Test elastic-package#3919 - DO NOT MERGE

[elastic-vault-github-plugin-prod]

Update elastic-package reference to elastic/elastic-package@a6c50f7.
Automated by Buildkite build

Relates: elastic/elastic-package#3919

[infra-vault-gh-plugin-prod]

⏳ Build in-progress, with failures

• Buildkite Build
• Commit: 1dd4fe4

Failed CI Steps

• :elastic-cloud:📊 [security_detection_engine] Test for OOM issues against 9.6.0-SNAPSHOT ECH

cc @kcreddy

[github-actions]

TL;DR

The Buildkite failure is a test/runtime failure in the prebuilt-rules OOM FTR step: the install-prebuilt-rules API call returned 502 Bad Gateway instead of 200. Since this PR only swaps the elastic-package dependency to test elastic-package#3919, the failure is tied to that dependency change path, not a direct security_detection_engine package content edit.

Remediation

• Re-run the same Buildkite OOM test once to rule out a transient environment blip; if it reproduces, treat it as a regression in the elastic-package commit under test (a6c50f71fa46e3da7972b4177bb0ba00244371ca).
• Compare package artifacts generated by baseline vs this PR (especially the security_detection_engine prebuilt rules payload) and inspect Kibana server logs for the failed run to identify the exact server-side 502 trigger.

Investigation details

Root Cause

The failing job is the external FTR OOM suite (appex-qa-stateful-security-prebuilt-rules-ftr-oom-testing), and it fails at Kibana API assertion time in the test file:

• x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/oom_testing/install_prebuilt_rules/install_prebuilt_rules.ts:133

In this PR, the only code changes are dependency wiring changes:

• go.mod adds a replace github.com/elastic/elastic-package => github.com/kcreddy/elastic-package v0.51.3-0.20260910075350-a6c50f71fa46 (PR file diff)
• go.sum removes github.com/elastic/elastic-package v0.126.4 entries and adds github.com/kcreddy/elastic-package v0.51.3-0.20260910075350-a6c50f71fa46 entries (PR file diff)

So the failing surface is consistent with the dependency-under-test path rather than an unrelated integration package edit.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/49421
• Job/step: :test_tube: Run FTR OOM tests (package version: 9.5.5, EPR: ...epr-oom.estc.dev)
• Key log excerpt:
  • Error: expected 200 "OK", got 502 "Bad Gateway"
  • at Context.<anonymous> (.../install_prebuilt_rules.ts:133:10)
• Failed log file:
  • /tmp/gh-aw/buildkite-logs/appex-qa-stateful-security-prebuilt-rules-ftr-oom-testing-test_tube-run-ftr-oom-tests-package-version-955-epr-httpsbk.txt

Verification

• Not run locally: this failure is from a remote, stateful OOM FTR environment and requires Buildkite/Kibana runtime logs from that environment.

Follow-up

• If reproducible, open or update the linked elastic-package#3919 thread with the failing OOM step and attach Kibana server logs around the 502 response.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.