chore(opensearch): update versions for release 26.7

jdk-base/boil-config.toml

@@ -3,3 +3,6 @@ vector = "0.55.0"
 
 [versions."24".local-images]
 vector = "0.55.0"
+
+[versions."25".local-images]
+vector = "0.55.0"

opensearch/boil-config.toml

@@ -62,3 +62,34 @@ jdk-base = "24"
 "opensearch-system-templates-plugin-version" = "3.4.0.0"
 "opensearch-ubi-plugin-version" = "3.4.0.0"
 "query-insights-plugin-version" = "3.4.0.0"
+
+[versions."3.6.0".local-images]
+java-devel = "25"
+jdk-base = "25"
+"opensearch/security-plugin" = "3.6.0.0"
+"opensearch/opensearch-prometheus-exporter" = "3.6.0.0"
+
+[versions."3.6.0".build-arguments]
+"opensearch-alerting-plugin-version" = "3.6.0.0"
+"opensearch-job-scheduler-plugin-version" = "3.6.0.0"
+"opensearch-anomaly-detection-plugin-version" = "3.6.0.0"
+"opensearch-asynchronous-search-plugin-version" = "3.6.0.0"
+"opensearch-cross-cluster-replication-plugin-version" = "3.6.0.0"
+"opensearch-custom-codecs-plugin-version" = "3.6.0.0"
+"opensearch-flow-framework-plugin-version" = "3.6.0.0"
+"opensearch-geospatial-plugin-version" = "3.6.0.0"
+"opensearch-index-management-plugin-version" = "3.6.0.0"
+"opensearch-knn-plugin-version" = "3.6.0.0"
+"opensearch-ml-plugin-version" = "3.6.0.0"
+"opensearch-neural-search-plugin-version" = "3.6.0.0"
+"opensearch-notifications-core-plugin-version" = "3.6.0.0"
+"opensearch-notifications-plugin-version" = "3.6.0.0"
+"opensearch-observability-plugin-version" = "3.6.0.0"
+"opensearch-reports-scheduler-plugin-version" = "3.6.0.0"
+"opensearch-search-relevance-plugin-version" = "3.6.0.0"
+"opensearch-security-analytics-plugin-version" = "3.6.0.0"
+"opensearch-skills-plugin-version" = "3.6.0.0"
+"opensearch-sql-plugin-version" = "3.6.0.0"
+"opensearch-system-templates-plugin-version" = "3.6.0.0"
+"opensearch-ubi-plugin-version" = "3.6.0.0"
+"query-insights-plugin-version" = "3.6.0.0"

opensearch/opensearch-prometheus-exporter/boil-config.toml

@@ -5,3 +5,8 @@ java-devel = "21"
 # OpenSearch 3.4.0 bundles JDK 24, but the OpenSearch Prometheus Exporter can only be built with
 # JDK 21.
 java-devel = "21"
+
+[versions."3.6.0.0".local-images]
+# OpenSearch 3.6.0 bundles JDK 25, but the OpenSearch Prometheus Exporter can only be built with
+# JDK 21.
+java-devel = "21"

opensearch/opensearch-prometheus-exporter/stackable/patches/3.6.0.0/0001-Add-CycloneDX-plugin.patch

@@ -0,0 +1,33 @@
+From 523bb67bd099d627bd787c66cdb2a9501cf214c7 Mon Sep 17 00:00:00 2001
+From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
+Date: Fri, 19 Jun 2026 11:14:39 +0200
+Subject: Add CycloneDX plugin
+
+---
+ build.gradle | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/build.gradle b/build.gradle
+index a0486c2..e6b1c3f 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -30,8 +30,17 @@ buildscript {
+     }
+ }
+
+-configurations {
+-    zipArchive
++plugins {
++    id("org.cyclonedx.bom") version "3.2.4"
++}
++
++cyclonedxBom {
++    // Specified the type of project being built. Defaults to 'library'
++    projectType = org.cyclonedx.model.Component.Type.APPLICATION
++    // Specified the version of the CycloneDX specification to use. Defaults to VERSION_16.
++    schemaVersion = org.cyclonedx.Version.VERSION_16
++    jsonOutput = file("build/reports/cyclonedx/bom.json")
++    xmlOutput.unsetConvention()
+ }
+
+ apply plugin: 'java'

opensearch/opensearch-prometheus-exporter/stackable/patches/3.6.0.0/patchable.toml

@@ -0,0 +1,2 @@
+mirror = "https://github.com/stackabletech/opensearch-prometheus-exporter"
+base = "e270733405f43f40ddd46706713347c8670d6d83"

opensearch/security-plugin/Dockerfile

@@ -18,7 +18,14 @@ cd "$(/stackable/patchable --images-repo-root=src checkout opensearch/security-p
 
 # Create snapshot of the source code including custom patches
 tar -czf /stackable/opensearch-security-${PRODUCT_VERSION}-stackable${RELEASE_VERSION}-src.tar.gz .
-./gradlew clean assemble -Dbuild.snapshot=false
+
+# Starting with version 3.6.0.0, the security plugin defaults to crypto.standard=FIPS-140-3 (gradle.properties),
+# which makes the build treat the BouncyCastle FIPS jars as compileOnly, expecting the OpenSearch core
+# distribution to provide them in lib/.
+# The Stackable OpenSearch build is not a FIPS build, so it does not ship those jars, and the plugin fails
+# at startup with NoClassDefFoundError: org/bouncycastle/jcajce/provider/BouncyCastleFipsProvider.
+# Build in non-FIPS mode (-Pcrypto.standard=any-supported) so the plugin bundles its own BouncyCastle jars.
+./gradlew clean assemble -Dbuild.snapshot=false -Pcrypto.standard=any-supported
 ./gradlew cyclonedxBom --warning-mode=summary -Dbuild.snapshot=false
 EOF
 

opensearch/security-plugin/boil-config.toml

@@ -3,3 +3,6 @@ java-devel = "21"
 
 [versions."3.4.0.0".local-images]
 java-devel = "24"
+
+[versions."3.6.0.0".local-images]
+java-devel = "25"

opensearch/security-plugin/stackable/patches/3.6.0.0/0001-Add-CycloneDX-plugin.patch

@@ -0,0 +1,38 @@
+From ef01276e08fe6d84c023bc30bca290def3da69c0 Mon Sep 17 00:00:00 2001
+From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com>
+Date: Fri, 19 Jun 2026 11:24:38 +0200
+Subject: Add CycloneDX plugin
+
+---
+ build.gradle | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/build.gradle b/build.gradle
+index 89a749af..273208ce 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -70,11 +70,24 @@ plugins {
+     id 'eclipse'
+     id "com.github.spotbugs" version "6.4.8"
+     id "com.google.osdetector" version "1.7.3"
++    id "org.cyclonedx.bom" version "3.2.4"
+ }
+
+ allprojects {
+     group = "org.opensearch"
+     version = opensearch_build
++
++    cyclonedxDirectBom {
++        includeConfigs = ["runtimeClasspath"]
++        skipConfigs = ["compileClasspath", "testCompileClasspath"]
++    }
++}
++
++cyclonedxBom {
++    includeLicenseText = false
++    projectType = "application"
++    schemaVersion = org.cyclonedx.Version.VERSION_16
++    componentVersion = opensearch_build
+ }
+
+ apply plugin: 'opensearch.opensearchplugin'