major bump is not fully wired for current CI tooling; overall risk is high.

github.com/dgraph-io/ristretto v0.2.0 → github.com/dgraph-io/ristretto/v2 v2.4.2

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found (details below)
Testable in PR	✅ Yes (Buildkite PR pipeline runs on commit)

Changelog highlights (v0.2.0 → v2.4.2)

• Upstream v2.0.0 explicitly marks breaking changes (generic API and key-type constraints).
• Subsequent releases include memory/race/TTL fixes and RSS regression fixes.
• No CVE/GHSA IDs were listed in the release notes reviewed.
• Security posture impact for this repo appears neutral-to-improved (stability/memory fixes), but the API break is currently unresolved in-repo.

Usage in this repository

• internal/pkg/cache/impl_ristretto.go:10 imports github.com/dgraph-io/ristretto/v2.
• internal/pkg/cache/impl_ristretto.go:16-22 constructs ristretto.Config and calls ristretto.NewCache.
• This cache implementation is part of runtime cache behavior (internal/pkg/cache/cache.go).

Compatibility assessment

• Confirmed break with current code after the bump:
  • go test ./internal/pkg/cache -run 'TestValidAPIKey(EnabledKey|DisabledKey|Miss)$'
  • Error: cannot use generic type ristretto.Config[K ristretto.Key, V any] without instantiation (internal/pkg/cache/impl_ristretto.go:16).
• Conclusion: this major bump is not yet compatible with current repository usage.

github.com/jstemmer/go-junit-report v1.0.0 → github.com/jstemmer/go-junit-report/v2 v2.1.0

Ecosystem: Go (dev/CI tooling)

Check	Result
Breaking changes	⚠️ Found (details below)
Testable in PR	✅ Yes (PR Buildkite jobs run test:junitReport)

Changelog highlights (v1.0.0 → v2.1.0)

• v2.0.0 introduces significant behavior/formatting and parser changes.
• v2.1.0 adds parsing and XML-output correctness fixes.
• No CVE/GHSA IDs were listed in the release notes reviewed.
• Security impact appears neutral (no new elevated attack surface identified for this repo’s usage).

Usage in this repository

• Tool declared at dev-tools/go.mod:8 as github.com/jstemmer/go-junit-report.
• Require bumped at dev-tools/go.mod:26 to github.com/jstemmer/go-junit-report/v2 v2.1.0.
• Invoked at magefile.go:1708 via go tool ... github.com/jstemmer/go-junit-report.
• PR CI executes this path through mage ... test:junitReport in:
  • .buildkite/scripts/unit_test.sh:18
  • .buildkite/scripts/integration_test.sh:16
  • .buildkite/scripts/e2e_test.sh:16
  • PR pipeline is commit-triggered (.buildkite/pull-requests.json:9, build_on_commit: true).

Compatibility assessment

• Current invocation fails with updated module wiring:
  • go tool -modfile dev-tools/go.mod github.com/jstemmer/go-junit-report -help
  • Error includes missing sums for v2 dependency graph (e.g. missing go.sum entry ... github.com/jstemmer/go-junit-report/v2@v2.1.0).
• The major-version module path transition is incomplete in current repo usage (tool path/sum state).

Labels Applied

No labels applied (overall risk high; breaking compatibility observed).

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

TL;DR

Buildkite build 17935 is failing for two non-flaky reasons: the ristretto v2 migration introduced a compile error in cache config typing, and check-ci is failing because regenerated notice files are not committed. Immediate action: instantiate ristretto.Config with type args and commit refreshed notice files.

Remediation

• In internal/pkg/cache/impl_ristretto.go (at failing SHA 23341bfd), change &ristretto.Config{...} to a typed instantiation (e.g. &ristretto.Config[string, any]{...}).
• Run mage check:notice, commit NOTICE.txt + NOTICE-fips.txt, and re-run Buildkite.

Investigation details

Root Cause

1. Code bug (compile-time):
   • internal/pkg/cache/impl_ristretto.go:16 at commit 23341bfd uses ristretto.Config without generic type parameters after upgrading to github.com/dgraph-io/ristretto/v2.
2. Configuration/compliance failure (check-ci):
   • NOTICE artifacts are stale for the dependency/module-path change and CI enforces a clean index.

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/17935
• Failing packaging jobs (x86_64, x86_64 FIPS, aarch64, aarch64 FIPS) log excerpt:
  • internal/pkg/cache/impl_ristretto.go:16:11: cannot use generic type ristretto.Config[K ristretto.Key, V any] without instantiation
• Failing Run check-ci log excerpt:
  • NOTICE-fips.txt: needs update
  • NOTICE.txt: needs update
  • Error: git update-index failure: running "git update-index --refresh" failed with exit code 1

Verification

• Not run locally; analysis based on provided Buildkite logs and repository files at SHA 23341bfd04f1a1f9588cb03913186de5a79c0241.

Follow-up

• I attempted to check open flaky-test issues, but issue results were filtered by integrity policy in this run, so I could not correlate to a specific flaky-test tracker.

---

What is this? | From workflow: Observability Agentic Workflow — Status

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.