From 9a38ac601c35276918391f786a667c6d5b35e191 Mon Sep 17 00:00:00 2001
From: Konrad Szwarc <konrad.szwarc@elastic.co>
Date: Tue, 30 Jan 2024 17:58:58 +0100
Subject: [PATCH 1/6] [EDR Workflows][Osquery] Timeout copy changes (#175894)

https://github.com/elastic/security-docs/issues/4698#issuecomment-1914737291

![Screenshot 2024-01-30 at 15 23
13](https://github.com/elastic/kibana/assets/29123534/9809b4ea-c347-4dc1-8e26-b13c41377687)
![Screenshot 2024-01-30 at 15 23
27](https://github.com/elastic/kibana/assets/29123534/b821adda-8544-4600-9af3-69ced269c83c)
![Screenshot 2024-01-30 at 15 23
37](https://github.com/elastic/kibana/assets/29123534/4df3e119-c9b7-432b-af20-27a7d6ccd8f2)
---
 .../e2e/all/alerts_response_actions_form.cy.ts     | 14 +++++++-------
 .../osquery/cypress/e2e/all/live_query.cy.ts       |  4 ++--
 .../plugins/osquery/public/form/timeout_field.tsx  | 11 ++++++-----
 3 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
index 0591e650cc560..041818824f2f2 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
@@ -70,32 +70,32 @@ describe('Alert Event Details - Response Actions Form', { tags: ['@ess', '@serve
 
     cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
       cy.contains('Query is a required field');
-      cy.contains('Timeout value must be greater than 60 seconds.').should('not.exist');
+      cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
     });
 
     // check if changing error state of one input doesn't clear other errors - START
     cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
       cy.contains('Advanced').click();
       cy.getBySel('timeout-input').clear();
-      cy.contains('Timeout value must be greater than 60 seconds.');
+      cy.contains('The timeout value must be 60 seconds or higher.');
     });
 
     cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
       cy.contains('Query is a required field');
-      cy.contains('Timeout value must be greater than 60 seconds.');
+      cy.contains('The timeout value must be 60 seconds or higher.');
     });
 
     cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
       cy.getBySel('timeout-input').type('6');
-      cy.contains('Timeout value must be greater than 60 seconds.');
+      cy.contains('The timeout value must be 60 seconds or higher.');
     });
     cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
       cy.contains('Query is a required field');
-      cy.contains('Timeout value must be greater than 60 seconds.');
+      cy.contains('The timeout value must be 60 seconds or higher.');
     });
     cy.getBySel(RESPONSE_ACTIONS_ITEM_0).within(() => {
       cy.getBySel('timeout-input').type('6');
-      cy.contains('Timeout value must be greater than 60 seconds.').should('not.exist');
+      cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
     });
     cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
       cy.contains('Query is a required field');
@@ -105,7 +105,7 @@ describe('Alert Event Details - Response Actions Form', { tags: ['@ess', '@serve
     });
     cy.getBySel(RESPONSE_ACTIONS_ERRORS).within(() => {
       cy.contains('Query is a required field');
-      cy.contains('Timeout value must be greater than 60 seconds.').should('not.exist');
+      cy.contains('The timeout value must be 60 seconds or higher.').should('not.exist');
     });
     // check if changing error state of one input doesn't clear other errors - END
 
diff --git a/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts b/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts
index 8351e9df4728c..6f551ad39b196 100644
--- a/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts
+++ b/x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts
@@ -39,10 +39,10 @@ describe('ALL - Live Query', { tags: ['@ess', '@serverless'] }, () => {
     getAdvancedButton().click();
     fillInQueryTimeout('910');
     submitQuery();
-    cy.contains('Timeout value must be lower than 900 seconds.');
+    cy.contains('The timeout value must be 900 seconds or or lower.');
     fillInQueryTimeout('890');
     submitQuery();
-    cy.contains('Timeout value must be lower than 900 seconds.').should('not.exist');
+    cy.contains('The timeout value must be 900 seconds or or lower.').should('not.exist');
     typeInOsqueryFieldInput('days{downArrow}{enter}');
     submitQuery();
     cy.contains('ECS field is required.');
diff --git a/x-pack/plugins/osquery/public/form/timeout_field.tsx b/x-pack/plugins/osquery/public/form/timeout_field.tsx
index cdbc415a69c8f..86b696694570c 100644
--- a/x-pack/plugins/osquery/public/form/timeout_field.tsx
+++ b/x-pack/plugins/osquery/public/form/timeout_field.tsx
@@ -28,15 +28,15 @@ const TimeoutFieldComponent = ({ euiFieldProps }: TimeoutFieldProps) => {
       validate: (currentValue: number) => {
         if (currentValue < QUERY_TIMEOUT.DEFAULT || isNaN(currentValue)) {
           return i18n.translate('xpack.osquery.pack.queryFlyoutForm.timeoutFieldMinNumberError', {
-            defaultMessage: 'Timeout value must be greater than {than} seconds.',
-            values: { than: QUERY_TIMEOUT.DEFAULT },
+            defaultMessage: 'The timeout value must be {timeoutInSeconds} seconds or higher.',
+            values: { timeoutInSeconds: QUERY_TIMEOUT.DEFAULT },
           });
         }
 
         if (currentValue > QUERY_TIMEOUT.MAX) {
           return i18n.translate('xpack.osquery.pack.queryFlyoutForm.timeoutFieldMaxNumberError', {
-            defaultMessage: 'Timeout value must be lower than {than} seconds.',
-            values: { than: QUERY_TIMEOUT.MAX },
+            defaultMessage: 'The timeout value must be {timeoutInSeconds} seconds or or lower. ',
+            values: { timeoutInSeconds: QUERY_TIMEOUT.MAX },
           });
         }
       },
@@ -61,7 +61,8 @@ const TimeoutFieldComponent = ({ euiFieldProps }: TimeoutFieldProps) => {
           <EuiFlexItem grow={false}>
             <EuiIconTip
               content={i18n.translate('xpack.osquery.liveQuery.timeoutHint', {
-                defaultMessage: 'Maximum time to wait for query results, default is 60 seconds.',
+                defaultMessage:
+                  'The default and minimum timeout period is 60 seconds. Increase this value if your query needs more time to run.',
               })}
             />
           </EuiFlexItem>

From ee8ec9ae3f7e450ff311c1bfd019f6b9e43ddd6d Mon Sep 17 00:00:00 2001
From: Elena Stoeva <59341489+ElenaStoeva@users.noreply.github.com>
Date: Tue, 30 Jan 2024 16:59:32 +0000
Subject: [PATCH 2/6] [Advanced settings] Add json validation to code editor
 field (#175779)

Closes https://github.com/elastic/kibana/issues/175728

## Summary

This PR adds JSON syntax validation to the code editor field, so that
the field components that don't use server-side `schema` validation
(such as the settings in APM) are also validated against JSON syntax.

**How to test:**
1. Start Es with `yarn es snapshot` and Kibana with `yarn start`.
2. Go to Observability -> APM -> Settings
3. Type in some invalid JSON in the
`observability:apmAWSLambdaPriceFactor` field and verify that an error
message is diplayed.

<img width="1178" alt="Screenshot 2024-01-29 at 11 19 35"
src="https://github.com/elastic/kibana/assets/59341489/eae01ee4-8503-4a36-ad09-1288abcd5142">
---
 .../field_input/input/code_editor_input.tsx   | 19 ++++++++++++
 .../input/json_editor_input.test.tsx          | 31 +++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/packages/kbn-management/settings/components/field_input/input/code_editor_input.tsx b/packages/kbn-management/settings/components/field_input/input/code_editor_input.tsx
index cbf53979efa83..101ac8897bb28 100644
--- a/packages/kbn-management/settings/components/field_input/input/code_editor_input.tsx
+++ b/packages/kbn-management/settings/components/field_input/input/code_editor_input.tsx
@@ -8,6 +8,7 @@
 
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
 
+import { i18n } from '@kbn/i18n';
 import { SettingType } from '@kbn/management-settings-types';
 import { getFieldInputValue, useUpdate } from '@kbn/management-settings-utilities';
 
@@ -55,6 +56,24 @@ export const CodeEditorInput = ({
     async (newValue: string, onUpdateFn) => {
       const isJsonArray = Array.isArray(JSON.parse(defaultValue || '{}'));
       const parsedValue = newValue || (isJsonArray ? '[]' : '{}');
+
+      // Validate JSON syntax
+      if (field.type === 'json') {
+        try {
+          JSON.parse(parsedValue);
+        } catch (e) {
+          onUpdateFn({
+            type: field.type,
+            unsavedValue: newValue,
+            isInvalid: true,
+            error: i18n.translate('management.settings.field.codeEditorSyntaxErrorMessage', {
+              defaultMessage: 'Invalid JSON syntax',
+            }),
+          });
+          return;
+        }
+      }
+
       const validationResponse = await validateChange(field.id, parsedValue);
       if (validationResponse.successfulValidation && !validationResponse.valid) {
         onUpdateFn({
diff --git a/packages/kbn-management/settings/components/field_input/input/json_editor_input.test.tsx b/packages/kbn-management/settings/components/field_input/input/json_editor_input.test.tsx
index ecc132dad8c89..eab463be60109 100644
--- a/packages/kbn-management/settings/components/field_input/input/json_editor_input.test.tsx
+++ b/packages/kbn-management/settings/components/field_input/input/json_editor_input.test.tsx
@@ -89,6 +89,21 @@ describe('JsonEditorInput', () => {
     );
   });
 
+  it('calls the onInputChange prop with an error when the object value changes to invalid JSON', async () => {
+    const { getByTestId } = render(wrap(<CodeEditorInput {...defaultProps} />));
+    const input = getByTestId(`${TEST_SUBJ_PREFIX_FIELD}-${id}`);
+    fireEvent.change(input, { target: { value: '{"bar" "foo"}' } });
+
+    await waitFor(() =>
+      expect(defaultProps.onInputChange).toHaveBeenCalledWith({
+        type: 'json',
+        unsavedValue: '{"bar" "foo"}',
+        error: 'Invalid JSON syntax',
+        isInvalid: true,
+      })
+    );
+  });
+
   it('calls the onInputChange prop when the array value changes', async () => {
     const props = { ...defaultProps, defaultValue: '["bar", "foo"]', value: undefined };
     const { getByTestId } = render(wrap(<CodeEditorInput {...props} />));
@@ -117,4 +132,20 @@ describe('JsonEditorInput', () => {
       expect(defaultProps.onInputChange).toHaveBeenCalledWith({ type: 'json', unsavedValue: '' })
     );
   });
+
+  it('calls the onInputChange prop with an array when the array value changes to invalid JSON', async () => {
+    const props = { ...defaultProps, defaultValue: '["bar", "foo"]', value: undefined };
+    const { getByTestId } = render(wrap(<CodeEditorInput {...props} />));
+    const input = getByTestId(`${TEST_SUBJ_PREFIX_FIELD}-${id}`);
+    fireEvent.change(input, { target: { value: '["bar", "foo" | "baz"]' } });
+
+    await waitFor(() =>
+      expect(defaultProps.onInputChange).toHaveBeenCalledWith({
+        type: 'json',
+        unsavedValue: '["bar", "foo" | "baz"]',
+        error: 'Invalid JSON syntax',
+        isInvalid: true,
+      })
+    );
+  });
 });

From 88b75009649a21fd500547622a3ed5641217b6e3 Mon Sep 17 00:00:00 2001
From: Alex Szabo <alex.szabo@elastic.co>
Date: Tue, 30 Jan 2024 18:18:55 +0100
Subject: [PATCH 3/6] [Ops/QA] Migrate coverage data to elastic's bucket
 (#175891)

## Summary
The currently used bucket for https://kibana-coverage.elastic.dev/ is
`gs://elastic-bekitzur-kibana-coverage-live/` - this is probably
belonging to an ex-elastician, now outside the company, we can't adjust
access rights to it, won't be able to set up proper IAM access on it in
the future.

We're migrating to this bucket: `gs://elastic-kibana-coverage-live/`.

To avoid having to copy over 6G of old coverage data, we're setting up
the pipeline that populates this bucket
(https://buildkite.com/elastic/kibana-code-coverage-main) to copy to
both for some time, then we shut down the old one, while the new has
some recent coverage data.
---
 .../steps/code_coverage/reporting/downloadPrevSha.sh      | 6 +++++-
 .../steps/code_coverage/reporting/uploadPrevSha.sh        | 5 ++++-
 .../steps/code_coverage/reporting/uploadStaticSite.sh     | 8 +++++++-
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.buildkite/scripts/steps/code_coverage/reporting/downloadPrevSha.sh b/.buildkite/scripts/steps/code_coverage/reporting/downloadPrevSha.sh
index e7158bb07b667..af7824841ef28 100755
--- a/.buildkite/scripts/steps/code_coverage/reporting/downloadPrevSha.sh
+++ b/.buildkite/scripts/steps/code_coverage/reporting/downloadPrevSha.sh
@@ -2,10 +2,14 @@
 
 set -euo pipefail
 
+# TODO: Safe to remove this after 2024-03-01 (https://github.com/elastic/kibana/issues/175904)
 gsutil -m cp -r gs://elastic-bekitzur-kibana-coverage-live/previous_pointer/previous.txt . || echo "### Previous Pointer NOT FOUND?"
 
+# TODO: Activate after the above is removed
+#gsutil -m cp -r gs://elastic-kibana-coverage-live/previous_pointer/previous.txt . || echo "### Previous Pointer NOT FOUND?"
+
 if [ -e ./previous.txt ]; then
     mv previous.txt downloaded_previous.txt
     echo "### downloaded_previous.txt"
     cat downloaded_previous.txt
-fi
\ No newline at end of file
+fi
diff --git a/.buildkite/scripts/steps/code_coverage/reporting/uploadPrevSha.sh b/.buildkite/scripts/steps/code_coverage/reporting/uploadPrevSha.sh
index 2c15dc34f38c2..26d84fa7d6024 100755
--- a/.buildkite/scripts/steps/code_coverage/reporting/uploadPrevSha.sh
+++ b/.buildkite/scripts/steps/code_coverage/reporting/uploadPrevSha.sh
@@ -9,4 +9,7 @@ collectPrevious() {
 }
 collectPrevious
 
-gsutil cp previous.txt gs://elastic-bekitzur-kibana-coverage-live/previous_pointer/
\ No newline at end of file
+# TODO: Safe to remove this after 2024-03-01 (https://github.com/elastic/kibana/issues/175904)
+gsutil cp previous.txt gs://elastic-bekitzur-kibana-coverage-live/previous_pointer/
+
+gsutil cp previous.txt gs://elastic-kibana-coverage-live/previous_pointer/
diff --git a/.buildkite/scripts/steps/code_coverage/reporting/uploadStaticSite.sh b/.buildkite/scripts/steps/code_coverage/reporting/uploadStaticSite.sh
index 02f2262075b89..93f2ca8660e60 100755
--- a/.buildkite/scripts/steps/code_coverage/reporting/uploadStaticSite.sh
+++ b/.buildkite/scripts/steps/code_coverage/reporting/uploadStaticSite.sh
@@ -4,18 +4,24 @@ set -euo pipefail
 
 xs=("$@")
 
-uploadPrefix="gs://elastic-bekitzur-kibana-coverage-live/"
+# TODO: Safe to remove this after 2024-03-01 (https://github.com/elastic/kibana/issues/175904) - also clean up usages
+uploadPrefix_old="gs://elastic-bekitzur-kibana-coverage-live/"
+uploadPrefixWithTimeStamp_old="${uploadPrefix}${TIME_STAMP}/"
+
+uploadPrefix="gs://elastic-kibana-coverage-live/"
 uploadPrefixWithTimeStamp="${uploadPrefix}${TIME_STAMP}/"
 
 uploadBase() {
   for x in 'src/dev/code_coverage/www/index.html' 'src/dev/code_coverage/www/404.html'; do
     gsutil -m -q cp -r -a public-read -z js,css,html "${x}" "${uploadPrefix}"
+    gsutil -m -q cp -r -a public-read -z js,css,html "${x}" "${uploadPrefix_old}"
   done
 }
 
 uploadRest() {
   for x in "${xs[@]}"; do
     gsutil -m -q cp -r -a public-read -z js,css,html "target/kibana-coverage/${x}-combined" "${uploadPrefixWithTimeStamp}"
+    gsutil -m -q cp -r -a public-read -z js,css,html "target/kibana-coverage/${x}-combined" "${uploadPrefixWithTimeStamp_old}"
   done
 }
 

From e69e971fb4a8f09b53ea75c61a22882c2f3ac207 Mon Sep 17 00:00:00 2001
From: Jorge Sanz <jorge.sanz@elastic.co>
Date: Tue, 30 Jan 2024 18:34:26 +0100
Subject: [PATCH 4/6] [Docs][EMS] Adding more details about connectivity and
 link to the stack docs (#175551)

Related to #174716

* Adds an intro paragraph mentioning the three options regarding EMS and
limited connectivity: set up a firewall, disable it fully, or install
Elastic Maps Server.
* Adds a reference to the Elastic Stack air-gapped guide.

Co-authored-by: Brandon Morelli <brandon.morelli@elastic.co>
---
 docs/maps/connect-to-ems.asciidoc | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/docs/maps/connect-to-ems.asciidoc b/docs/maps/connect-to-ems.asciidoc
index 8fac6a6d95c15..879d4846ef3f1 100644
--- a/docs/maps/connect-to-ems.asciidoc
+++ b/docs/maps/connect-to-ems.asciidoc
@@ -1,14 +1,17 @@
-[[maps-connect-to-ems]]
-== Connect to Elastic Maps Service
-
+:ems: Elastic Maps Service
 :ems-docker-repo: docker.elastic.co/elastic-maps-service/elastic-maps-server-ubi8
 :ems-docker-image: {ems-docker-repo}:{version}
 :ems-headers-url: https://deployment-host
 
-https://www.elastic.co/elastic-maps-service[Elastic Maps Service (EMS)] is a service that hosts
+[[maps-connect-to-ems]]
+== Connect to {ems}
+
+https://www.elastic.co/elastic-maps-service[{ems} (EMS)] is a service that hosts
 tile layers and vector shapes of administrative boundaries.
 If you are using Kibana's out-of-the-box settings, Maps is already configured to use EMS.
 
+If you are on a restricted or fully air-gapped environment, you may need to configure your firewall to enable access to EMS resources. Find below details on the domains and HTTP headers used by {ems}. Alternatively, {ems} can be <<disable-ems, disabled>> or <<elastic-maps-server, installed locally>>.
+
 [float]
 === Domains
 
@@ -57,7 +60,8 @@ include::headers/file-data.asciidoc[]
 
 
 [float]
-=== Disable Elastic Maps Service
+[id=disable-ems]
+=== Disable {ems}
 
 You might experience EMS connection issues if your Kibana server or browser are on a private network or
 behind a firewall. If this happens, you can disable the EMS connection to avoid unnecessary EMS requests.
@@ -69,11 +73,13 @@ To disable EMS, change your <<settings, kibana.yml>> file.
 
 [float]
 [id=elastic-maps-server]
-=== Host Elastic Maps Service locally
+=== Host {ems} locally
+
+NOTE: Find more details about installing Elastic components in an air-gapped environment in the {stack-ref}/air-gapped-install.html[Elastic Stack documentation].
 
-If you cannot connect to Elastic Maps Service from the {kib} server or browser clients, and your cluster has the appropriate license level, you can opt to host the service on your own infrastructure.
+If you cannot connect to {ems} from the {kib} server or browser clients, and your cluster has the appropriate license level, you can opt to host the service on your own infrastructure.
 
-{hosted-ems} is a self-managed version of Elastic Maps Service offered as a Docker image that provides both the EMS basemaps and EMS boundaries. The image is bundled with basemaps up to zoom level 8. After connecting it to your {es} cluster for license validation, you have the option to download and configure a more detailed basemaps database.
+{hosted-ems} is a self-managed version of {ems} offered as a Docker image that provides both the EMS basemaps and EMS boundaries. The image is bundled with basemaps up to zoom level 8. After connecting it to your {es} cluster for license validation, you have the option to download and configure a more detailed basemaps database.
 
 You can use +docker pull+ to download the {hosted-ems} image from the Elastic Docker registry.
 

From 82e22b3f765a77ba47ca8040a7deae16037aa0e1 Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Tue, 30 Jan 2024 19:52:49 +0200
Subject: [PATCH 5/6] [Expressions] Unskips test (#175879)

## Summary

Closes https://github.com/elastic/kibana/issues/156780
Unskips the expression tests

Flaky runner (50 times)
---
 test/examples/expressions_explorer/expressions.ts | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/test/examples/expressions_explorer/expressions.ts b/test/examples/expressions_explorer/expressions.ts
index d988f0ae22f92..cd796f3bfc3a1 100644
--- a/test/examples/expressions_explorer/expressions.ts
+++ b/test/examples/expressions_explorer/expressions.ts
@@ -17,8 +17,7 @@ export default function ({ getService }: PluginFunctionalProviderContext) {
   const find = getService('find');
   const browser = getService('browser');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/156780
-  describe.skip('', () => {
+  describe('', () => {
     it('runs expression', async () => {
       await retry.try(async () => {
         const text = await testSubjects.getVisibleText('expressionResult');
@@ -54,7 +53,7 @@ export default function ({ getService }: PluginFunctionalProviderContext) {
       await find.clickByCssSelector(selector);
       await retry.try(async () => {
         const text = await browser.getCurrentUrl();
-        expect(text).to.contain('https://www.google.com/');
+        expect(text).to.contain('https://www.google.com');
       });
     });
   });

From 0e22f756b7dedede7cb6444d55447364197f3e85 Mon Sep 17 00:00:00 2001
From: "Eyo O. Eyo" <7893459+eokoneyo@users.noreply.github.com>
Date: Tue, 30 Jan 2024 18:55:17 +0100
Subject: [PATCH 6/6] [Reporting] Puppeteer v21.9.0 upgrade (#175835)

## Summary

Upgrades Puppeteer to version 21.9.0

<!--
### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
-->
---
 package.json                                  |  2 +-
 .../chromium/driver_factory/args.test.ts      |  2 +-
 .../server/browsers/chromium/paths.ts         | 34 ++++----
 yarn.lock                                     | 80 +++++++++----------
 4 files changed, 59 insertions(+), 59 deletions(-)

diff --git a/package.json b/package.json
index b3e0fe4625e9e..80b0135011cab 100644
--- a/package.json
+++ b/package.json
@@ -1041,7 +1041,7 @@
     "pretty-ms": "6.0.0",
     "prop-types": "^15.8.1",
     "proxy-from-env": "1.0.0",
-    "puppeteer": "21.5.2",
+    "puppeteer": "21.9.0",
     "query-string": "^6.13.2",
     "rbush": "^3.0.1",
     "re-resizable": "^6.9.9",
diff --git a/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/args.test.ts b/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/args.test.ts
index 3e2cb57af3a88..6c736a97a52fe 100644
--- a/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/args.test.ts
+++ b/x-pack/plugins/screenshotting/server/browsers/chromium/driver_factory/args.test.ts
@@ -51,7 +51,7 @@ describe('headless webgl arm mac workaround', () => {
     // please double-check that the --use-angle flag is still needed for arm macs
     // instead of --use-angle you may need --enable-gpu
     expect(getChromiumPackage().binaryChecksum).toBe(
-      'a8556ed7ac2a669fa81f752f7d18a9d1e9b99b05d3504f6bbc08e3e0b02ff71e'
+      '2b5c892e3125eecd31b651f4632cbafabee3a31c02728dcddafee8d462ab075d'
     ); // just putting this here so that someone updating the chromium version will see this comment
   });
 });
diff --git a/x-pack/plugins/screenshotting/server/browsers/chromium/paths.ts b/x-pack/plugins/screenshotting/server/browsers/chromium/paths.ts
index 91c53aba46e77..c8e18d9459a9d 100644
--- a/x-pack/plugins/screenshotting/server/browsers/chromium/paths.ts
+++ b/x-pack/plugins/screenshotting/server/browsers/chromium/paths.ts
@@ -44,10 +44,10 @@ export class ChromiumArchivePaths {
       platform: 'darwin',
       architecture: 'x64',
       archiveFilename: 'chrome-mac.zip',
-      archiveChecksum: '35261c7a88f1797d27646c340eeaf7d7d70727f0c4ae884e8400240ed66d7192',
-      binaryChecksum: 'ca90fe7573ddb0723d633fe526acf0fdefdda570a549f35e15c111d10f3ffc0d',
+      archiveChecksum: '2577b515b871b507a9c830cdf5a360e6a966dc058e07307ad1a21a22ae681d4c',
+      binaryChecksum: '80287437016fd444f78822017c3dba939984b627c18cba57b052136323aa82ef',
       binaryRelativePath: 'chrome-mac/Chromium.app/Contents/MacOS/Chromium',
-      revision: 1204244, // 1204232 is not available for Mac Intel
+      revision: 1233115, // 1233107 is not available for Mac Intel
       location: 'common',
       archivePath: 'Mac',
       isPreInstalled: false,
@@ -56,10 +56,10 @@ export class ChromiumArchivePaths {
       platform: 'darwin',
       architecture: 'arm64',
       archiveFilename: 'chrome-mac.zip',
-      archiveChecksum: '1ed375086a9505ee6bc9bc1373bebd79e87e5b27af5a93258ea25ffb6f71f03c',
-      binaryChecksum: 'a8556ed7ac2a669fa81f752f7d18a9d1e9b99b05d3504f6bbc08e3e0b02ff71e',
+      archiveChecksum: 'c2219ea9dea838eef2ea350c4d2591fc91090fd7a920dfa010fa44d8c31db515',
+      binaryChecksum: '2b5c892e3125eecd31b651f4632cbafabee3a31c02728dcddafee8d462ab075d',
       binaryRelativePath: 'chrome-mac/Chromium.app/Contents/MacOS/Chromium',
-      revision: 1204255, // 1204232 is not available for Mac_Arm
+      revision: 1233124, // 1233107 is not available for Mac_Arm
       location: 'common',
       archivePath: 'Mac_Arm',
       isPreInstalled: false,
@@ -67,22 +67,22 @@ export class ChromiumArchivePaths {
     {
       platform: 'linux',
       architecture: 'x64',
-      archiveFilename: 'chromium-38c7255-locales-linux_x64.zip',
-      archiveChecksum: 'bf07734366ece771a85b2452fd63e5981b1abc234ef0ed1c7d0774b8a7b5c6a9',
-      binaryChecksum: '87a991c412ad333549a58524b6be23f2a1ff56af61bb1a1b10c1f4a0206edc2a',
+      archiveFilename: 'chromium-3f98d69-locales-linux_x64.zip',
+      archiveChecksum: '251e4cf450bfab59154a2a366e724db65df521016d3fc651e9fe5cbe6970b7b0',
+      binaryChecksum: 'cd888114440b25c29a653563e56a29dc1ae2cebbf335e557f99100c5402bc302',
       binaryRelativePath: 'headless_shell-linux_x64/headless_shell',
-      revision: 1204232,
+      revision: 1233107,
       location: 'custom',
       isPreInstalled: true,
     },
     {
       platform: 'linux',
       architecture: 'arm64',
-      archiveFilename: 'chromium-38c7255-locales-linux_arm64.zip',
-      archiveChecksum: '11c1cd2398ae3b57a72e7746e1f1cbbd2c2d18d1b83dec949dc81a3c690688f0',
-      binaryChecksum: '4d914034d466b97c438283dbc914230e087217c25028f403dfa3c933ea755e94',
+      archiveFilename: 'chromium-3f98d69-locales-linux_arm64.zip',
+      archiveChecksum: '87e59ba3fb20649301a27f56d3328d970812ecb473b23ad216f9122739a40bf0',
+      binaryChecksum: '2a44c60e7f85e47533beace3d5dc6271803f87e8fc2083e8cdc612e8cf4366b9',
       binaryRelativePath: 'headless_shell-linux_arm64/headless_shell',
-      revision: 1204232,
+      revision: 1233107,
       location: 'custom',
       isPreInstalled: true,
     },
@@ -90,10 +90,10 @@ export class ChromiumArchivePaths {
       platform: 'win32',
       architecture: 'x64',
       archiveFilename: 'chrome-win.zip',
-      archiveChecksum: 'd6f5a21973867115435814c2c46d49edd9a0a2ad6da14b4724746374cad80e47',
-      binaryChecksum: '9c0d2404004bd7c4ada649049422de6958460ecf6cec53460a478c6d8c33e444',
+      archiveChecksum: 'b7c04da4d51ee03eca5ffa6c440c951375147d913647375e30bd52e9d67c6caf',
+      binaryChecksum: '52fe4b81323c73d48cb50e80d16e61e1aced809e19d984d9df20169efdf63b5b',
       binaryRelativePath: path.join('chrome-win', 'chrome.exe'),
-      revision: 1204234, // 1204232 is not available for win
+      revision: 1233121, // 1233107 is not available for win
       location: 'common',
       archivePath: 'Win',
       isPreInstalled: true,
diff --git a/yarn.lock b/yarn.lock
index e0dd741228a76..b66b7c8ff450f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7517,10 +7517,10 @@
   resolved "https://registry.yarnpkg.com/@protobufjs/utf8/-/utf8-1.1.0.tgz#a777360b5b39a1a2e5106f8e858f2fd2d060c570"
   integrity sha1-p3c2C1s5oaLlEG+OhY8v0tBgxXA=
 
-"@puppeteer/browsers@1.8.0":
-  version "1.8.0"
-  resolved "https://registry.yarnpkg.com/@puppeteer/browsers/-/browsers-1.8.0.tgz#fb6ee61de15e7f0e67737aea9f9bab1512dbd7d8"
-  integrity sha512-TkRHIV6k2D8OlUe8RtG+5jgOF/H98Myx0M6AOafC8DdNVOFiBSFa5cpRDtpm8LXOa9sVwe0+e6Q3FC56X/DZfg==
+"@puppeteer/browsers@1.9.1":
+  version "1.9.1"
+  resolved "https://registry.yarnpkg.com/@puppeteer/browsers/-/browsers-1.9.1.tgz#384ee8b09786f0e8f62b1925e4c492424cb549ee"
+  integrity sha512-PuvK6xZzGhKPvlx3fpfdM2kYY3P/hB1URtK8wA7XUJ6prn6pp22zvJHu48th0SGcHL9SutbPHrFuQgfXTFobWA==
   dependencies:
     debug "4.3.4"
     extract-zip "2.0.1"
@@ -13206,10 +13206,10 @@ chromedriver@^120.0.0:
     proxy-from-env "^1.1.0"
     tcp-port-used "^1.0.2"
 
-chromium-bidi@0.4.33:
-  version "0.4.33"
-  resolved "https://registry.yarnpkg.com/chromium-bidi/-/chromium-bidi-0.4.33.tgz#9a9aba5a5b07118c8e7d6405f8ee79f47418dd1d"
-  integrity sha512-IxoFM5WGQOIAd95qrSXzJUv4eXIrh+RvU3rwwqIiwYuvfE7U/Llj4fejbsJnjJMUYCuGtVQsY2gv7oGl4aTNSQ==
+chromium-bidi@0.5.4:
+  version "0.5.4"
+  resolved "https://registry.yarnpkg.com/chromium-bidi/-/chromium-bidi-0.5.4.tgz#dcf60bbc510a0a1d19b35012d7bb53f82bb5f2ba"
+  integrity sha512-p9CdiHl0xNh4P7oVa44zXgJJw+pvnHXFDB+tVdo25xaPLgQDVf2kQO+TDxD2fp2Evqi7vs/vGRINMzl1qJrWiw==
   dependencies:
     mitt "3.0.1"
     urlpattern-polyfill "9.0.0"
@@ -13891,15 +13891,15 @@ core-util-is@1.0.2, core-util-is@^1.0.2, core-util-is@~1.0.0:
   resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.2.tgz#b5fd54220aa2bc5ab57aab7140c940754503c1a7"
   integrity sha1-tf1UIgqivFq1eqtxQMlAdUUDwac=
 
-cosmiconfig@8.3.6:
-  version "8.3.6"
-  resolved "https://registry.yarnpkg.com/cosmiconfig/-/cosmiconfig-8.3.6.tgz#060a2b871d66dba6c8538ea1118ba1ac16f5fae3"
-  integrity sha512-kcZ6+W5QzcJ3P1Mt+83OUv/oHFqZHIx8DuxG6eZ5RGMERoLqp4BuGjhHLYGK+Kf5XVkQvqBSmAy/nGWN3qDgEA==
+cosmiconfig@9.0.0:
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/cosmiconfig/-/cosmiconfig-9.0.0.tgz#34c3fc58287b915f3ae905ab6dc3de258b55ad9d"
+  integrity sha512-itvL5h8RETACmOTFc4UfIyB2RfEHi71Ax6E/PivVxq9NseKbOWpeyHEOIbmAw1rs8Ak0VursQNww7lf7YtUwzg==
   dependencies:
+    env-paths "^2.2.1"
     import-fresh "^3.3.0"
     js-yaml "^4.1.0"
     parse-json "^5.2.0"
-    path-type "^4.0.0"
 
 cosmiconfig@^6.0.0:
   version "6.0.0"
@@ -15207,10 +15207,10 @@ detective@^5.0.2:
     defined "^1.0.0"
     minimist "^1.1.1"
 
-devtools-protocol@0.0.1203626:
-  version "0.0.1203626"
-  resolved "https://registry.yarnpkg.com/devtools-protocol/-/devtools-protocol-0.0.1203626.tgz#4366a4c81a7e0d4fd6924e9182c67f1e5941e820"
-  integrity sha512-nEzHZteIUZfGCZtTiS1fRpC8UZmsfD1SiyPvaUNvS13dvKf666OAm8YTi0+Ca3n1nLEyu49Cy4+dPWpaHFJk9g==
+devtools-protocol@0.0.1232444:
+  version "0.0.1232444"
+  resolved "https://registry.yarnpkg.com/devtools-protocol/-/devtools-protocol-0.0.1232444.tgz#406345a90a871ba852c530d73482275234936eed"
+  integrity sha512-pM27vqEfxSxRkTMnF+XCmxSEb6duO5R+t8A9DEEJgy4Wz2RVanje2mmj99B6A3zv2r/qGfYlOvYznUhuokizmg==
 
 dezalgo@^1.0.0, dezalgo@^1.0.4:
   version "1.0.4"
@@ -15837,10 +15837,10 @@ entities@~2.1.0:
   resolved "https://registry.yarnpkg.com/entities/-/entities-2.1.0.tgz#992d3129cf7df6870b96c57858c249a120f8b8b5"
   integrity sha512-hCx1oky9PFrJ611mf0ifBLBRW8lUUVRlFolb5gWRfIELabBlbp9xZvrqZLZAs+NxFnbfQoeGd8wDkygjg7U85w==
 
-env-paths@^2.2.0:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/env-paths/-/env-paths-2.2.0.tgz#cdca557dc009152917d6166e2febe1f039685e43"
-  integrity sha512-6u0VYSCo/OW6IoD5WCLLy9JUGARbamfSavcNXry/eu8aHVFei6CD3Sw+VGX5alea1i9pgPHW0mbu6Xj0uBh7gA==
+env-paths@^2.2.0, env-paths@^2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/env-paths/-/env-paths-2.2.1.tgz#420399d416ce1fbe9bc0a07c62fa68d67fd0f8f2"
+  integrity sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==
 
 envinfo@^7.7.3:
   version "7.7.3"
@@ -25415,26 +25415,26 @@ pupa@^3.1.0:
   dependencies:
     escape-goat "^4.0.0"
 
-puppeteer-core@21.5.2:
-  version "21.5.2"
-  resolved "https://registry.yarnpkg.com/puppeteer-core/-/puppeteer-core-21.5.2.tgz#6d3de4efb2ae65f1ee072043787b75594e88035f"
-  integrity sha512-v4T0cWnujSKs+iEfmb8ccd7u4/x8oblEyKqplqKnJ582Kw8PewYAWvkH4qUWhitN3O2q9RF7dzkvjyK5HbzjLA==
+puppeteer-core@21.9.0:
+  version "21.9.0"
+  resolved "https://registry.yarnpkg.com/puppeteer-core/-/puppeteer-core-21.9.0.tgz#7462d5dd0571cd1e0580cc3729d7951cc6fe2505"
+  integrity sha512-QgowcczLAoLWlV38s3y3VuEvjJGfKU5rR6Q23GUbiGOaiQi+QpaWQ+aXdzP9LHVSUPmHdAaWhcvMztYSw3f8gQ==
   dependencies:
-    "@puppeteer/browsers" "1.8.0"
-    chromium-bidi "0.4.33"
+    "@puppeteer/browsers" "1.9.1"
+    chromium-bidi "0.5.4"
     cross-fetch "4.0.0"
     debug "4.3.4"
-    devtools-protocol "0.0.1203626"
-    ws "8.14.2"
+    devtools-protocol "0.0.1232444"
+    ws "8.16.0"
 
-puppeteer@21.5.2:
-  version "21.5.2"
-  resolved "https://registry.yarnpkg.com/puppeteer/-/puppeteer-21.5.2.tgz#0a4a72175c0fd0944d6486f4734807e1671d527b"
-  integrity sha512-BaAGJOq8Fl6/cck6obmwaNLksuY0Bg/lIahCLhJPGXBFUD2mCffypa4A592MaWnDcye7eaHmSK9yot0pxctY8A==
+puppeteer@21.9.0:
+  version "21.9.0"
+  resolved "https://registry.yarnpkg.com/puppeteer/-/puppeteer-21.9.0.tgz#ff6cb321f6d43c1f39ba74bbdfccf2b5ef0121af"
+  integrity sha512-vcLR81Rp+MBrgqhiXZfpwEBbyKTa88Hd+8Al3+emWzcJb9evLLSfUYli0QUqhofPFrXsO2A/dAF9OunyOivL6w==
   dependencies:
-    "@puppeteer/browsers" "1.8.0"
-    cosmiconfig "8.3.6"
-    puppeteer-core "21.5.2"
+    "@puppeteer/browsers" "1.9.1"
+    cosmiconfig "9.0.0"
+    puppeteer-core "21.9.0"
 
 pure-rand@^6.0.0:
   version "6.0.2"
@@ -31734,10 +31734,10 @@ write-file-atomic@^4.0.1, write-file-atomic@^4.0.2:
     imurmurhash "^0.1.4"
     signal-exit "^3.0.7"
 
-ws@8.14.2, ws@>=8.14.2, ws@^8.2.3, ws@^8.4.2, ws@^8.9.0:
-  version "8.14.2"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.14.2.tgz#6c249a806eb2db7a20d26d51e7709eab7b2e6c7f"
-  integrity sha512-wEBG1ftX4jcglPxgFCMJmZ2PLtSbJ2Peg6TmpJFTbe9GZYOQCDPdMYu/Tm0/bGZkw8paZnJY45J4K2PZrLYq8g==
+ws@8.16.0, ws@>=8.14.2, ws@^8.2.3, ws@^8.4.2, ws@^8.9.0:
+  version "8.16.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.16.0.tgz#d1cd774f36fbc07165066a60e40323eab6446fd4"
+  integrity sha512-HS0c//TP7Ina87TfiPUz1rQzMhHrl/SG2guqRcTOIUYD2q8uhUdNHZYJUaQ8aTGPzCh+c6oawMKW35nFl1dxyQ==
 
 ws@^7.3.1, ws@^7.4.2:
   version "7.5.9"