Merge 5.0.1 into main (#1542)

* Merge 5.0.0 into 5.0.1 (#1518)

* Report skipped bumps in the repository bumper workflow (#1492)

Improve repository bumper error handling

* Recalculate flyout position when the sidecar is opened (#1503)

* Adapt flyout position in relation to the sidecar

* Add changelog

* Change resizable button emphasis style from :focus to :active (#1508)

* fix(sidecar): change resizable button emphasis style from :focus to :active

Update the .sidecar-resizableButton CSS to emphasize the "grab" icon
on :active instead of :focus, matching the intended interaction
feedback when dragging the resizer.

Closes wazuh/wazuh-dashboard-plugins#8989

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* fix(sidecar): remove leftover native focus outline on resizable button

The resizable button programmatically calls .focus() on every click,
so after removing the custom :focus emphasis in favor of :active, the
browser's default focus outline was left showing as an unstyled
colored border until focus moved elsewhere. Suppress it for
mouse/touch interaction while keeping it for keyboard users via
:focus-visible.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* fix(sidecar): opt out resizable button from the global focus-ring animation

The resizable button programmatically calls .focus() on every click,
which triggered OSD's global brute-force focus-ring animation
(:focus:not([class^="eui"]):not(.osd-resetFocusState) in _base.scss)
since the button isn't an EUI component. That showed as a lingering
colored border after dragging, independent from the button's own
:active styling. Opt out via the "osd-resetFocusState" class, which is
the mechanism _base.scss already documents for components with
hand-crafted focus states, instead of fighting the rule's
!important/specificity locally. Supersedes the previous outline:none
attempt, which didn't target the actual animation.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* feat(sidecar): allow configuring the resizable button className

Add an optional className prop to ResizableButton, and forward it from
a new classNameButton option on OverlaySidecarOpenOptions/Sidecar, so
callers of overlays.sidecar.open() can style/opt-out the resizer
button (e.g. pass "osd-resetFocusState" to drop the global focus-ring
animation) without hardcoding it in the component.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

---------

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Claude <noreply@anthropic.com>

* Change top bar health-check icon (#1505)

* feat: update health check indicator

* Change top bar health-check icon to a pulse shown only when attention is needed

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>

* fix(core): use kebab-case for sidecar docked-mode CSS variable

Rename --osdSidecarSize to --osd-sidecar-size and switch attribute
selectors to double quotes to satisfy the repo's stylelint rules
(custom-property-pattern, string-quotes), registering sidecar.scss
in the global selectors allowlist for its .euiFlyout references.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* chore: use constant

* Rework health-check popover

* Rework health-check popover

* List failing health checks in the nav-button popover

Show the enabled non-green checks as an EuiHealth list in the health-check
popover, labelled by the check name and with the error surfaced in a tooltip.
Use the shared mapTaskStatusToHealthColor helper and TASK.RUN_RESULT constants
instead of magic strings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>

* Fix popover closes when clicking inside

* Close popover after navigating to the health check

---------

Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Federico Rodriguez <federico.rodriguez@wazuh.com>

* Bump 5.0.0 branch (#1513)

feat: bump 5.0.0

* Fix RPM changelog entry order causing build failure (#1516)

Fix RPM changelog entry order for 5.0.0

The 5.0.0 changelog entry was placed out of descending chronological
order, causing rpmbuild to fail while parsing %changelog.

Signed-off-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Merge 4.14.9 into 5.0.0 (#1517)

Remove unnecessary debhelper install-time dependency (#1484)

fix: remove unnecessary debhelper install-time dependency

debhelper is only required to build the .deb package (declared under
Build-Depends in dev-tools/build-packages/deb/debian/control), not to
install a pre-built one. Remove it from the apt-get install steps used
to test package install/upgrade.

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

---------

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>
Signed-off-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com>
Co-authored-by: Federico Rodriguez <federico.rodriguez@wazuh.com>
Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Rodrigo López <37187963+rodrigofez@users.noreply.github.com>
Co-authored-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Wazuh CI <22834044+wazuhci@users.noreply.github.com>

* Merge 5.0.0 into 5.0.1 (#1541)

* Report skipped bumps in the repository bumper workflow (#1492)

Improve repository bumper error handling

* Recalculate flyout position when the sidecar is opened (#1503)

* Adapt flyout position in relation to the sidecar

* Add changelog

* Change resizable button emphasis style from :focus to :active (#1508)

* fix(sidecar): change resizable button emphasis style from :focus to :active

Update the .sidecar-resizableButton CSS to emphasize the "grab" icon
on :active instead of :focus, matching the intended interaction
feedback when dragging the resizer.

Closes wazuh/wazuh-dashboard-plugins#8989

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* fix(sidecar): remove leftover native focus outline on resizable button

The resizable button programmatically calls .focus() on every click,
so after removing the custom :focus emphasis in favor of :active, the
browser's default focus outline was left showing as an unstyled
colored border until focus moved elsewhere. Suppress it for
mouse/touch interaction while keeping it for keyboard users via
:focus-visible.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* fix(sidecar): opt out resizable button from the global focus-ring animation

The resizable button programmatically calls .focus() on every click,
which triggered OSD's global brute-force focus-ring animation
(:focus:not([class^="eui"]):not(.osd-resetFocusState) in _base.scss)
since the button isn't an EUI component. That showed as a lingering
colored border after dragging, independent from the button's own
:active styling. Opt out via the "osd-resetFocusState" class, which is
the mechanism _base.scss already documents for components with
hand-crafted focus states, instead of fighting the rule's
!important/specificity locally. Supersedes the previous outline:none
attempt, which didn't target the actual animation.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* feat(sidecar): allow configuring the resizable button className

Add an optional className prop to ResizableButton, and forward it from
a new classNameButton option on OverlaySidecarOpenOptions/Sidecar, so
callers of overlays.sidecar.open() can style/opt-out the resizer
button (e.g. pass "osd-resetFocusState" to drop the global focus-ring
animation) without hardcoding it in the component.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

---------

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Claude <noreply@anthropic.com>

* Change top bar health-check icon (#1505)

* feat: update health check indicator

* Change top bar health-check icon to a pulse shown only when attention is needed

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>

* fix(core): use kebab-case for sidecar docked-mode CSS variable

Rename --osdSidecarSize to --osd-sidecar-size and switch attribute
selectors to double quotes to satisfy the repo's stylelint rules
(custom-property-pattern, string-quotes), registering sidecar.scss
in the global selectors allowlist for its .euiFlyout references.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>

* chore: use constant

* Rework health-check popover

* Rework health-check popover

* List failing health checks in the nav-button popover

Show the enabled non-green checks as an EuiHealth list in the health-check
popover, labelled by the check name and with the error surfaced in a tooltip.
Use the shared mapTaskStatusToHealthColor helper and TASK.RUN_RESULT constants
instead of magic strings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>

* Fix popover closes when clicking inside

* Close popover after navigating to the health check

---------

Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>
Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Federico Rodriguez <federico.rodriguez@wazuh.com>

* Bump 5.0.0 branch (#1513)

feat: bump 5.0.0

* Fix RPM changelog entry order causing build failure (#1516)

Fix RPM changelog entry order for 5.0.0

The 5.0.0 changelog entry was placed out of descending chronological
order, causing rpmbuild to fail while parsing %changelog.

Signed-off-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Merge 4.14.9 into 5.0.0 (#1517)

Remove unnecessary debhelper install-time dependency (#1484)

fix: remove unnecessary debhelper install-time dependency

debhelper is only required to build the .deb package (declared under
Build-Depends in dev-tools/build-packages/deb/debian/control), not to
install a pre-built one. Remove it from the apt-get install steps used
to test package install/upgrade.

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

* Merge 4.14.9 into 5.0.0 (#1537)

Merge 4.14.9 into 5.0.0: no changes (verified 2026-08-28)

* fix: remove inert opensearch_security.cookie.ttl setting (#1534)

The dashboard config declares opensearch_security.cookie.ttl, but the
security plugin never reads it: only opensearch_security.session.ttl
governs session/cookie expiry. Shipping the setting misleads operators
into believing it bounds the cookie lifetime.

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Claude <noreply@anthropic.com>

---------

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>
Signed-off-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com>
Co-authored-by: Federico Rodriguez <federico.rodriguez@wazuh.com>
Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Rodrigo López <37187963+rodrigofez@users.noreply.github.com>
Co-authored-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Wazuh CI <22834044+wazuhci@users.noreply.github.com>

---------

Signed-off-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Signed-off-by: Rodrigo Lopez <rodrigo.lopez@wazuh.com>
Signed-off-by: Ian Yenien Serrano <63758389+yenienserrano@users.noreply.github.com>
Co-authored-by: Federico Rodriguez <federico.rodriguez@wazuh.com>
Co-authored-by: Antonio <34042064+Desvelao@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Rodrigo López <37187963+rodrigofez@users.noreply.github.com>
Co-authored-by: Antonio David Gutiérrez <antonio.gutierrez@wazuh.com>
Co-authored-by: Wazuh CI <22834044+wazuhci@users.noreply.github.com>

Author: 6 people

config/opensearch_dashboards.prod.yml

@@ -4,16 +4,15 @@ opensearch.hosts: https://localhost:9200
 opensearch.ssl.verificationMode: certificate
 #opensearch.username:
 #opensearch.password:
-opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
+opensearch.requestHeadersAllowlist: ['securitytenant', 'Authorization']
 opensearch_security.multitenancy.enabled: false
-opensearch_security.readonly_mode.roles: ["kibana_read_only"]
+opensearch_security.readonly_mode.roles: ['kibana_read_only']
 server.ssl.enabled: true
-server.ssl.key: "/etc/wazuh-dashboard/certs/dashboard-key.pem"
-server.ssl.certificate: "/etc/wazuh-dashboard/certs/dashboard.pem"
-opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"]
+server.ssl.key: '/etc/wazuh-dashboard/certs/dashboard-key.pem'
+server.ssl.certificate: '/etc/wazuh-dashboard/certs/dashboard.pem'
+opensearch.ssl.certificateAuthorities: ['/etc/wazuh-dashboard/certs/root-ca.pem']
 uiSettings.overrides.defaultRoute: /app/wz-home
 # Session expiration settings
-opensearch_security.cookie.ttl: 900000
 opensearch_security.session.ttl: 900000
 opensearch_security.session.keepalive: true
 

docker/config/opensearch_dashboards.dev.security.yml

@@ -1,15 +1,14 @@
-server.host: "0.0.0.0"
+server.host: '0.0.0.0'
 
-opensearch.hosts: ["https://indexer:9200"]
+opensearch.hosts: ['https://indexer:9200']
 opensearch.ssl.verificationMode: none
-opensearch.username: "kibanaserver"
-opensearch.password: "kibanaserver"
-opensearch.requestHeadersWhitelist: [ authorization,securitytenant ]
+opensearch.username: 'kibanaserver'
+opensearch.password: 'kibanaserver'
+opensearch.requestHeadersWhitelist: [authorization, securitytenant]
 opensearch_security.multitenancy.enabled: true
-opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]
-opensearch_security.readonly_mode.roles: ["kibana_read_only"]
+opensearch_security.multitenancy.tenants.preferred: ['Private', 'Global']
+opensearch_security.readonly_mode.roles: ['kibana_read_only']
 # Session expiration settings
-opensearch_security.cookie.ttl: 900000
 opensearch_security.session.ttl: 900000
 opensearch_security.session.keepalive: true