What elastic/kibana shipped

This week: managed workflow clone and history routes now enforce the read privilege, dashboard upserts no longer crash on missing tags, and the Privileged Users watchlist syncs its integration sources so deletion detection runs.

This week in Kibana: managed workflow clone and history routes now require the read managed workflows privilege, so their full YAML is no longer returned to users without it. Upserting a dashboard with a tag that does not exist no longer produces an unhandled rejection that could crash Kibana. The prebuilt Privileged Users watchlist now sets the sync marker index on its okta and ad integration sources, so deletion detection runs for them. The Automatic Import Read privilege now allows uploading integration packages, and apm-telemetry-task now aborts in-flight collection on cancel with a 10m timeout. The Defend utilization_limits.cpu description is updated for the 9.6 range.

This week: an opt-in event loop watchdog in Core, One Workflow stops child-workflow event loops and shows a Template not found page, ES|QL resolves LET subquery columns, and Security Solution closes cases at the user action limit.

This week in Kibana: Core adds an event loop watchdog behind a feature flag that logs main-thread blocks with per-phase stats. One Workflow no longer loops when a child workflow emits the triggering event, and unknown template slugs get a Template not found page. ES|QL resolves output columns for LET named subqueries, Workflows share alert document loading through one API, Security Solution re-authorizes rule params when enabling rules, and cases can be closed at the user action limit. Shared frontend artifacts move into the Rspack MultiCompiler build.

This week: remove timelines from a case, run workflows on all selected alerts, correct Entity Analytics engine status for editors, surface failed verification in Context Engine, and bind private Slack channels in Nightshift settings.

This week in the repository: Security Investigations lets you remove timelines from a case from the Timelines tab, as a batch or row action. Workflows now resolves every alert behind a select-all and accepts document ids server-side, so runs no longer stop at the loaded page. Entity Analytics shows the correct resource status on the engine status page for editors. Context Engine writes knowledge items with a verification_failed status and marks them with a FAILED badge. Nightshift can bind private Slack channels and answer mentions with the Nightshift Assistant. Hunt Watch threat reports now use a publication date to limit which reports a hunt picks up.

This week: risk movers read 90% fewer entity rows, risk inputs rank by numeric score, Task Manager no longer re-runs an rrule occurrence, and opt-in OpenSSL FIPS ships in standard Linux packages.

This week in the repository: the Risk movers count now reads only entities that can qualify, keeping the same counts with 90% fewer entity rows read, and risk inputs are ranked by numeric score rather than as text. Resolution scoring now applies the same alert filters as base scoring. Task Manager no longer re-runs an rrule task for the same occurrence when claimed before its runAt, dotenv is gone from production dependencies, and standard Linux x64 and arm64 archives, RPMs and Debian packages now bundle an opt-in OpenSSL 3.1.2 FIPS provider, disabled by default.

Alerts flyout pagination, custom threshold KQL filters applied to every aggregation type, and cleaner copy value in Discover. Plus redacted response headers, a new Synthetics getting started state, and a docker badge fix for APM services.

This week in Kibana: alerts flyout pagination lets you step through the rest of a result set without closing and reopening the flyout, and custom threshold rules now apply the metric KQL filter to every aggregation type (average, min, max, sum, cardinality, median, percentiles, rate, last value). Copy value in the Discover document viewer no longer applies CSV escaping. HTTP and Elasticsearch response loggers redact a few more internal headers. The Synthetics getting started empty state gets a new Create your first monitor layout, prebuilt rules no longer show non-solvable required_fields upgrade conflicts, the docker badge only appears on services actually running in docker, and ES|QL commands in Agent Builder no longer fail on clusters without the remote cluster privilege.

New week shipped: Alerting V2 Preview removed from management, workflow execution logs cleaned up, nested approvals supported, entity analytics now trackable in APM, and data federation form validation improved.

This week's release includes removing the Alerting V2 Preview from Stack Management, fixing workflow durable steps to stop repeating start events on resume, adding support for nested approval steps, improving data federation form validation, and enhancing observability with execution context tracking in Entity Analytics. Several reliability fixes target edge cases in alerting workflows and agent policy management.

New: Workflows execute as service accounts, support profile-based access control, and Datadog webhooks now work. Service accounts can be downscoped, and Agent Builder conversations export to JSON.

This week in Kibana: workflows gain service account execution and profile-based access control for fine-grained permissions. Datadog connectors now receive webhooks, service accounts support downscoping, and parallel steps correctly resolve branch outputs. Agent Builder exports conversations as JSON, and Alerting v2 surfaces matching notification policies. Test subject checks now separate DOM presence from element waits.

Week 40 shipped: Jest uses SWC now for faster tests, Fleet handles package conflicts better across spaces, and JSM/Opsgenie connectors stop failing on oversized messages.

This week in Kibana: We replaced Babel with SWC for Jest (faster test builds), moved oas_docs into the pnpm workspace (simpler dependency management), fixed Fleet's multi-space package installation conflicts, and improved connector resilience by gracefully handling field size limits. Also upgraded infrastructure tooling across the board.