[mergify]

What is the problem this PR solves?

The github.com/elastic/elastic-agent-system-metrics repository has been archived and its code merged back into Beats as pkg/systemmetrics (elastic/beats#52081, backported to 9.5, 9.4 and 8.19). Fleet Server still depends on the archived module, so it will no longer receive fixes or security updates for the process/system metrics it reports on the /stats endpoint.

How does this PR solve the problem?

Switches Fleet Server to the Beats package, which exposes the same API. Elastic Agent made the same change in elastic/elastic-agent#17362.

• internal/pkg/api/metrics.go: import github.com/elastic/beats/v7/pkg/systemmetrics/report instead of github.com/elastic/elastic-agent-system-metrics/report. No other code changes.
• go.mod / go.sum: add github.com/elastic/beats/v7 pinned to the current Beats main commit (v7.0.0-alpha2.0.20261104093103-ee4981601f01) and drop elastic-agent-system-metrics. go mod tidy only keeps what the report package needs: one new indirect module (github.com/ebitengine/purego) and a few indirect bumps (gopsutil v4.24.7 to v4.26.9, go-sysinfo, gosigar, tklauser/*, go-winio, fatih/color, pflag, prometheus/common, genproto/googleapis/rpc). No direct dependency other than Beats changes.
• testing/go.mod / testing/go.sum: tidied, because this module replaces the root module with ../.
• .golangci.yml: remove the gomodguard rule that blocked github.com/elastic/beats/v7, since pkg/systemmetrics is not a separate Go module and can only be consumed through beats/v7. The beats/elastic-agent and bytedance/sonic blocks stay. AGENTS.md is updated to match.
• renovate.json: disable Renovate gomod updates for github.com/elastic/beats/v7. Beats has no release tags on its working branches, so it is pinned to a pseudo-version of the same-named Beats branch; Renovate would otherwise move release branches to Beats main or propose the unrelated v7.17.x tags. Beats is updated manually per branch with go get github.com/elastic/beats/v7@<branch>, go mod tidy and mage check:notice.
• NOTICE.txt / NOTICE-fips.txt: regenerated with mage check:notice.

Backports

This PR is labeled backport-active-all. The Mergify backports will cherry-pick the main Beats pin unchanged, so each backport PR (9.6, 9.5, 9.4, 8.19) needs a follow-up commit pinning Beats to the matching branch:

go get github.com/elastic/beats/v7@<branch>   # e.g. @9.6
go mod tidy && (cd testing && go mod tidy)
mage check:notice

All four Beats release branches contain pkg/systemmetrics and use the same Go version (1.26.10) as the matching Fleet Server branches.

How to test this PR locally

mage check:all
mage test:unit
mage build:local
FIPS=true mage build:local
mage check:detectFIPSCryptoImports
rg elastic-agent-system-metrics   # no results

Locally mage check:ci steps, mage test:unit, both builds and the FIPS crypto import check pass. golangci-lint v2.15.0 reports the same issue set as on main (no new issues).

Design Checklist

N/A: dependency relocation with no runtime behavior change.

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have made corresponding changes to the documentation

Related issues

• Relates https://github.com/elastic/ingest-dev/issues/9310
• Relates chore: import elastic-agent-system-metrics repository beats#52081
• Relates Replace elastic-agent-system-metrics with Beats pkg/systemmetrics elastic-agent#17362

---

This is an automatic backport of pull request #8192 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 287860c has failed:

On branch mergify/bp/9.5/pr-8192
Your branch is up to date with 'origin/9.5'.

You are currently cherry-picking commit 287860c.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   .golangci.yml
	modified:   AGENTS.md
	modified:   internal/pkg/api/metrics.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	both modified:   NOTICE-fips.txt
	both modified:   NOTICE.txt
	both modified:   go.mod
	both modified:   go.sum
	deleted by us:   renovate.json
	both modified:   testing/go.mod
	both modified:   testing/go.sum

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[Copilot]

🟡 Changes recommended

Unresolved merge markers in dependency manifests and checksums block builds and tests, and the Beats dependency still targets main rather than the required 9.5 branch.

2 open issues

• Resolve dependency conflicts in Go manifests and checksums · New
• Pin Beats to the matching 9.5 branch · New

What changed in this PR

This 9.5 backport of #8192 migrates Fleet Server’s /stats metrics reporting from the archived elastic-agent-system-metrics module to the maintained Beats package.

Changes:

• Switches the metrics import to beats/v7/pkg/systemmetrics/report.
• Updates dependency requirements, checksums, and standard/FIPS notices.
• Allows the Beats dependency and disables its automated Renovate updates to support branch-specific pinning.

File	Description
testing/​go.sum	Updates testing-module dependency checksums.
testing/​go.mod	Updates testing-module indirect requirements.
renovate.json	Configures dependency automation, keeping Beats updates manual.
NOTICE.txt	Updates standard-build dependency notices.
NOTICE-fips.txt	Updates FIPS-build dependency notices.
internal/​pkg/​api/​metrics.go	Imports metrics reporting from Beats.
go.sum	Updates root dependency checksums.
go.mod	Replaces the archived metrics dependency with Beats.
AGENTS.md	Documents removal of the Beats dependency restriction.
.golangci.yml	Removes the Beats module block from lint rules.

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR correctly switches metrics reporting from the archived elastic-agent-system-metrics module to beats/v7/pkg/systemmetrics, but unresolved merge-conflict markers in dependency manifests make the update currently high risk / not merge-ready.

github.com/elastic/elastic-agent-system-metrics v0.14.5 → github.com/elastic/beats/v7 v7.0.0-alpha2.0.20261104093103-ee4981601f01

Ecosystem: Go

Check	Result
Breaking changes	⚠️ Found (repository state is currently broken by unresolved conflict markers in module files)
Testable in PR	✅ Yes (repo has pull_request workflows, e.g. .github/workflows/golangci-lint.yml)

Changelog highlights (v0.14.5 → beats pseudo-version)

• get_release_by_tag for elastic/beats at v7.0.0-alpha2.0.20261104093103-ee4981601f01 (and without v) returned 404; no exact release-note tag exists for this pseudo-version.
• Using local PR metadata/diff: this is a package relocation from archived elastic-agent-system-metrics into elastic/beats/v7/pkg/systemmetrics/report with intended API parity.
• No explicit CVE/GHSA entries were available from upstream release notes for this exact pseudo-version.

Usage in this repository

• internal/pkg/api/metrics.go:19 imports github.com/elastic/beats/v7/pkg/systemmetrics/report.
• internal/pkg/api/metrics.go:79 uses report.SetupMetricsOptions(report.MetricOptions{...}) for /stats metrics setup.
• No other in-repo usages of elastic-agent-system-metrics were found.

Compatibility assessment

• The code-path usage is narrow and appears API-compatible at the call site (report.SetupMetricsOptions).
• However, module state is currently invalid due to unresolved merge markers:
  • go.mod contains <<<<<<</=======/>>>>>>> blocks (e.g. lines 10, 14, 19, 64, 66, 68, 109, 111, 113).
  • go.sum, testing/go.mod, and testing/go.sum also contain conflict markers.
• This prevents a trustworthy dependency resolution/validation baseline and is a hard blocker independent of the relocation itself.

Labels Applied

No labels applied (oblt-aw/ai/merge-ready withheld because overall risk is high until manifest conflicts are resolved).

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the system-metrics dependency backport.

2 open issues

• Resolve dependency conflicts in Go manifests and checksums
• Pin Beats to the matching 9.5 branch

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: Replaces github.com/elastic/elastic-agent-system-metrics with github.com/elastic/beats/v7/pkg/systemmetrics and updates related transitive Go modules; overall risk is low-to-moderate.

github.com/elastic/elastic-agent-system-metrics v0.14.5 → github.com/elastic/beats/v7 v7.0.0-alpha2.0.20261105162333-48d0117e5b74

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in repository usage
Testable in PR	✅ Yes (go test ./internal/pkg/api/... passed)

Changelog highlights (vOLD → vNEW)

• GitHub release notes for the pseudo-version tag were unavailable (get_release_by_tag with and without v returned 404; no exact-equivalent tag found in list_releases).
• Local metadata available: the pinned Beats commit message references otelconsumer retry back-off behavior; no explicit CVE/GHSA/security advisory noted in available metadata.

Usage in this repository

• internal/pkg/api/metrics.go:19 imports github.com/elastic/beats/v7/pkg/systemmetrics/report.
• internal/pkg/api/metrics.go:79 calls report.SetupMetricsOptions(report.MetricOptions{...}).
• No other repository references to the old or new system-metrics package path were found.

Compatibility assessment

• Call-site API usage remained equivalent after import-path migration (report package + SetupMetricsOptions pattern).
• No Go major-version path break was introduced for consumed imports.
• Additional transitive updates (e.g. go-sysinfo, gopsutil, golang.org/x/net) are patch/minor/pseudo updates with no direct API consumption changes in this repo.
• No newly introduced attack surface was identified from local usage evidence.

Labels Applied

• oblt-aw/ai/merge-ready (applied): low-to-moderate risk, compatible usage, and PR-testable changes.

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

Automerge skipped

Automerge skipped this pull request because the changed files do not match any configured dependency collection.

If this update should be automerged, ask a maintainer to add or adjust a collection, or merge the pull request manually.

See Opt in or opt out for how to enable or disable Automerge collections on the Control Plane Dashboard.

Collections currently enabled for automerge: github-actions, pre-commit, vm-images

Changed files considered:

• .golangci.yml
• AGENTS.md
• NOTICE-fips.txt
• NOTICE.txt
• go.mod
• go.sum
• internal/pkg/api/metrics.go
• internal/pkg/server/fleet_integration_test.go
• testing/go.mod
• testing/go.sum

[github-actions]

TL;DR

The failed Buildkite integration step does not include the actual failing test/package output in the captured log, so the root cause cannot be verified from available evidence. Immediate next action is to re-run the job and capture the full go test failure lines (or build/test-int-<os>.out) so the real failing test can be fixed.

Remediation

• Re-run :smartbear-testexecute: Run integration tests and capture full go test stderr/stdout (including the first failing package/test line).
• Upload build/test-int-*.out as an artifact (not only build/*.xml) to preserve failure context when JUnit XML is missing.
• Once the concrete failing test name/error is visible, apply a targeted fix and validate with mage test:integration.

Investigation details

Root Cause

I could not confirm a code-level root cause from the provided failure artifact because it only shows passing test output plus a final generic FAIL/exit code.

Evidence in the provided job log (/tmp/gh-aw/buildkite-logs/fleet-server-smartbear-testexecute-run-integration-tests.txt):

• Passing suites are shown (e.g., internal/pkg/smap, internal/pkg/throttle, internal/pkg/ver).
• Then only terminal summary appears:
  • FAIL (line 131)
  • Error: running "go test -v -tags=integration,grpcnotrace -count=1 -race -p 1 ./..." failed with exit code 1 (line 133)
• No --- FAIL: block, panic, compile error, or failing package line is present in captured output.

Relevant code path:

• .buildkite/scripts/integration_test.sh runs mage test:integration then mage test:junitReport.
• magefile.go writes integration output to build/test-int-<os>.out in Test.IntegrationRun (around lines 1285-1330), but this file is not uploaded by the job artifact rule shown in the log (build/*.xml only).

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/17921
• Job/step: :smartbear-testexecute: Run integration tests
• Key log excerpt:
  • FAIL
  • Error: running "go test -v -tags=integration,grpcnotrace -count=1 -race -p 1 ./..." failed with exit code 1
  • No files matched paths: build/*.xml

Verification

• Local reproduction was not run in this environment because integration tests require Docker Compose and Docker-in-Docker is unavailable in this runner context.

Follow-up

• I attempted to check open flaky-test issues for correlation, but issue payloads were filtered by integrity policy in this run, so I cannot safely link a specific existing flaky issue from available data.

---

What is this? | From workflow: Observability Agentic Workflow — Status

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the backport to Beats’ maintained metrics package.

No open issues 🎉

2 resolved since last review

• Resolve dependency conflicts in Go manifests and checksums
• Pin Beats to the matching 9.5 branch

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR replaces github.com/elastic/elastic-agent-system-metrics with github.com/elastic/beats/v7/pkg/systemmetrics/report; based on local usage and PR-testable CI, overall risk is low-to-moderate.

github.com/elastic/elastic-agent-system-metrics v0.14.5 → github.com/elastic/beats/v7 v7.0.0-alpha2.0.20261105162333-48d0117e5b74 (pkg/systemmetrics/report)

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in this repo’s consumed interface
Testable in PR	✅ Yes — PR-triggered workflows exist (e.g. .github/workflows/golangci-lint.yml, .github/workflows/pre-commit.yml)

Changelog highlights (vOLD → vNEW)

• No exact GitHub Release exists for the pseudo-version tag (v7.0.0-alpha2.0.20261105162333-48d0117e5b74) after MCP release lookup retries.
• Local metadata confirms intent: migrate from archived elastic-agent-system-metrics into Beats pkg/systemmetrics (see chore: import elastic-agent-system-metrics repository beats#52081, referenced in PR body).
• CVE/security review from available notes: no explicit CVE/GHSA entries found for this bump path; change reduces maintenance risk by moving off an archived module.

Usage in this repository

• internal/pkg/api/metrics.go imports github.com/elastic/beats/v7/pkg/systemmetrics/report.
• Consumed API is report.SetupMetricsOptions(report.MetricOptions{...}) in the same file.
• No other direct imports of old/new systemmetrics package were found in repo search.

Compatibility assessment

• The call site in internal/pkg/api/metrics.go keeps the same usage pattern (SetupMetricsOptions + MetricOptions fields), indicating interface compatibility at this integration point.
• I ran a compile-level check for this area: go test ./internal/pkg/api -run TestDoesNotExist -count=0 ✅.
• Indirect module churn from go mod tidy (e.g. gopsutil, go-sysinfo, x/net) is expected for the new source module and does not show a direct breaking surface in Fleet Server code.
• Potential security regression surface appears limited to metric collection internals; no authn/authz, request parsing, or crypto handling changes were introduced in Fleet Server call sites.

Labels Applied

• oblt-aw/ai/merge-ready — applied (risk low-to-moderate, no repo-usage breaking change found, ecosystem checks passed for this Go bump).

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[mergify]

This pull request has not been merged yet. Could you please review and merge it @{{ assignee | join(', @') }}? 🙏

[mergify]

This pull request is now in conflicts. Could you fix it @mergify[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/9.5/pr-8192 upstream/mergify/bp/9.5/pr-8192
git merge upstream/9.5
git push upstream mergify/bp/9.5/pr-8192

[Copilot]

🟢 Approval recommended

No active review issues are blocking the system-metrics dependency migration and related updates.

No open issues 🎉

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: Replaces archived github.com/elastic/elastic-agent-system-metrics with github.com/elastic/beats/v7/pkg/systemmetrics/report; overall risk is low-to-moderate and compatible with current usage.

Dependency 1: github.com/elastic/elastic-agent-system-metrics v0.14.5 → github.com/elastic/beats/v7 v7.0.0-alpha2.0.20261105162333-48d0117e5b74

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in repository usage
Testable in PR	✅ Yes — PR-triggered workflows exist (.github/workflows/golangci-lint.yml:8, .github/workflows/pre-commit.yml:4)

Changelog highlights (v0.14.5 → new Beats pseudo-version)

• Exact release notes for the Beats pseudo-version are not published as a tagged release (MCP lookup for exact tag returned 404).
• Local metadata in this PR indicates the system-metrics code was merged into Beats (pkg/systemmetrics) and this PR switches import path accordingly.
• Prior elastic-agent-system-metrics v0.14.5 notes include maintenance + process metrics fixes, with no CVE/GHSA entries.
• Security/CVE assessment: no explicit vulnerability advisories found in available notes; moving from an archived module to maintained Beats code reduces long-term stale-dependency exposure.

Usage in this repository

• internal/pkg/api/metrics.go:19 imports github.com/elastic/beats/v7/pkg/systemmetrics/report.
• internal/pkg/api/metrics.go:77 uses report.SetupMetricsOptions(...) for /stats process/system metrics reporting.
• No remaining code imports of elastic-agent-system-metrics were found.

Compatibility assessment

• The consumed API (report.SetupMetricsOptions with report.MetricOptions) remains compatible with current call sites.
• go.mod/testing/go.mod include tidy-driven transitive adjustments (including some indirect upgrades and a few downgrades such as grpc/cbor); no direct call-site changes were introduced for those modules in this PR.
• Overall CVE-focused risk remains contained for this repository’s current usage surface.

Labels Applied

• oblt-aw/ai/merge-ready — low-to-moderate risk, no usage-breaking changes identified, and PR-testable CI coverage present.

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the backport replacing the archived system-metrics dependency with the maintained Beats package.

No open issues 🎉

_{Review effort: Balanced}

[elastic-vault-github-plugin-prod]

Dependency Update Analysis

Summary: This PR is a Go dependency relocation from github.com/elastic/elastic-agent-system-metrics to github.com/elastic/beats/v7/pkg/systemmetrics/report with related indirect go mod tidy updates; overall risk is low-to-moderate and compatible with current repo usage.

github.com/elastic/elastic-agent-system-metrics v0.14.5 → github.com/elastic/beats/v7 v7.0.0-alpha2.0.20261105162333-48d0117e5b74

Ecosystem: Go

Check	Result
Breaking changes	✅ None found in local usage
Testable in PR	✅ Yes — code change is in repo code (internal/pkg/api/metrics.go) and can be validated in PR CI/local test runs

Changelog highlights (vOLD → vNEW)

• elastic-agent-system-metrics v0.14.5 notes show maintenance/process changes and a Linux PID handling fix; no CVE/GHSA entries were identified in that release body.
• No exact release tag exists for Beats pseudo-version v7.0.0-alpha2.0.20261105162333-48d0117e5b74 (MCP get_release_by_tag returned 404 on both retry attempts). Using local commit metadata for this pin, the referenced Beats commit message is focused on OTel retry backoff behavior, with no explicit CVE/GHSA advisory in available metadata.
• Security/CVE assessment from available sources: no explicit new vulnerability disclosure tied to this bump; moving off an archived module to actively maintained Beats reduces maintenance risk.

Usage in this repository

• Direct code usage is at internal/pkg/api/metrics.go:19 (report import) and internal/pkg/api/metrics.go:78 (report.SetupMetricsOptions(...)).
• The PR changes only the import path (internal/pkg/api/metrics.go), not the call pattern.
• grep confirms no remaining elastic-agent-system-metrics imports in *.go files.

Compatibility assessment

• This is an import-path relocation to the same metrics package lineage (pkg/systemmetrics/report); local usage (SetupMetricsOptions with MetricOptions) remains unchanged.
• No Go major-version migration issue for existing imports in this repo was introduced (the new module is added directly as /v7 and consumed in one location).
• Related indirect updates in go.mod/testing/go.mod (e.g., gopsutil, go-sysinfo, purego, tklauser/*) appear as transitive tidy effects of the module replacement; no direct API coupling from fleet-server source to those modules was found.
• No new security-sensitive configuration or authn/authz surface was introduced by this PR’s code changes.

Labels Applied

• oblt-aw/ai/merge-ready — applied (risk low-to-moderate, no breaking usage changes found, ecosystem checks passed for this Go dependency update).

---

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.