Backport of 'Update GitLab Elasticsearch Indexer to 5.14.14' to 19.2

John Masonrequested to merge
jmason-backport-indexer-5-14-14-19-2-v2 into 19-2-stable-ee

🤖 AI-authored change.

What does this MR do and why?

Bumps GITLAB_ELASTICSEARCH_INDEXER_VERSION from 5.14.13 to 5.14.14, because the current 5.14.13 pin builds the indexer with jackc/pgx/v5 5.8.0 — below the 5.9.0 fixed line for CVE-2026-33816 (CVSS 9.8, out-of-bounds write from malicious database responses). This is a security fix, not a version tidy: v5.14.13 was cut from the v5.14.7 lineage rather than from main, so pinning it moved the indexer's dependencies backwards. pgx is a direct dependency, imported in indexer code.

v5.14.14 is the union of both lineages, so this one bump closes it with no cherry-picking: pgx 5.10.0 and go 1.26.0 restored, ICU charset-conversion fix kept. Also restored: x/crypto 0.52.0, x/net 0.55.0, grpc 1.80.0, a goroutine-leak fix, Debian base image 13.

Follows !255533 (merged)

Reviewer focus: whether a patch release is the right vehicle for a dependency regression of this severity, or whether it should route through the security repo.

MR acceptance checklist

  • Backporting a fix previously merged in the default branch.
  • The default-branch MR has been deployed to GitLab.com.
  • The MR title is descriptive.
  • Required labels applied.
    • severity and bug subtype labels (if applicable)
    • customer label if this affects customers.
  • Approved by a maintainer (one approval required).
  • e2e:test-on-omnibus-ee has succeeded, or its failures were investigated.

🤖 Automated change — mention me to get a response. Feedback welcome. Ask to speak to John directly anytime.

Mechanism, citations and verification (for agents / deep readers)

Mechanism

One line in GITLAB_ELASTICSEARCH_INDEXER_VERSION. Omnibus and the GDK read that file to pick the gitlab-elasticsearch-indexer tag they build, so the pin is the whole delivery path.

Verification

Read from tags in a local clone of gitlab-org/gitlab-elasticsearch-indexer:

  • go.mod at v5.14.13: github.com/jackc/pgx/v5 v5.8.0, go 1.25.0. At v5.14.12 and v5.14.14: v5.10.0, go 1.26.0.
  • git merge-base --is-ancestor v5.14.12 v5.14.14 exits 0; the same test against v5.14.13 exits 1.
  • pgx is imported at internal/mode/chunk/client/postgresql/postgresql.go and internal/mode/chunk/indexer/postgresql/indexer.go.
  • Branch cut from origin/19-2-stable-ee at df82cb15. git diff --stat names only GITLAB_ELASTICSEARCH_INDEXER_VERSION: 1 file changed, 1 insertion, 1 deletion.
  • Advisories: GHSA-9jj7-4m8r-rfcm / GO-2026-4772 (CVE-2026-33816), GHSA-xgrm-4fwx-7qm8 (CVE-2026-33815).
  • Patch release process: https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/patch/engineers.md

What I did not verify

  • No indexer binary was built from v5.14.14 against this branch; the claim rests on tag contents and the pipeline.
  • Whether any deployment has actually been reached through the vulnerable pgx path.
  • Whether release managers want the ICU fix and the dependency restoration recorded as separate patch-release entries.

Merge request reports