build(deps): bump github.com/opensearch-project/opensearch-go/v4 from 4.6.0 to 4.7.3

[dependabot]

Bumps github.com/opensearch-project/opensearch-go/v4 from 4.6.0 to 4.7.3.

Release notes

Sourced from github.com/opensearch-project/opensearch-go/v4's releases.

v4.7.3

opensearch-go v4.7.3

CRITICAL UPGRADE RELEASE NOTE - The next major release (v5) has substantially expanded error handling capabilities compared to v4.

v4.7.3 is the last v4 release before v5. The v4 -> v5 upgrade changes runtime error-handling behavior and is NOT a drop-in replacement across major versions. If you use this client, read this now - even if you are only upgrading to v4.7.3.

Today, v4 only returns transport-level errors; partial failures (e.g. failed bulk items, failed shards, unconfirmed replica writes) are reported inside the response body, not as Go error values. In v5, those partial failures are returned as errors by default. Code that compiles and passes against v4 can behave differently against v5 without any code change.

Upgrading between v4 releases (any <v4.7.3 to any v4.X.X) does not change the default error-handling semantics. The change lands in v5, which is expected shortly after this release. The full error-handling guide is in the v4.7.1 release notes and https://github.com/opensearch-project/opensearch-go/blob/HEAD/guides/error_handling.md.

This release covers development from December 2025 through July 2026 (v4.6.0 -> v4.7.3). Three themes dominate the line: a reworked error-handling model that surfaces partial failures as typed Go errors, a rewritten transport layer, and a client-side routing layer that replaces plain round-robin node selection. It also ships a preview of the v5 API surface.

v4.7.3 is a patch on top of v4.7.2. One memory leak, one batch of memory the bulk indexer held on to, a dependency CVE in the code generator, and the Dependabot config gap that let the CVE sit unnoticed. No new features, no behavior changes, no breaking changes. Neither memory fix shows up in a unit test, so anyone running a v4 client as a long-lived process should take this patch.

Full Changelog: opensearch-project/opensearch-go@v4.6.0...v4.7.3

4.7.3 Fixes

• fix(opensearchutil): BulkIndexer did not release a batch's memory on flush, holding it until a later batch of the same size reused the slots. Backport of @​Ashwinnbr007's opensearch-project/opensearch-go#1016 in opensearch-project/opensearch-go#1018, fixing opensearch-project/opensearch-go#912
• fix(opensearchtransport): clusters with a dedicated cluster manager leaked memory on discovery, which built a new connection for the node every cycle and never evicted the old one. By @​sean- in opensearch-project/opensearch-go#1003

---

1. Error handling

Background

OpenSearch returns HTTP 200 for many operations that only partially succeed: bulk requests where some items fail, searches where some shards error, and writes where a replica fails to confirm. A 2xx status code does not mean the whole operation succeeded.

Before v4.7.0, only transport errors were returned as errors and any partial or shard-level failure required inspecting response fields by hand after every call. v4.7.0 adds a model that turns partial failures into typed Go errors:

Error type	Returned by
*PartialBulkError	Bulk
*PartialSearchError	Search, MSearch, SearchTemplate, Scroll.Get
*ShardFailureError	Index, Document.Create, Document.Delete, Update
*MultiSearchItemError	MSearch, MSearchTemplate (per sub-response)

Which categories are returned as errors is controlled by a per-category mask on Config.Errors. When a category is masked, the operation returns its response with a nil error even though the response body records failures, and the caller is responsible for inspecting it. When a category is not masked (the default coming in v5), the same partial failure is returned as one of the typed errors above, and the response is still fully populated alongside the error.

v4 -> v5 Migration Path

The default mask in v4 is to mask all errors to preserve the existing v4 behavior of only returning transport errors. The v4.7.0 release exists to catch this change in behavior between v4 and v5 of the library in a forward-compatible way.

Surface	Config.Errors == nil means	Effect
v4	errmask.All	every category masked: partial failures are not returned as errors (preserves pre-4.7 behavior)
v5+	errmask.Empty	no category masked: every partial failure is returned as an error

... (truncated)

Changelog

Sourced from github.com/opensearch-project/opensearch-go/v4's changelog.

[4.7.3]

Changed

• Point Dependabot at the cmd/osgen module as well as the repository root. The gomod entry in .github/dependabot.yml used the singular directory: "/" key and so only ever read the root manifest, leaving the nested generator module unwatched since it was introduced. It now uses directories with both paths listed explicitly, which is what the singular key cannot express. Modules are listed one by one rather than globbed so that linter testdata fixtures, which pin old dependency versions deliberately, stay out of scope. Any nested module added later needs its own entry (#1019)

Fixed

• Fix opensearchutil.BulkIndexer retaining a worker's peak batch memory after a traffic burst subsides. (*worker).flush released a completed batch with w.items = w.items[:0], which keeps the slice's backing array -- and every BulkIndexerItem it holds, including each item's Body (an io.ReadSeeker over the caller's document bytes) and its OnSuccess/OnFailure closures -- reachable until a later batch of equal or greater size overwrites the slots. A worker that peaked at N items during a backlog replay stayed pinned at ~N items' worth of document bodies and closures indefinitely, even after traffic dropped. flush now clears the item slice before truncating, dropping those references so the GC can reclaim them (#912)
• Fix an unbounded connection/heap leak in node discovery when the cluster has a dedicated cluster manager (cluster_manager role with no work roles). The node was filtered out of the allConns inventory while the router received the unfiltered added/removed diffs, so findConnectionByURL never matched it: a new *Connection was created every discovery cycle and the stale one was never evicted, accumulating without bound in the round-robin fallback pool whose checkDead health checks repopulated a per-connection poolRegistry sync.Map each cycle (leak rate scaled with discovery frequency). allConns is now the full connection inventory so discovery reuses and evicts symmetrically, and dedicated cluster managers are excluded at request-routing selection instead: RoundRobinPolicy skips them in its DiscoveryUpdate add path and multiServerPool.Next() skips them during selection (including the no-router fallback), both gated on IncludeDedicatedClusterManagers. Discovery still bootstraps against a dedicated cluster manager seed via the seed-fallback pool (#1003)

Dependencies

• Bump github.com/getkin/kin-openapi from 0.142.0 to 0.144.0 and golang.org/x/text from 0.14.0 to 0.40.0 in cmd/osgen in order to resolve CVE-2026-56852. Details in the Pull Request (#1019)

[4.7.2]

Fixed

• Fix data races on multiServerPool lock-guarded fields: activeListCap, warmupRounds, warmupSkipCount, and healthCheck were de-facto guarded by cp.mu but declared at the top level of the struct, allowing accesses from snapshot(), createOrUpdateMultiNodePoolWithLock, and updateConnectionPool to escape the lock without looking wrong. All four fields are now nested inside the mu embedded struct so every access is spelled cp.mu.<field> and the guard is structural. snapshot() reads activeListCap under the read lock; createOrUpdateMultiNodePoolWithLock runs fully under allConnsPool.mu with per-connection conn.mu taken inside the loop; updateConnectionPool's RTT-probe scheduling loop reads healthCheck under the read lock. recalculateWarmupParams/getWarmupParams renamed *WithLock to document that all callers now hold the pool lock (#995)
• Fix removed opensearch.BuildRequest reference in v4 upgrade guide (#978)

Dependencies

• Bump actions/setup-go to 7.0.0 and actions/setup-java to 5.6.0 (#993)

[4.7.1]

Changed

• Add a first-class container-provider abstraction to the test harness Makefile. CONTAINER_PROVIDER is auto-detected by CLI presence in the order Colima -> Rancher Desktop (rdctl) -> Docker, and overridable with CONTAINER_PROVIDER=colima|rancher|docker. Selecting a provider pins the docker context (colima / rancher-desktop; the Docker provider leaves the active context alone, and a pre-set DOCKER_CONTEXT in the environment is respected), resolves the CLI runtime $(CTR) (now docker by default for every provider, with CONTAINER_RUNTIME=nerdctl as an advanced override), ensures the backing VM/daemon is running via the new cluster.provider.ensure target (wired into cluster.start), and sets vm.max_map_count through the provider's VM (colima ssh / rdctl shell) or a privileged helper container. Previously $(CTR) preferred nerdctl whenever it was on PATH, so a Rancher-installed nerdctl could hijack a Colima session. make cluster.runtime now reports the detected provider, docker context, and runtime (#968)

Fixed

• Fix two gaps in the seed-fallback routing path left by #952/#954/#956: RoundRobinPolicy.Eval went straight to pool.Next() without checking its own psEnabled bit (unlike CoordinatorPolicy.Eval and RolePolicy.Eval), so a dead but unverified discovered node was returned as a zombie producing a transport error — not ErrNoConnections — and the seed fallback never fired; PolicyChain.Eval also did not gate on IsEnabled() even though PolicyChain.Route did, leaving the nested chain inside IfEnabledPolicy.Eval unguarded. Both gaps are now closed: RoundRobinPolicy.Eval returns no connection when its enabled bit is clear, and PolicyChain.Eval skips not-enabled sub-policies, matching the behavior of every other leaf policy and Route (#966)
• Fix node discovery serving unverified discovered nodes as last-resort zombies and bypassing the seed-URL fallback when publish_address is unroutable from the client (NAT'd clusters, Kubernetes stack clusters in CI). multiServerPool.nextFallbackWithLock previously returned any dead connection unconditionally; a never-health-checked discovered node was handed out and failed with a transport error (connection reset by peer / no route to host), which is not ErrNoConnections so the seed fallback never fired. Introduce lcViable, a monotonic lifecycle bit meaning "proven directly reachable at least once" — seeds are born viable; discovered nodes earn it on their first successful health check or request. availableForRouting() now gates on lcViable so a dead list holding only never-verified discovered nodes yields ErrNoConnections and the request cascades to the seed-URL fallback (#973)

[4.7.0]

Added

• Add Close() to opensearch.Client and opensearchapi.Client to release background goroutines (node discovery, health/stats pollers, DNS refresh) and idle connections; opensearchutil.NewBulkIndexer now closes the client it implicitly creates. Backport of #926 without the default-client cache (#928, #893)
• Add VerifyDeadAfter (opensearch.Config / opensearchtransport.Config, env override OPENSEARCH_GO_VERIFY_DEAD_AFTER): bounds how long a connection proven reachable may still be blindly resurrected as a last-resort "zombie" while dead. Each discovery cycle clears the viability mark on any non-seed connection that has been dead longer than the window, so a node that never recovers stops absorbing requests and must health-check clean again before it is routed to; seed connections are exempt. The env var accepts a boolean (true selects the 15m default, false disables the expiry) or a time.ParseDuration string; the Config field follows the 0 = default, <0 = disabled, >0 = explicit convention. See guides/routing.md (Zombie Connection Resurrection and Connection Viability)
• Add cmd/osgen code generator for typed path builders and API consumer files from the OpenAPI spec
• v5preview/opensearchapi: NewClient and NewDefaultClient now inject opensearchtransport.NewDefaultRouter when config.Client.Router is nil, opting every v5preview client into intelligent request routing by default. The OPENSEARCH_GO_ROUTER env var preserves its v4 semantics end-to-end: =true/=1 enables auto-discovery (via DiscoverNodesOnStart); =false/=0 suppresses both Router injection and auto-discovery; unset injects the Router without auto-discovery. v4's opensearchapi.NewClient is unchanged. (#816)
• Add envvars.Falsy(name) helper that distinguishes "explicitly opted out" from "unset" (Truthy collapses both into false). Used by v5preview's router injection rule.
• Add v5preview/opensearchapi/ package: regenerated v5-track API surface produced by cmd/osgen from the OpenAPI spec. Fully typed Req/Resp/Params structs, sub-clients matching OpenSearch namespaces (client.Cat, client.Cluster, client.Indices, etc.), and a plugins/ subtree for ML/k-NN/security/ISM/etc. Coexists with opensearchapi/ during the v4 -> v5 transition; see v5preview/opensearchapi/README.md for usage and UPGRADING.md for migration guidance (#650)
• Add primary_terms_map and split_shards_metadata fields to ClusterState index metadata for OpenSearch >=3.6.0 compatibility
• Add generic opensearch.Do[T]() function for compile-time pointer enforcement on response types, preventing a class of bugs where non-pointer values are silently passed to Client.Do() and fail at runtime during JSON unmarshaling. Includes opensearch.NoBody marker type for calls that expect no response body, unifying all internal dispatch through a single generic path (#809)
• Add dynamic read cost scoring: primary shard cost scales with write-pool utilization via connScoreFunc, preferring primaries at idle and shedding reads to replicas under write load

... (truncated)

Commits

• 172ea95 chore(deps): update dependabot to scan /cmd/osgen and fixes CVE-2026-56852 (#...
• dc37a07 added clear on the w.items slice (#1016) (#1018)
• 3e002aa chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#1012)
• e33776d chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1009)
• 280028c docs(changelog): add v4.7.1 and v4.7.2 sections (#1005)
• 7311cec fix(opensearchtransport): keep dedicated cluster managers in the connection i...
• c46b959 chore: sync CODEOWNERS with main, drop departed maintainers (#1006)
• ac45b8e chore: prepare v4.7.2 release (#996)
• 9ae8960 chore(deps): bump actions/setup-go to 7.0.0 and setup-java to 5.6.0 (#993)
• 59493e6 Backport/981 pool lock races to v4 (#995)
• Additional commits viewable in compare view

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}