Skip to content

[9.0] [Security Solution] Reverts all remaining diff algorithm fields to return Target version when base version is missing (#214287)#214517

Merged
kibanamachine merged 1 commit intoelastic:9.0from
kibanamachine:backport/9.0/pr-214287
Mar 14, 2025
Merged

Conversation

@kibanamachine
Copy link
Contributor

Backport

This will backport the following commits from main to 9.0:

Questions ?

Please refer to the Backport tool documentation

…turn Target version when base version is missing (elastic#214287)

## Summary

Originally we had intended to have the prebuilt rule diff algorithms
merge non-functional fields when the field's base version was missing
and a rule was marked as customized as described in
elastic#210358

> - When the rule has a missing base version and is marked as
customized:
> - We should attempt to merge all non-functional mergeable fields (any
field that doesn't have consequences with how the rule runs e.g. tags)
and return them as SOLVABLE_CONFLICT

We ended up changing this logic to return the `Target` version for every
field that fit that description
(elastic#214161 and
elastic#213757) besides `tags` and in
order to support consistency rather than a very minor edge case, we now
just return the target version for every field with a missing base
version and let users sort it out on their end

This PR reverts the changes made to accommodate this edge case and
updates related tests to account for the new logic

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
(cherry picked from commit a2d2054)
@kibanamachine kibanamachine merged commit 2b0f94a into elastic:9.0 Mar 14, 2025
12 checks passed
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

cc @dplumlee

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants