[AUTO] Add release notes for 3.8.0

[opensearch-ci-bot]

Add release notes for 3.8.0

Borderline Calls

• Fix unbounded recursion in deserialization that can cause StackOverflowError #22404 appears in both Enhancements (depth tracking) and Bug Fixes (unbounded recursion fix) because the PR contains both a security hardening enhancement and a bug fix; listed in both as the PR description frames it both ways.
• Disable Mustache partial template resolution in CustomMustacheFactory #22438 (Mustache partial template) categorized as Enhancement (security hardening) rather than Bug Fix since partial resolution was never intended to work, not a defect per se.
• Strengthen scroll_id validation #22396 (scroll_id validation) categorized as Enhancement (hardening) rather than Bug Fix since the prior behavior was by-design but exploitable.
• Validate base_path in FsRepository to prevent path.repo containment bypass #22328 (base_path validation) and fix(analysis): Add path boundary validation in resolveAnalyzerPath #22094 (analyzer path validation) categorized as Enhancements (security hardening) rather than Features since they add validation to existing functionality.
• Use binary serde for resource usage headers #21230 (binary serde for resource usage headers) categorized as Enhancement rather than Feature since it improves an existing mechanism's performance.
• [Search Pipelines] Preserve resolved pipeline id and inline pipeline source through query rewrite #22501 (search pipeline preservation) categorized as Enhancement since it fixes a gap in existing pipeline functionality rather than adding new capability.
• fix: Separate internal ignore settings from user ignore settings in restore #20494 (internal ignore settings in restore) categorized as Enhancement since it improves existing restore behavior.
• Add process-wide ObjectInputFilter to reject Java deserialization by default #22073 (serial filter) categorized as Feature since it introduces a new security mechanism gated behind a setting.
• Excluded all analytics-engine/sandbox/DataFusion PRs (Add DataFusion physical plan to profile output #22112, [Analytics Engine] Add DF metrics to profile API response #21972, Add Rust UDFs for json, json_object, json_array #22130, Add composite-engine stats and parquet ingest rejection/pool metrics #22134, Add fancy-regex to Cargo.lock (follow-up to #22002) #22057, Projection pushdown below Exchange + QTF adaptation #22082, etc.) as they are part of an experimental sandbox feature not yet GA, and most are internal engine improvements not directly user-facing for the core release.
• Excluded Add indexing throttle on merge pressure for DataFormatAwareEngine #22319 (indexing throttle) because it was reverted in the same release (Revert "Add indexing throttle on merge pressure for DataFormatAwareEngine (#22319) #22335).
• Excluded maintainer additions (Add Arpit Bandejiya (alchemist51) as a maintainer #22389, Add navneet1v as a maintainer #22519), affiliation updates (Update affiliation for @RS146BIJAY #22425, Update affiliation for @msfroh #22418), CI/workflow changes (Onboard new backport-pr re-usable github workflow (OpenSearch) #22310, Use commit SHA for github actions & branches for resuable workflows #22138, Use github default token for releases #22397, Add rustfmt check to sandbox CI #22369, Publish logger usage checker #22043), documentation fixes ([BUG] Fix broken Gradle Shadow Plugin links #22513, Update -PinstalledPlugins documentation to reflect opensearch-security plugin requirements #22469, fix: correct typos in comments and documentation #22446, fix: remove duplicated words and grammar issues in comments #22447), version bump (Bump version to 3.8 #22090), and test-only fixes.
• Rollover: scope checkBlock to write index only, skipping non-write alias members #21838 (rollover checkBlock scoping) categorized as Enhancement rather than Bug Fix — it's debatable but the PR describes it as fixing incorrect behavior that blocked valid rollovers.
• Deprecate REST client (finally) #22116 (deprecate RestClient) categorized as Enhancement since deprecation is a signal to users about migration path.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected